Overview

overview

10

Static

static

1

New Order.exe

windows7_x64

10

New Order.exe

windows10-2004_x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    753bcec81b68d95f0866670270587e29

  • Size

    804KB

  • Sample

    220707-f8gd5sfhg6

  • MD5

    753bcec81b68d95f0866670270587e29

  • SHA1

    a50f381e3ddb2ba40fffffe2723f48aa9c3e43b3

  • SHA256

    cef18ff96d859568d9f54431c4d174a3c99685855ea86927ceb3849c9c4aa3a9

  • SHA512

    88304eb0797f7c9ef15671375270fdb4ac975bb893bcf4a1566344aa583efe66bc2ff35fdd5f67386e466cac2878c59a850e5832b50a942648987756b8d59233

Score
10/10
formbookxloadernmd2loaderpersistenceratspywarestealersuricatatrojan

Malware Config

Extracted

Family

xloader

Version

2.8

Campaign

nmd2

Decoy

FNWENUOMqqSv0Q==

ls6DEbQ1KBCeSsvUyRg=

mwgrjwpFplaykGoT

Uzzj8yXi13iLMnNGZcnViQliwA==

T7vzj0l0lqquyA==

csHzBjwvF7rmjcmWxjThd61NuuVl4gQ=

YaXyTwg3p1vrf/n9kYJQjrc=

cHAfFEI1JKDF4mTsGjDbeg==

TdDv+o9VSFep3wgTtY0swqQ=

Jw66vdyXdRZG9jJZycLD

icGvsuKZgXNid1M=

6m6H0GvguY+vZZpcioudbQ==

kNUBYMuymhgm2b0q3bEAiQliwA==

M3SiAXRbVe0XAsxDOIp6cg==

+eWLk+HjRRe3LuyavQ==

753R3QYD8XOWtWI0ouGpYw==

dRg+bQZ6TSbC8Sbs2mXXxLM=

kDlUsE+U7Y/RfUQ=

oENlcFZVqqSv0Q==

HCC+nbachxEs1f29GjDbeg==

Targets

    • Target

      New Order.exe

    • Size

      540KB

    • MD5

      3e1c3ccd576afbb899714b3985451a62

    • SHA1

      b5e8b705c021abbe2035b2d50fbbd13a38d0eaf0

    • SHA256

      901b8ec8346c9ec07fb34f17b2eb18f45d6197b0cbb1d7bad6b1cf23ff0cbab1

    • SHA512

      85b7166b27b2ea70377a95e838e75dd474fe4041776fdc654ce8984775b9ea1a33a487b74843a7e5cc612889b1751fe342019e7a764d5022fbd899b72bc16ddd

    Score
    10/10
    formbookxloadernmd2loaderpersistenceratspywarestealersuricatatrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata: ET MALWARE FormBook CnC Checkin (GET)

      suricata

    • Xloader Payload

      rat

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Deletes itself

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks