Overview

overview

10

Static

static

3

Proforma I...ed.exe

windows7-x64

10

Proforma I...ed.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    Proforma Invoice attached.zip

  • Size

    412KB

  • Sample

    230605-tnhncsab3x

  • MD5

    6f9548baa03697bfce8624e7b510c21e

  • SHA1

    34ef543afcb5833d03e39e98dfacbb49bc4a2032

  • SHA256

    06862bd815afb961a4dd3aa604744d9bb553bc9f111dd87c221430c8f5e3ef9c

  • SHA512

    01fc9df577905ccd56422de6bfb699744d8d1187eb1921b81873869376714cf24c0c28d93b865a06d633432267e57b1b9f4ecdf5896df07a07683cbe02b348ab

  • SSDEEP

    6144:ZDNCSPPrTQ2Xjpp2nj+/CRWmlr1xifnFMI+sW4I8hSos+Ju2fBhm9IupT/Y10ESt:Z4yTQ4bkj+KjrkFJWh8/gMBMjpTAuXkO

Score
10/10
modiloaderxloaderuj3cloaderpersistencerattrojan

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uj3c

Decoy

copimetro.com

choonchain.com

luxxwireless.com

fashionweekofcincinnati.com

campingshare.net

suncochina.com

kidsfundoor.com

testingnyc.co

lovesoe.com

vehiclesbeenrecord.com

socialpearmarketing.com

maxproductdji.com

getallarticle.online

forummind.com

arenamarenostrum.com

trisuaka.xyz

designgamagazine.com

chateaulehotel.com

huangse5.com

esginvestment.tech

Targets

    • Target

      Proforma Invoice attached.exe

    • Size

      805KB

    • MD5

      dab7cc983ca9542bd96062d675128a57

    • SHA1

      13d832f3e6a884dfee1b05c4fe9ab7f754c8607c

    • SHA256

      e399bdc24cb76e8ebdfef7bba94b18031fe0b4fd3664fcad763e77b1e4b2da86

    • SHA512

      de268296462fe12039fc316b4674b4bc20e4ad4140e198ea5f8fc38d42e7434c8ba4e47b76b5cebad4b692e828a7d0423f1b01ebf7cefbb7abfc52f05f0697e3

    • SSDEEP

      12288:29Id6OrPwqTQAwBTTvY0Z3l9+P/bnqvPPOmWnADUcHjNEU:29XyTFwtTpZ1E32POM7m

    Score
    10/10
    modiloadertrojanxloaderuj3cloaderpersistencerat

    • ModiLoader, DBatLoader

      ModiLoader is a Delphi loader that misuses cloud services to download other malicious families.

      trojanmodiloader

    • Xloader

      Xloader is a rebranded version of Formbook malware.

      loaderxloader

    • ModiLoader Second Stage

    • Xloader payload

      rat

    • Blocklisted process makes network request

    • Executes dropped EXE

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks