Analysis
-
max time kernel
58s -
max time network
10s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
23-09-2021 09:42
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20210920
General
-
Target
vbc.exe
-
Size
761KB
-
MD5
1c3047465bb31dd2ac45101680301992
-
SHA1
36219c9148dafb036bc5871c440cbcf959d1b683
-
SHA256
995c349e77a02cf1d77af852797437f2cd89914f41f493fa7f352549f374d7d3
-
SHA512
cc4ef5a89b34067434e478a8e9d96e212dc1cdb0b8c128d7ab6890e91cb4c4f0170270b86ae872219c4adfbe1bcb19490beadbe65ae4f296aabc9b802ed93d74
Malware Config
Extracted
xloader
2.5
arup
http://www.sapphiretype.com/arup/
mezonpezon.com
bellapbd.com
xn--2kr800ab2z.group
cupecoysuites.com
extractselect.com
cherrycooky.com
reshawna.com
bluewinetours.com
dez2fly.com
washedproductions.com
om-asahi-kasei-jp.com
talkingpoint.tours
avaspacecompany.com
fbtvmall.com
trocaoferta.com
mionegozio.com
reitschuetz.com
basepicks.com
networkagricity.com
kastore.club
groovydeer.com
realisa.net
891708.com
naveenachittibiyina.com
guizhouawj.com
royaltortoisecookieco.online
scubafarm.com
sibo.care
rapi-vet.com
metaid.website
shadoworksart.com
gratitudegalore.com
penhal.com
fetch-an-us-itchy.zone
melisaakyolicmimarlik.com
yiweise.com
sofasstorremolinos.com
rfanil.com
metaverselemon.com
theholidaymovieplanner.com
n4sins.com
fortcor.com
galaxysingle.com
gzwqpsyj.com
azur-riviera-rental.com
bharathpaperbagmachine.com
pinup722bk.com
darkness.global
theihearthotel.com
wecowork.net
big-thoughtconsulting.com
ricartepinlac.com
beatsingh.com
xn--e6qg25lq0kdudqy7g.com
zkingstore.com
gd83574.com
jiajssie.xyz
patientempowered.care
tiannuoxxrp.top
itsnalab.com
ioumal.com
bellinghamapartment.com
sakibotchi.com
jessicapets.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1564-59-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1564-60-0x000000000041D4B0-mapping.dmp xloader behavioral1/memory/1600-69-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1104 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exeexplorer.exedescription pid process target process PID 1268 set thread context of 1564 1268 vbc.exe vbc.exe PID 1564 set thread context of 1400 1564 vbc.exe Explorer.EXE PID 1600 set thread context of 1400 1600 explorer.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
vbc.exeexplorer.exepid process 1564 vbc.exe 1564 vbc.exe 1600 explorer.exe 1600 explorer.exe 1600 explorer.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeexplorer.exepid process 1564 vbc.exe 1564 vbc.exe 1564 vbc.exe 1600 explorer.exe 1600 explorer.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1564 vbc.exe Token: SeDebugPrivilege 1600 explorer.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
vbc.exeExplorer.EXEexplorer.exedescription pid process target process PID 1268 wrote to memory of 1564 1268 vbc.exe vbc.exe PID 1268 wrote to memory of 1564 1268 vbc.exe vbc.exe PID 1268 wrote to memory of 1564 1268 vbc.exe vbc.exe PID 1268 wrote to memory of 1564 1268 vbc.exe vbc.exe PID 1268 wrote to memory of 1564 1268 vbc.exe vbc.exe PID 1268 wrote to memory of 1564 1268 vbc.exe vbc.exe PID 1268 wrote to memory of 1564 1268 vbc.exe vbc.exe PID 1400 wrote to memory of 1600 1400 Explorer.EXE explorer.exe PID 1400 wrote to memory of 1600 1400 Explorer.EXE explorer.exe PID 1400 wrote to memory of 1600 1400 Explorer.EXE explorer.exe PID 1400 wrote to memory of 1600 1400 Explorer.EXE explorer.exe PID 1600 wrote to memory of 1104 1600 explorer.exe cmd.exe PID 1600 wrote to memory of 1104 1600 explorer.exe cmd.exe PID 1600 wrote to memory of 1104 1600 explorer.exe cmd.exe PID 1600 wrote to memory of 1104 1600 explorer.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1104-67-0x0000000000000000-mapping.dmp
-
memory/1268-53-0x0000000000AE0000-0x0000000000AE1000-memory.dmpFilesize
4KB
-
memory/1268-55-0x0000000004C50000-0x0000000004C51000-memory.dmpFilesize
4KB
-
memory/1268-56-0x0000000000A50000-0x0000000000A6D000-memory.dmpFilesize
116KB
-
memory/1268-57-0x00000000053C0000-0x000000000542B000-memory.dmpFilesize
428KB
-
memory/1268-58-0x0000000005430000-0x000000000546B000-memory.dmpFilesize
236KB
-
memory/1400-62-0x0000000004740000-0x0000000004814000-memory.dmpFilesize
848KB
-
memory/1564-63-0x0000000000180000-0x0000000000191000-memory.dmpFilesize
68KB
-
memory/1564-61-0x0000000000BB0000-0x0000000000EB3000-memory.dmpFilesize
3.0MB
-
memory/1564-60-0x000000000041D4B0-mapping.dmp
-
memory/1564-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1600-64-0x0000000000000000-mapping.dmp
-
memory/1600-65-0x00000000751A1000-0x00000000751A3000-memory.dmpFilesize
8KB
-
memory/1600-66-0x0000000074761000-0x0000000074763000-memory.dmpFilesize
8KB
-
memory/1600-68-0x0000000000310000-0x0000000000591000-memory.dmpFilesize
2.5MB
-
memory/1600-69-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1600-70-0x00000000022F0000-0x00000000025F3000-memory.dmpFilesize
3.0MB
-
memory/1600-71-0x00000000021F0000-0x0000000002280000-memory.dmpFilesize
576KB