General

  • Target

    NEW ORDER FOR SUPPLY Ref PO-298721.doc

  • Size

    9KB

  • Sample

    220518-s7v75aebcr

  • MD5

    999da45debe8277aa7669c3794c3e20a

  • SHA1

    4f5d7562a57253fc3d9e08e966a446124dc73314

  • SHA256

    5a2ba485918f8ae4dbe016d972fb1106ce28e5f4a003ab86d82c49db38c921e2

  • SHA512

    6ac8e668cf358d4b095b610b381921e596c5fe507238108d633e42386830863e658bec07ca1e7a3e33aa18658b40a8b6db837480f5e27b7048293c9f1378b236

Score
10/10

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

r007

Decoy

trashpandaservice.com

mobileads.network

ascolstore.com

gelsinextra.com

bonestell.net

heitoll.xyz

ceapgis.com

mon-lapin.biz

miq-eva.com

rematedesillas.com

playingonline.xyz

hausense.quest

tnyzw.com

appsdial.com

addcolor.city

hagenoblog.com

michaelwesleyj.com

she-zain.com

lorhsems.com

karmaserena.com

Targets

    • Target

      NEW ORDER FOR SUPPLY Ref PO-298721.doc

    • Size

      9KB

    • MD5

      999da45debe8277aa7669c3794c3e20a

    • SHA1

      4f5d7562a57253fc3d9e08e966a446124dc73314

    • SHA256

      5a2ba485918f8ae4dbe016d972fb1106ce28e5f4a003ab86d82c49db38c921e2

    • SHA512

      6ac8e668cf358d4b095b610b381921e596c5fe507238108d633e42386830863e658bec07ca1e7a3e33aa18658b40a8b6db837480f5e27b7048293c9f1378b236

    Score
    10/10
    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • Xloader Payload

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Execution

Exploitation for Client Execution

1
T1203

Defense Evasion

Modify Registry

1
T1112

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Tasks