Analysis
-
max time kernel
149s -
max time network
164s -
submitted
01-01-1970 00:00
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
vbc.exe
Resource
win10-en-20210920
General
-
Target
vbc.exe
-
Size
966KB
-
MD5
9980e7e39379cbe367adf3b7443dd319
-
SHA1
1f1c0e658b23ce7be9e345bfc41edc98ddb91545
-
SHA256
9e68a0780d3c86c44563ecb3ff063bd0daa87fa141de7e1022fa285f812dacae
-
SHA512
da18abae14c407d304d66d64d96430e700ce249d5a58d66cdf6745eabd3a67e40ca9dc673613c027bf8095c589fdaff7513ed16a95815ae76eb38049ac0fc1a7
Malware Config
Extracted
xloader
2.5
rqan
http://www.cardboutiqueapp.com/rqan/
panda.wiki
gailkannamassage.com
ungravitystudio.com
coraggiomusicschool.com
51walkerstreetrippleside.com
infemax.store
mapara-foundation.net
elitespeedwaxs.com
manateeprint.com
thelocksmithtradeshow.com
phoenix-out-of-ashes.com
marionkgregory.store
abasketofwords.com
century21nokta.com
anthonyaarnold.com
forevermyanmar.com
ramashi.com
uniquecarbonbrush.com
packecco.com
appelnacrtl.quest
mayo-group.com
healthychefla.com
chuhaitalk.com
promoapp12.com
sergomosta.com
missuniversepr.com
onfinan.com
moyue27.com
miaocharge.com
hubmedia.digital
sarasota-pressurewashing.com
deliciousrecipe.xyz
rosalia-pilates-angers.com
qqsmt09.com
comercialjyv.com
ismarthings.com
b8ceex.com
reviewbyornex.online
familylovmix.com
wurzelwerk-sk.com
buratacoin.com
delocdinh.com
paraspikakasino.com
buyinsurance24.com
d1storesa.com
apollonfitnessvrn.club
tokofebri.store
cambabez.xyz
pointcon.net
digitalcoursepreneur.com
15dgj.xyz
mg-garage.com
claggs.com
yuezhong66.com
uvowtae.xyz
puutuisossa.quest
glitchpunks.art
haferssippe.quest
ucwykl.biz
finlandtwo.xyz
efterpisart.com
usbankofamerican.com
bamubusinesssolutions.com
lakshhomesbalram.info
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4020-117-0x0000000000000000-mapping.dmp xloader behavioral2/memory/4020-120-0x0000000074180000-0x00000000741A9000-memory.dmp xloader behavioral2/memory/2936-126-0x0000000002430000-0x0000000002459000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
vbc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Zostiq = "C:\\Users\\Public\\Libraries\\\\qitsoZ.url" vbc.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
DpiScaling.exeraserver.exedescription pid process target process PID 4020 set thread context of 3064 4020 DpiScaling.exe Explorer.EXE PID 2936 set thread context of 3064 2936 raserver.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
DpiScaling.exeraserver.exepid process 4020 DpiScaling.exe 4020 DpiScaling.exe 4020 DpiScaling.exe 4020 DpiScaling.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe 2936 raserver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
DpiScaling.exeraserver.exepid process 4020 DpiScaling.exe 4020 DpiScaling.exe 4020 DpiScaling.exe 2936 raserver.exe 2936 raserver.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
DpiScaling.exeraserver.exedescription pid process Token: SeDebugPrivilege 4020 DpiScaling.exe Token: SeDebugPrivilege 2936 raserver.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
vbc.exeExplorer.EXEdescription pid process target process PID 316 wrote to memory of 4020 316 vbc.exe DpiScaling.exe PID 316 wrote to memory of 4020 316 vbc.exe DpiScaling.exe PID 316 wrote to memory of 4020 316 vbc.exe DpiScaling.exe PID 316 wrote to memory of 4020 316 vbc.exe DpiScaling.exe PID 316 wrote to memory of 4020 316 vbc.exe DpiScaling.exe PID 316 wrote to memory of 4020 316 vbc.exe DpiScaling.exe PID 3064 wrote to memory of 2936 3064 Explorer.EXE raserver.exe PID 3064 wrote to memory of 2936 3064 Explorer.EXE raserver.exe PID 3064 wrote to memory of 2936 3064 Explorer.EXE raserver.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-116-0x0000000002A01000-0x0000000002A15000-memory.dmpFilesize
80KB
-
memory/316-115-0x0000000002350000-0x0000000002351000-memory.dmpFilesize
4KB
-
memory/2936-125-0x00000000003F0000-0x000000000040F000-memory.dmpFilesize
124KB
-
memory/2936-128-0x0000000004350000-0x00000000043E0000-memory.dmpFilesize
576KB
-
memory/2936-127-0x0000000004500000-0x0000000004820000-memory.dmpFilesize
3.1MB
-
memory/2936-126-0x0000000002430000-0x0000000002459000-memory.dmpFilesize
164KB
-
memory/2936-124-0x0000000000000000-mapping.dmp
-
memory/3064-129-0x0000000005FB0000-0x0000000006106000-memory.dmpFilesize
1.3MB
-
memory/3064-123-0x0000000005E20000-0x0000000005F48000-memory.dmpFilesize
1.2MB
-
memory/4020-120-0x0000000074180000-0x00000000741A9000-memory.dmpFilesize
164KB
-
memory/4020-122-0x0000000004C40000-0x0000000004C51000-memory.dmpFilesize
68KB
-
memory/4020-121-0x0000000005080000-0x00000000053A0000-memory.dmpFilesize
3.1MB
-
memory/4020-119-0x0000000002D80000-0x0000000002D81000-memory.dmpFilesize
4KB
-
memory/4020-117-0x0000000000000000-mapping.dmp