Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
20-04-2021 15:32
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7v20210410
General
-
Target
vbc.exe
-
Size
331KB
-
MD5
a5c974a5617823b3de03e26b469ad47d
-
SHA1
197b391fcd3b7b41e07f819535691405194fe2a4
-
SHA256
a3ae710cb1edbfd1f9cc33ab53ffddd288646a040118b2bc252cc6ac070a8308
-
SHA512
b660fab41fadc6497216ef3f0e3750f153f5f59f5dba0e30c60afba731b368b65d18576f1f5ca8ef10b52df97423f9addf1d1f9fd296d779c0d8d51e968ae4d1
Malware Config
Extracted
xloader
2.3
http://www.nyclgbxyi.icu/u6nq/
lamailefr.com
creativesword.com
mpconnextions.com
tureture-diary.net
ateamtotalcare.com
ihealthsauna.com
contex33.xyz
hotege.club
candiceco.com
southerntwistent.com
foivgohl.com
azetheelynn.art
galsmith.com
alphaquantumfunds.site
mursiony.club
ajobfit.com
resourceunits.com
metropolitanez.net
shaohuizq.com
tedbagsstore.com
hvygcj.com
anthonyfry.com
drinkjoisi.com
webgomo.com
k12paymemtcenter.com
pal-photo.net
gzlcwl.com
robertbunisrealestate.com
visitaswede.com
budo.team
goodreality1.com
kenkelconsulting.com
niuzaiapp.com
bookjoegandelman.com
deluzultravioleta.com
achievecake.com
bluehensolutions.com
findthesmartphone.com
205southsignalstojai.com
risk-neutralport.com
moongoodies.com
elevatedeventcatering.com
nubiaurquizopeluqueria.com
j2ztvwx5dz.club
csnturkiye.com
unsoldauctionproperties.com
sharkorderusa.com
apexmaintenancegroup.com
nakedlies.net
allthe-things.com
yourfaithinluck.com
seniorflying.com
downy.sucks
yocontramismostros.com
ine.expert
rockfirenola.com
vssop.xyz
xn--3bss1rzz1apulk7k.com
hearts2give.com
littlecreatorz.com
ericthelefty.com
setosahealth.com
legalopinion.guru
farneasy.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1624-59-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral1/memory/1624-60-0x000000000041CFF0-mapping.dmp xloader behavioral1/memory/1640-61-0x0000000000220000-0x000000000024A000-memory.dmp xloader behavioral1/memory/532-70-0x0000000000080000-0x00000000000A8000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1660 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exehelp.exedescription pid process target process PID 1640 set thread context of 1624 1640 vbc.exe vbc.exe PID 1624 set thread context of 1220 1624 vbc.exe Explorer.EXE PID 1624 set thread context of 1220 1624 vbc.exe Explorer.EXE PID 532 set thread context of 1220 532 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 30 IoCs
Processes:
vbc.exehelp.exepid process 1624 vbc.exe 1624 vbc.exe 1624 vbc.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe 532 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exehelp.exepid process 1624 vbc.exe 1624 vbc.exe 1624 vbc.exe 1624 vbc.exe 532 help.exe 532 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exehelp.exedescription pid process Token: SeDebugPrivilege 1624 vbc.exe Token: SeDebugPrivilege 532 help.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE 1220 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
vbc.exeExplorer.EXEhelp.exedescription pid process target process PID 1640 wrote to memory of 1624 1640 vbc.exe vbc.exe PID 1640 wrote to memory of 1624 1640 vbc.exe vbc.exe PID 1640 wrote to memory of 1624 1640 vbc.exe vbc.exe PID 1640 wrote to memory of 1624 1640 vbc.exe vbc.exe PID 1640 wrote to memory of 1624 1640 vbc.exe vbc.exe PID 1640 wrote to memory of 1624 1640 vbc.exe vbc.exe PID 1640 wrote to memory of 1624 1640 vbc.exe vbc.exe PID 1220 wrote to memory of 532 1220 Explorer.EXE help.exe PID 1220 wrote to memory of 532 1220 Explorer.EXE help.exe PID 1220 wrote to memory of 532 1220 Explorer.EXE help.exe PID 1220 wrote to memory of 532 1220 Explorer.EXE help.exe PID 532 wrote to memory of 1660 532 help.exe cmd.exe PID 532 wrote to memory of 1660 532 help.exe cmd.exe PID 532 wrote to memory of 1660 532 help.exe cmd.exe PID 532 wrote to memory of 1660 532 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/532-72-0x00000000008F0000-0x0000000000BF3000-memory.dmpFilesize
3.0MB
-
memory/532-70-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/532-75-0x0000000075631000-0x0000000075633000-memory.dmpFilesize
8KB
-
memory/532-73-0x0000000000580000-0x000000000060F000-memory.dmpFilesize
572KB
-
memory/532-68-0x0000000000000000-mapping.dmp
-
memory/532-69-0x0000000000290000-0x0000000000296000-memory.dmpFilesize
24KB
-
memory/1220-65-0x0000000003C80000-0x0000000003D39000-memory.dmpFilesize
740KB
-
memory/1220-67-0x0000000004B10000-0x0000000004C78000-memory.dmpFilesize
1.4MB
-
memory/1220-74-0x0000000004C80000-0x0000000004DB0000-memory.dmpFilesize
1.2MB
-
memory/1624-60-0x000000000041CFF0-mapping.dmp
-
memory/1624-66-0x00000000003F0000-0x0000000000400000-memory.dmpFilesize
64KB
-
memory/1624-64-0x0000000000200000-0x0000000000210000-memory.dmpFilesize
64KB
-
memory/1624-59-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/1624-63-0x0000000000770000-0x0000000000A73000-memory.dmpFilesize
3.0MB
-
memory/1640-61-0x0000000000220000-0x000000000024A000-memory.dmpFilesize
168KB
-
memory/1660-71-0x0000000000000000-mapping.dmp