Overview

overview

10

Static

static

S28BW-4211...0.xlsx

windows7_x64

10

S28BW-4211...0.xlsx

windows10-2004_x64

4

Sharing

Copy URL
Twitter E-mail

General

  • Target

    S28BW-421122909390.xlsx

  • Size

    187KB

  • Sample

    220222-h5jq7seac2

  • MD5

    96d83ce629445d8534e77eeb35d19c56

  • SHA1

    7add8952900d884d16ad7ebae1b97e97f4fae534

  • SHA256

    2e2ff6465fbc6043dc75bc1d6d15144fcc51f7860333f208cef6ec4c098f856e

  • SHA512

    fef94f86161f7f853a98d3ae4d55263fbbae33fc5b723613b39847254e6dbb7543bc190a949539cc1e13c590893e2a8f89b47ee2b188874ea779f51b7b1cd41c

Score
10/10
xloaderp2a5loaderrat

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      S28BW-421122909390.xlsx

    • Size

      187KB

    • MD5

      96d83ce629445d8534e77eeb35d19c56

    • SHA1

      7add8952900d884d16ad7ebae1b97e97f4fae534

    • SHA256

      2e2ff6465fbc6043dc75bc1d6d15144fcc51f7860333f208cef6ec4c098f856e

    • SHA512

      fef94f86161f7f853a98d3ae4d55263fbbae33fc5b723613b39847254e6dbb7543bc190a949539cc1e13c590893e2a8f89b47ee2b188874ea779f51b7b1cd41c

    Score
    10/10
    xloaderp2a5loaderrat

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Command-Line Interface

1
T1059

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

4
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks