General

  • Target

    Siparis onayi eklendi.exe

  • Size

    769KB

  • Sample

    230502-nlxrlscf8z

  • MD5

    ad5bb0335bbe8103b8d328d87bfabff5

  • SHA1

    7fbba6bb27897dd6a53a7784d0b764d49af23fc0

  • SHA256

    8d82a0a70b5e08f94c099d225990c4725f14f85b35b6b8d0c93e801b43553a7a

  • SHA512

    ad22a382c6933a876eb9d988969a37e1cb66aef904007dff8197e2313be845fb51df35ffd3ae06fc2268554f8029fd74347c81951a168af19ee07988e65db5d0

  • SSDEEP

    12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNahnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeWszhxN2rn4P

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uj3c

Decoy

copimetro.com

choonchain.com

luxxwireless.com

fashionweekofcincinnati.com

campingshare.net

suncochina.com

kidsfundoor.com

testingnyc.co

lovesoe.com

vehiclesbeenrecord.com

socialpearmarketing.com

maxproductdji.com

getallarticle.online

forummind.com

arenamarenostrum.com

trisuaka.xyz

designgamagazine.com

chateaulehotel.com

huangse5.com

esginvestment.tech

Targets

    • Target

      Siparis onayi eklendi.exe

    • Size

      769KB

    • MD5

      ad5bb0335bbe8103b8d328d87bfabff5

    • SHA1

      7fbba6bb27897dd6a53a7784d0b764d49af23fc0

    • SHA256

      8d82a0a70b5e08f94c099d225990c4725f14f85b35b6b8d0c93e801b43553a7a

    • SHA512

      ad22a382c6933a876eb9d988969a37e1cb66aef904007dff8197e2313be845fb51df35ffd3ae06fc2268554f8029fd74347c81951a168af19ee07988e65db5d0

    • SSDEEP

      12288:Hu+e4v0ma0dwwcQNHRh+ZXiwBdbPmWNahnBMQfhxN2rn4PhWu7:HuRQq0iwcmhEffeWszhxN2rn4P

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

    • Xloader

      Xloader is a rebranded version of Formbook malware.

    • ModiLoader Second Stage

    • Xloader payload

    • Adds Run key to start application

    • Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Tasks