Overview

overview

10

Static

static

QUOTATION.exe

windows7_x64

10

QUOTATION.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    QUOTATION.exe

  • Size

    564KB

  • Sample

    220209-mdncjaabdp

  • MD5

    98baccb2a35dcd64991688d8c2f9863e

  • SHA1

    2cf34e18ccb91d2e0572ec833f8656178f4e834b

  • SHA256

    33b08940d5a2fdd70c73fddf7e359193eb86a1d42e7cce27dba02718b7279c49

  • SHA512

    caf53ba7e93e0f781877cfc318b429dbec9490b443ff8e5533f5ef0c89a1f612ac6e7cc245c99b34ffbf4c9bad95c8e2a183e7faffba3ce78a8b23b1c4757e54

Score
10/10
xloadernt3floaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Targets

    • Target

      QUOTATION.exe

    • Size

      564KB

    • MD5

      98baccb2a35dcd64991688d8c2f9863e

    • SHA1

      2cf34e18ccb91d2e0572ec833f8656178f4e834b

    • SHA256

      33b08940d5a2fdd70c73fddf7e359193eb86a1d42e7cce27dba02718b7279c49

    • SHA512

      caf53ba7e93e0f781877cfc318b429dbec9490b443ff8e5533f5ef0c89a1f612ac6e7cc245c99b34ffbf4c9bad95c8e2a183e7faffba3ce78a8b23b1c4757e54

    Score
    10/10
    xloadernt3floaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks