Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10_x64
  • resource
    win10-en
  • submitted
    19-09-2021 14:49

General

  • Target

    vbc.exe

  • Size

    255KB

  • MD5

    de8a80136d8b6c2002ba8473bda2a617

  • SHA1

    6ccca366fd276d0bff3197b02bfb8c192fe75cb3

  • SHA256

    4e18d364c4fa2db105557cf8105e5e3d77c9d7a06590b4f897051f99014da5be

  • SHA512

    d93ca922a818f387312a317ef84e22d88ac9c091a8ddb85c742983fa37801614681d22b842aacd66f6d66621700a0e4eeacc632428303f8db6c7bd0f8d607875

Malware Config

Extracted

Family

xloader

Version

2.3

Campaign

b6a4

C2

http://www.helpmovingandstorage.com/b6a4/

Decoy

gr2future.com

asteroid.finance

skoba-plast.com

rnerfrfw5z3ki.net

thesmartroadtoretirement.com

avisdrummondhomes.com

banban365.net

profesyonelkampcadiri.net

royalloanhs.com

yulujy.com

xn--naqejahan-n3b.com

msalee.net

dollyvee.com

albertagamehawkersclub.com

cbspecialists.com

findingforeverrealty.com

mrtireshop.com

wadamasanari.com

growtechinfo.com

qipai039.com

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 62 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 9 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of WriteProcessMemory 7 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:2304
    • C:\Users\Admin\AppData\Local\Temp\vbc.exe
      "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Users\Admin\AppData\Local\Temp\vbc.exe
        "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:804
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:3164

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Defense Evasion

Scripting

1
T1064

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\nseBB81.tmp\tkxaz.dll
    MD5

    220b53f6a42f8f23f16378c8330763d1

    SHA1

    02078dc5f0d573ba4c7bb24f69c7218f31987be6

    SHA256

    3c470a8a1732a7e3e06cd561f5566c192f851e763b3694d84f546fe8ba379637

    SHA512

    6f442f207deaabb292851abae4d7c372504aa61a1ccfdce6d6f5b5d9d00fff681ff3a458731e47d227404a9bbab6f7fc61493a98075fac33db89766064cbb6f2

  • memory/804-116-0x000000000041D0B0-mapping.dmp
  • memory/804-118-0x0000000000980000-0x0000000000CA0000-memory.dmp
    Filesize

    3.1MB

  • memory/804-117-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/804-119-0x00000000008B0000-0x00000000008C0000-memory.dmp
    Filesize

    64KB

  • memory/2304-120-0x00000000072D0000-0x0000000007420000-memory.dmp
    Filesize

    1.3MB

  • memory/2304-126-0x0000000002E20000-0x0000000002F0C000-memory.dmp
    Filesize

    944KB

  • memory/3164-121-0x0000000000000000-mapping.dmp
  • memory/3164-123-0x0000000000970000-0x0000000000999000-memory.dmp
    Filesize

    164KB

  • memory/3164-122-0x0000000001120000-0x000000000112C000-memory.dmp
    Filesize

    48KB

  • memory/3164-124-0x0000000003620000-0x0000000003940000-memory.dmp
    Filesize

    3.1MB

  • memory/3164-125-0x0000000003130000-0x00000000031BF000-memory.dmp
    Filesize

    572KB