Overview

overview

10

Static

static

OVGSGNLTK9...S.xlsx

windows7_x64

10

OVGSGNLTK9...S.xlsx

windows10-2004_x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    OVGSGNLTK982022 TDR IRIS MIKO 19S.xlsx

  • Size

    176KB

  • Sample

    220705-mesnmsgbcr

  • MD5

    412a8c592355ec728eb128d77a1824cf

  • SHA1

    76a6c61631edb07a0663ab214a57628f460e67fd

  • SHA256

    9d4afb06bbe9a89173e3bdf8b5b8472e52d87c7ca44468d3a5d4681d88bec129

  • SHA512

    8cd985bc5c8061ae1f5b04fade9478ef02125649869027030b4879c68255f7e4376cbdf651497052014562274453609948661e3917338ef6d1b7e1fffe6e6e25

Score
10/10
formbookxloadera2esloaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

a2es

Decoy

glutenfreebahrain.com

sportrid.com

js-films.com

cie-revolver.com

outsourcinginstitutebd.com

roboticsdatascience.com

tebrunk.com

needgreatwork.com

df1b8j2iwbl33n.life

voluum-training.com

cherna-roza.com

xiyouap.com

bluefiftyfoundation.com

angolettomc.com

yhcp225.com

keondredejawn.com

ifeelsilky.com

coraorganizing.com

smartmindstutorials.com

tanphucuong.info

Targets

    • Target

      OVGSGNLTK982022 TDR IRIS MIKO 19S.xlsx

    • Size

      176KB

    • MD5

      412a8c592355ec728eb128d77a1824cf

    • SHA1

      76a6c61631edb07a0663ab214a57628f460e67fd

    • SHA256

      9d4afb06bbe9a89173e3bdf8b5b8472e52d87c7ca44468d3a5d4681d88bec129

    • SHA512

      8cd985bc5c8061ae1f5b04fade9478ef02125649869027030b4879c68255f7e4376cbdf651497052014562274453609948661e3917338ef6d1b7e1fffe6e6e25

    Score
    10/10
    formbookxloadera2esloaderpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Adds policy Run key to start application

      persistence

    • Blocklisted process makes network request

    • Downloads MZ/PE file

    • Executes dropped EXE

    • Loads dropped DLL

    • Uses the VBS compiler for execution

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1
T1064

Exploitation for Client Execution

1
T1203

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

2
T1112

Scripting

1
T1064

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks