Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
04-05-2021 04:39
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7v20210408
General
-
Target
vbc.exe
-
Size
830KB
-
MD5
020adea3f32c15a0dc4a23522798c3f2
-
SHA1
88378c179cc71548d98eb0500829019be8f22dcb
-
SHA256
e3404e10a2f6b9abb35ab5869a8c78167c82b72815bc59983cd018170412d53d
-
SHA512
1a903bfebf8c75dd08e5907f3fcacfc44635df1a1563b2cbab704ee6d5370b350600c1d23921aac0d20b69a2033d4aad6131ec7e5971b46d7445dc93536370d8
Malware Config
Extracted
xloader
2.3
http://www.apluspro.online/bgnq/
customsclearingagents.com
vsemasteraokon.online
seeheresthething.com
chozamtravel.com
cjkustom.com
djeffexla.com
survivingks.com
rokascapitalmanagement.net
tekdesignlimited.com
1499parkave.com
fontanerosboadilla.com
jesusencounterminisries.com
uouhodler.com
cordstraw.com
dab50074.com
sarahleinartstore.com
inawinnebago.com
wassersportzentrum.online
giselabustamante.com
gulaturun.com
help4americanheroes.com
manuellandmann.com
togshot.com
indapolisitaiik.com
equilibriumarket.com
toucanwellness.com
piyboo.com
zoom4k.xyz
babe-boutique.com
f28smart.com
lawrencepestcontrolpros.com
yeethong.com
thewowwomen.com
priscillamaury.com
curtex.info
jennifernealtarot.com
atiqherbal.com
geraldgulley.com
jenniferlarmstrong.com
imaymei.com
electricporsche986.com
mikeahenry.com
colinscotflorals.com
01cheshi.com
hellofresh.club
infinitegrowthmarketing.com
kuryeforum.xyz
khalifehlivestock.com
biryanished.com
originallionqueen.com
tajigroup.com
instuctur.com
pennyfishdesigns.com
dulceespera.net
corporate-hero.com
sensers.club
unionbayblog.com
romaindaubord.com
kwrecruitment.com
hostingforphotographers.com
107001.com
lovelaughwine.com
simplyhealrhcareplans.com
thedoubletwelve.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1516-66-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1516-67-0x000000000041D090-mapping.dmp xloader behavioral1/memory/112-76-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 436 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exevbc.exewlanext.exedescription pid process target process PID 1080 set thread context of 1516 1080 vbc.exe vbc.exe PID 1516 set thread context of 1220 1516 vbc.exe Explorer.EXE PID 1516 set thread context of 1220 1516 vbc.exe Explorer.EXE PID 112 set thread context of 1220 112 wlanext.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
vbc.exevbc.exewlanext.exepid process 1080 vbc.exe 1080 vbc.exe 1516 vbc.exe 1516 vbc.exe 1516 vbc.exe 112 wlanext.exe 112 wlanext.exe 112 wlanext.exe 112 wlanext.exe 112 wlanext.exe 112 wlanext.exe -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
vbc.exewlanext.exepid process 1516 vbc.exe 1516 vbc.exe 1516 vbc.exe 1516 vbc.exe 112 wlanext.exe 112 wlanext.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exevbc.exewlanext.exedescription pid process Token: SeDebugPrivilege 1080 vbc.exe Token: SeDebugPrivilege 1516 vbc.exe Token: SeDebugPrivilege 112 wlanext.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
vbc.exeExplorer.EXEwlanext.exedescription pid process target process PID 1080 wrote to memory of 1624 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1624 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1624 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1624 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1620 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1620 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1620 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1620 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1516 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1516 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1516 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1516 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1516 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1516 1080 vbc.exe vbc.exe PID 1080 wrote to memory of 1516 1080 vbc.exe vbc.exe PID 1220 wrote to memory of 112 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 112 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 112 1220 Explorer.EXE wlanext.exe PID 1220 wrote to memory of 112 1220 Explorer.EXE wlanext.exe PID 112 wrote to memory of 436 112 wlanext.exe cmd.exe PID 112 wrote to memory of 436 112 wlanext.exe cmd.exe PID 112 wrote to memory of 436 112 wlanext.exe cmd.exe PID 112 wrote to memory of 436 112 wlanext.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
PID:1220 -
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵PID:1624
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵PID:1620
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\SysWOW64\wlanext.exe"C:\Windows\SysWOW64\wlanext.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:112 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Deletes itself
PID:436
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/112-74-0x0000000000000000-mapping.dmp
-
memory/112-79-0x0000000001D70000-0x0000000001E00000-memory.dmpFilesize
576KB
-
memory/112-77-0x0000000001F00000-0x0000000002203000-memory.dmpFilesize
3.0MB
-
memory/112-75-0x0000000000530000-0x0000000000546000-memory.dmpFilesize
88KB
-
memory/112-76-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/436-78-0x0000000000000000-mapping.dmp
-
memory/1080-65-0x00000000043E0000-0x0000000004445000-memory.dmpFilesize
404KB
-
memory/1080-60-0x0000000000CD0000-0x0000000000CD1000-memory.dmpFilesize
4KB
-
memory/1080-64-0x00000000050F0000-0x0000000005198000-memory.dmpFilesize
672KB
-
memory/1080-63-0x0000000004EB0000-0x0000000004EB1000-memory.dmpFilesize
4KB
-
memory/1080-62-0x0000000000480000-0x000000000048E000-memory.dmpFilesize
56KB
-
memory/1220-71-0x0000000006600000-0x0000000006734000-memory.dmpFilesize
1.2MB
-
memory/1220-73-0x00000000067E0000-0x00000000068B3000-memory.dmpFilesize
844KB
-
memory/1220-80-0x00000000068C0000-0x000000000699F000-memory.dmpFilesize
892KB
-
memory/1516-70-0x00000000003C0000-0x00000000003D1000-memory.dmpFilesize
68KB
-
memory/1516-69-0x0000000000920000-0x0000000000C23000-memory.dmpFilesize
3.0MB
-
memory/1516-72-0x0000000000450000-0x0000000000461000-memory.dmpFilesize
68KB
-
memory/1516-67-0x000000000041D090-mapping.dmp
-
memory/1516-66-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB