Analysis
-
max time kernel
59s -
max time network
51s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
23-09-2021 09:42
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20210920
General
-
Target
vbc.exe
-
Size
761KB
-
MD5
1c3047465bb31dd2ac45101680301992
-
SHA1
36219c9148dafb036bc5871c440cbcf959d1b683
-
SHA256
995c349e77a02cf1d77af852797437f2cd89914f41f493fa7f352549f374d7d3
-
SHA512
cc4ef5a89b34067434e478a8e9d96e212dc1cdb0b8c128d7ab6890e91cb4c4f0170270b86ae872219c4adfbe1bcb19490beadbe65ae4f296aabc9b802ed93d74
Malware Config
Extracted
xloader
2.5
arup
http://www.sapphiretype.com/arup/
mezonpezon.com
bellapbd.com
xn--2kr800ab2z.group
cupecoysuites.com
extractselect.com
cherrycooky.com
reshawna.com
bluewinetours.com
dez2fly.com
washedproductions.com
om-asahi-kasei-jp.com
talkingpoint.tours
avaspacecompany.com
fbtvmall.com
trocaoferta.com
mionegozio.com
reitschuetz.com
basepicks.com
networkagricity.com
kastore.club
groovydeer.com
realisa.net
891708.com
naveenachittibiyina.com
guizhouawj.com
royaltortoisecookieco.online
scubafarm.com
sibo.care
rapi-vet.com
metaid.website
shadoworksart.com
gratitudegalore.com
penhal.com
fetch-an-us-itchy.zone
melisaakyolicmimarlik.com
yiweise.com
sofasstorremolinos.com
rfanil.com
metaverselemon.com
theholidaymovieplanner.com
n4sins.com
fortcor.com
galaxysingle.com
gzwqpsyj.com
azur-riviera-rental.com
bharathpaperbagmachine.com
pinup722bk.com
darkness.global
theihearthotel.com
wecowork.net
big-thoughtconsulting.com
ricartepinlac.com
beatsingh.com
xn--e6qg25lq0kdudqy7g.com
zkingstore.com
gd83574.com
jiajssie.xyz
patientempowered.care
tiannuoxxrp.top
itsnalab.com
ioumal.com
bellinghamapartment.com
sakibotchi.com
jessicapets.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3808-127-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/3808-128-0x000000000041D4B0-mapping.dmp xloader behavioral2/memory/3776-135-0x00000000001C0000-0x00000000001E9000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exesvchost.exedescription pid process target process PID 1796 set thread context of 3808 1796 vbc.exe vbc.exe PID 3808 set thread context of 3028 3808 vbc.exe Explorer.EXE PID 3776 set thread context of 3028 3776 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
vbc.exesvchost.exepid process 3808 vbc.exe 3808 vbc.exe 3808 vbc.exe 3808 vbc.exe 3776 svchost.exe 3776 svchost.exe 3776 svchost.exe 3776 svchost.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exesvchost.exepid process 3808 vbc.exe 3808 vbc.exe 3808 vbc.exe 3776 svchost.exe 3776 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exesvchost.exedescription pid process Token: SeDebugPrivilege 3808 vbc.exe Token: SeDebugPrivilege 3776 svchost.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
vbc.exeExplorer.EXEsvchost.exedescription pid process target process PID 1796 wrote to memory of 3808 1796 vbc.exe vbc.exe PID 1796 wrote to memory of 3808 1796 vbc.exe vbc.exe PID 1796 wrote to memory of 3808 1796 vbc.exe vbc.exe PID 1796 wrote to memory of 3808 1796 vbc.exe vbc.exe PID 1796 wrote to memory of 3808 1796 vbc.exe vbc.exe PID 1796 wrote to memory of 3808 1796 vbc.exe vbc.exe PID 3028 wrote to memory of 3776 3028 Explorer.EXE svchost.exe PID 3028 wrote to memory of 3776 3028 Explorer.EXE svchost.exe PID 3028 wrote to memory of 3776 3028 Explorer.EXE svchost.exe PID 3776 wrote to memory of 3580 3776 svchost.exe cmd.exe PID 3776 wrote to memory of 3580 3776 svchost.exe cmd.exe PID 3776 wrote to memory of 3580 3776 svchost.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1796-126-0x0000000008710000-0x000000000874B000-memory.dmpFilesize
236KB
-
memory/1796-117-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/1796-115-0x0000000000D20000-0x0000000000D21000-memory.dmpFilesize
4KB
-
memory/1796-119-0x00000000057F0000-0x00000000057F1000-memory.dmpFilesize
4KB
-
memory/1796-120-0x0000000006000000-0x0000000006001000-memory.dmpFilesize
4KB
-
memory/1796-121-0x0000000003170000-0x0000000003171000-memory.dmpFilesize
4KB
-
memory/1796-122-0x0000000006370000-0x0000000006371000-memory.dmpFilesize
4KB
-
memory/1796-123-0x0000000008100000-0x000000000811D000-memory.dmpFilesize
116KB
-
memory/1796-124-0x0000000008440000-0x0000000008441000-memory.dmpFilesize
4KB
-
memory/1796-125-0x0000000008680000-0x00000000086EB000-memory.dmpFilesize
428KB
-
memory/1796-118-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/3028-138-0x0000000002F70000-0x000000000303A000-memory.dmpFilesize
808KB
-
memory/3028-131-0x0000000001030000-0x0000000001185000-memory.dmpFilesize
1.3MB
-
memory/3580-133-0x0000000000000000-mapping.dmp
-
memory/3776-132-0x0000000000000000-mapping.dmp
-
memory/3776-135-0x00000000001C0000-0x00000000001E9000-memory.dmpFilesize
164KB
-
memory/3776-134-0x0000000001070000-0x000000000107C000-memory.dmpFilesize
48KB
-
memory/3776-136-0x0000000003080000-0x00000000033A0000-memory.dmpFilesize
3.1MB
-
memory/3776-137-0x0000000000B90000-0x0000000000C20000-memory.dmpFilesize
576KB
-
memory/3808-128-0x000000000041D4B0-mapping.dmp
-
memory/3808-129-0x00000000018F0000-0x0000000001C10000-memory.dmpFilesize
3.1MB
-
memory/3808-130-0x00000000018C0000-0x00000000018D1000-memory.dmpFilesize
68KB
-
memory/3808-127-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB