Overview

overview

10

Static

static

Invoice.rtf

windows7_x64

10

Invoice.rtf

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Invoice.doc

  • Size

    10KB

  • Sample

    220208-hm3rcseehp

  • MD5

    df2d87d5b96bcabef5a4b2ae308f666c

  • SHA1

    68003034d1daaf5c59e5d61cdec603206239bb1b

  • SHA256

    73e13cce94f79361f590bc566a28b0434685b05419685da43e0163a05132a5d3

  • SHA512

    53295ae634abd9feca03bd2833ce10b7e3ab5c73b3f59b9e1a97903679282d27963880b24e02770c52c31487f55ef97ef256e6829e4558c2be056c971502ab10

Score
10/10
xloaders9neloaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

s9ne

Decoy

digital-performance-award.com

fioratti.xyz

designluxre.com

cngangdun.com

restaurantperladelmare.com

davinci65.info

glossmans.com

firstsmileimaging.com

indevmobility.biz

mvptcodesupport.com

crustenc.net

raleighsportsacademy.com

boytoyporn.com

rojaspass.com

acmepaysage.fr

shopatdean.xyz

leonergsteve18870.com

elnahuel.com

ils.network

canto-libero.com

Targets

    • Target

      Invoice.doc

    • Size

      10KB

    • MD5

      df2d87d5b96bcabef5a4b2ae308f666c

    • SHA1

      68003034d1daaf5c59e5d61cdec603206239bb1b

    • SHA256

      73e13cce94f79361f590bc566a28b0434685b05419685da43e0163a05132a5d3

    • SHA512

      53295ae634abd9feca03bd2833ce10b7e3ab5c73b3f59b9e1a97903679282d27963880b24e02770c52c31487f55ef97ef256e6829e4558c2be056c971502ab10

    Score
    10/10
    xloaders9neloaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks