Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-04-2021 15:32
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7v20210410
General
-
Target
vbc.exe
-
Size
331KB
-
MD5
a5c974a5617823b3de03e26b469ad47d
-
SHA1
197b391fcd3b7b41e07f819535691405194fe2a4
-
SHA256
a3ae710cb1edbfd1f9cc33ab53ffddd288646a040118b2bc252cc6ac070a8308
-
SHA512
b660fab41fadc6497216ef3f0e3750f153f5f59f5dba0e30c60afba731b368b65d18576f1f5ca8ef10b52df97423f9addf1d1f9fd296d779c0d8d51e968ae4d1
Malware Config
Extracted
xloader
2.3
http://www.nyclgbxyi.icu/u6nq/
lamailefr.com
creativesword.com
mpconnextions.com
tureture-diary.net
ateamtotalcare.com
ihealthsauna.com
contex33.xyz
hotege.club
candiceco.com
southerntwistent.com
foivgohl.com
azetheelynn.art
galsmith.com
alphaquantumfunds.site
mursiony.club
ajobfit.com
resourceunits.com
metropolitanez.net
shaohuizq.com
tedbagsstore.com
hvygcj.com
anthonyfry.com
drinkjoisi.com
webgomo.com
k12paymemtcenter.com
pal-photo.net
gzlcwl.com
robertbunisrealestate.com
visitaswede.com
budo.team
goodreality1.com
kenkelconsulting.com
niuzaiapp.com
bookjoegandelman.com
deluzultravioleta.com
achievecake.com
bluehensolutions.com
findthesmartphone.com
205southsignalstojai.com
risk-neutralport.com
moongoodies.com
elevatedeventcatering.com
nubiaurquizopeluqueria.com
j2ztvwx5dz.club
csnturkiye.com
unsoldauctionproperties.com
sharkorderusa.com
apexmaintenancegroup.com
nakedlies.net
allthe-things.com
yourfaithinluck.com
seniorflying.com
downy.sucks
yocontramismostros.com
ine.expert
rockfirenola.com
vssop.xyz
xn--3bss1rzz1apulk7k.com
hearts2give.com
littlecreatorz.com
ericthelefty.com
setosahealth.com
legalopinion.guru
farneasy.com
Signatures
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/3904-114-0x0000000000400000-0x0000000000428000-memory.dmp xloader behavioral2/memory/3904-115-0x000000000041CFF0-mapping.dmp xloader behavioral2/memory/796-116-0x00000000009B0000-0x00000000009DA000-memory.dmp xloader behavioral2/memory/412-124-0x0000000002E00000-0x0000000002E28000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exehelp.exedescription pid process target process PID 796 set thread context of 3904 796 vbc.exe vbc.exe PID 3904 set thread context of 3024 3904 vbc.exe Explorer.EXE PID 412 set thread context of 3024 412 help.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
vbc.exehelp.exepid process 3904 vbc.exe 3904 vbc.exe 3904 vbc.exe 3904 vbc.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe 412 help.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exehelp.exepid process 3904 vbc.exe 3904 vbc.exe 3904 vbc.exe 412 help.exe 412 help.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exehelp.exedescription pid process Token: SeDebugPrivilege 3904 vbc.exe Token: SeDebugPrivilege 412 help.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 3024 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
vbc.exeExplorer.EXEhelp.exedescription pid process target process PID 796 wrote to memory of 3904 796 vbc.exe vbc.exe PID 796 wrote to memory of 3904 796 vbc.exe vbc.exe PID 796 wrote to memory of 3904 796 vbc.exe vbc.exe PID 796 wrote to memory of 3904 796 vbc.exe vbc.exe PID 796 wrote to memory of 3904 796 vbc.exe vbc.exe PID 796 wrote to memory of 3904 796 vbc.exe vbc.exe PID 3024 wrote to memory of 412 3024 Explorer.EXE help.exe PID 3024 wrote to memory of 412 3024 Explorer.EXE help.exe PID 3024 wrote to memory of 412 3024 Explorer.EXE help.exe PID 412 wrote to memory of 1452 412 help.exe cmd.exe PID 412 wrote to memory of 1452 412 help.exe cmd.exe PID 412 wrote to memory of 1452 412 help.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\help.exe"C:\Windows\SysWOW64\help.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/412-125-0x0000000002E30000-0x0000000002EDE000-memory.dmpFilesize
696KB
-
memory/412-121-0x0000000000000000-mapping.dmp
-
memory/412-124-0x0000000002E00000-0x0000000002E28000-memory.dmpFilesize
160KB
-
memory/412-123-0x0000000000140000-0x0000000000147000-memory.dmpFilesize
28KB
-
memory/412-126-0x00000000032E0000-0x000000000336F000-memory.dmpFilesize
572KB
-
memory/796-116-0x00000000009B0000-0x00000000009DA000-memory.dmpFilesize
168KB
-
memory/1452-122-0x0000000000000000-mapping.dmp
-
memory/3024-120-0x0000000002610000-0x00000000026C2000-memory.dmpFilesize
712KB
-
memory/3024-127-0x0000000004760000-0x00000000047F6000-memory.dmpFilesize
600KB
-
memory/3904-115-0x000000000041CFF0-mapping.dmp
-
memory/3904-118-0x00000000009D0000-0x0000000000CF0000-memory.dmpFilesize
3.1MB
-
memory/3904-119-0x00000000009A0000-0x00000000009B0000-memory.dmpFilesize
64KB
-
memory/3904-114-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB