Overview

overview

10

Static

static

DUM 70-779 D.xlsx

windows7_x64

10

DUM 70-779 D.xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    DUM 70-779 D.xlsx

  • Size

    186KB

  • Sample

    220224-dj5pbsdbdm

  • MD5

    7b9ee6d79797a5845aaddea358f7e48c

  • SHA1

    f29b722e3560b260a3e628cc3427caff8792e8cb

  • SHA256

    4fccd7e86fa78a3510dc1e5bac951cfe95dfb6629536e22d0cadf00f049de500

  • SHA512

    76106377f35227621299b0da90f5286cff45cdc7bb3315506d08d411bddc2dcef3283e8a0ff731efff0f2eaeb265669d3f66f71636e80d2b1d3b2846ccc16787

Score
10/10
xloaderp2a5loaderratsuricata

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

p2a5

Decoy

gorillaslovebananas.com

zonaextasis.com

digitalpravin.online

memorialdoors.com

departmenteindhoven.com

vipulb.com

ruyibao365.com

ynpzz.com

matthewandjessica.com

winfrey2024.com

janetride.com

arairazur.xyz

alltheheads.com

amayawebdesigns.com

califunder.com

blacksource.xyz

farmasi.agency

ilmkibahar.com

thinkcentury.net

eskortclub.com

Targets

    • Target

      DUM 70-779 D.xlsx

    • Size

      186KB

    • MD5

      7b9ee6d79797a5845aaddea358f7e48c

    • SHA1

      f29b722e3560b260a3e628cc3427caff8792e8cb

    • SHA256

      4fccd7e86fa78a3510dc1e5bac951cfe95dfb6629536e22d0cadf00f049de500

    • SHA512

      76106377f35227621299b0da90f5286cff45cdc7bb3315506d08d411bddc2dcef3283e8a0ff731efff0f2eaeb265669d3f66f71636e80d2b1d3b2846ccc16787

    Score
    10/10
    xloaderp2a5loaderratsuricata

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

      suricata

    • Xloader Payload

      rat

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Privilege Escalation

Defense Evasion

Scripting

1
T1064

Modify Registry

1
T1112

Credential Access

Discovery

System Information Discovery

3
T1082

Query Registry

2
T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks