Overview

overview

10

Static

static

10

shipping d...s.docx

windows7_x64

10

shipping d...s.docx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    shipping documents.docx

  • Size

    10KB

  • Sample

    220622-lsv59acfdj

  • MD5

    360b36979a2aeffc7ea67395ca4ddb52

  • SHA1

    cf7943291b5a26ce4367d45e6744fd4b3de52dc8

  • SHA256

    60d0cce487b135cd6d8c2ee01066215fedde843a1f12721750e4f1adfcccde9a

  • SHA512

    fc022909b66b91eb2f75f1bbc7b801bfc49bd6f36cc6d4d37a2c906eaa94dd9de9ed35f828361c254dd079440055fb016fa37acc4f969009e6bd4ff6ad547e1e

Score
10/10
formbookxloaderpdrqevasionloaderpersistenceratspywarestealersuricatatrojanwebsettings

Malware Config

Extracted

Rule
Microsoft Office WebSettings Relationship
C2

https://itop.so/uCrEk

Extracted

Family

xloader

Version

2.6

Campaign

pdrq

Decoy

welchsunstar.com

mppservicesllc.com

wiresofteflon.com

brabov.xyz

compnonoch.site

yourbuilderworks.com

iamsamirahman.com

eriqoes.com

eastudio.design

skyearth-est.com

teethfitness.com

razaancreates.com

shfbfs.com

joyfulbrokekids.com

kjbolden.com

howirep.com

deedeesmainecoons.website

e-powair.com

aheatea.com

shalfey0009.xyz

Targets

    • Target

      shipping documents.docx

    • Size

      10KB

    • MD5

      360b36979a2aeffc7ea67395ca4ddb52

    • SHA1

      cf7943291b5a26ce4367d45e6744fd4b3de52dc8

    • SHA256

      60d0cce487b135cd6d8c2ee01066215fedde843a1f12721750e4f1adfcccde9a

    • SHA512

      fc022909b66b91eb2f75f1bbc7b801bfc49bd6f36cc6d4d37a2c906eaa94dd9de9ed35f828361c254dd079440055fb016fa37acc4f969009e6bd4ff6ad547e1e

    Score
    10/10
    formbookxloaderpdrqevasionloaderpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Looks for VirtualBox Guest Additions in registry

      evasion

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Looks for VMWare Tools registry key

      evasion

    • Abuses OpenXML format to download file from external location

    • Checks BIOS information in registry

      BIOS information is often read in order to detect sandboxing environments.

    • Loads dropped DLL

    • Reads user/profile data of web browsers

      Infostealers often target stored browser data, which can include saved credentials etc.

      spywarestealer

    • Uses the VBS compiler for execution

    • Maps connected drives based on registry

      Disk information is often read in order to detect sandboxing environments.

    • Drops file in System32 directory

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Modify Registry

3
T1112

Scripting

1
T1064

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

6
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

5
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Data from Local System

1
T1005

Exfiltration

Command and Control

Impact

Tasks