Analysis
-
max time kernel
148s -
max time network
161s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
29-10-2021 10:55
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20211014
General
-
Target
vbc.exe
-
Size
380KB
-
MD5
2953a7fb129cbb29a3f913e5e1f01d1b
-
SHA1
88cc356cf7566c6c5fff68821023c97f4c79d151
-
SHA256
9508c04b4c1dd578c8c3b8597a68bb73548b107edcbb37f13909a18d85f78b3a
-
SHA512
ae6da55999c04bf051744147f8caabf283b1b12f88385b1279a1109e72c4589be015e7f3338df2a4f9a673e332d156eb801fd74baeb6ba6b0192869303e9bcdc
Malware Config
Extracted
xloader
2.5
euzn
http://www.heser.net/euzn/
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
jakital.com
graywolfdesign.com
pepeavatar.com
predixlogisticscourier.com
football-transfer-news.pro
herbalmedication.xyz
esd66.com
janesgalant.quest
abcrefreshments.com
chaoxy.com
rediscoveringyouhealing.com
mcrjadr5.xyz
n4sins.com
faithful-presence.com
013yu.xyz
isystemslanka.com
newbeautydk.com
ethiopia-info.com
hgaffiliates.net
anodynemedicalmassage.com
esohgroup.com
clinicamonicabarros.com
rafathecook.com
londonescort.xyz
dreamites.com
webtiyan.com
cnnautorepair.com
soposhshop.com
aarohaninsight2021.com
arceprojects.com
mecasso.store
mirai-energy.com
barwg.com
angeescollections-shop.com
xinlishiqiaoqiao.xyz
linuxsauce.net
dirbn.com
anandiaper.xyz
blackpanther.online
livinwoodbridgefarms.com
diepraxiskommunikation.com
radiosaptshahid.com
gofieldtest.com
minxtales.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4016-124-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/4016-125-0x000000000041D420-mapping.dmp xloader behavioral2/memory/520-132-0x00000000005D0000-0x00000000005F9000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.execolorcpl.exedescription pid process target process PID 4076 set thread context of 4016 4076 vbc.exe vbc.exe PID 4016 set thread context of 2872 4016 vbc.exe Explorer.EXE PID 520 set thread context of 2872 520 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 44 IoCs
Processes:
vbc.execolorcpl.exepid process 4016 vbc.exe 4016 vbc.exe 4016 vbc.exe 4016 vbc.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe 520 colorcpl.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2872 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.execolorcpl.exepid process 4016 vbc.exe 4016 vbc.exe 4016 vbc.exe 520 colorcpl.exe 520 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.execolorcpl.exedescription pid process Token: SeDebugPrivilege 4016 vbc.exe Token: SeDebugPrivilege 520 colorcpl.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
vbc.exeExplorer.EXEcolorcpl.exedescription pid process target process PID 4076 wrote to memory of 4016 4076 vbc.exe vbc.exe PID 4076 wrote to memory of 4016 4076 vbc.exe vbc.exe PID 4076 wrote to memory of 4016 4076 vbc.exe vbc.exe PID 4076 wrote to memory of 4016 4076 vbc.exe vbc.exe PID 4076 wrote to memory of 4016 4076 vbc.exe vbc.exe PID 4076 wrote to memory of 4016 4076 vbc.exe vbc.exe PID 2872 wrote to memory of 520 2872 Explorer.EXE colorcpl.exe PID 2872 wrote to memory of 520 2872 Explorer.EXE colorcpl.exe PID 2872 wrote to memory of 520 2872 Explorer.EXE colorcpl.exe PID 520 wrote to memory of 1684 520 colorcpl.exe cmd.exe PID 520 wrote to memory of 1684 520 colorcpl.exe cmd.exe PID 520 wrote to memory of 1684 520 colorcpl.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/520-135-0x00000000040C0000-0x0000000004150000-memory.dmpFilesize
576KB
-
memory/520-133-0x0000000004340000-0x0000000004660000-memory.dmpFilesize
3.1MB
-
memory/520-131-0x0000000000950000-0x0000000000969000-memory.dmpFilesize
100KB
-
memory/520-132-0x00000000005D0000-0x00000000005F9000-memory.dmpFilesize
164KB
-
memory/520-130-0x0000000000000000-mapping.dmp
-
memory/1684-134-0x0000000000000000-mapping.dmp
-
memory/2872-129-0x0000000006820000-0x000000000694B000-memory.dmpFilesize
1.2MB
-
memory/2872-136-0x0000000003010000-0x0000000003107000-memory.dmpFilesize
988KB
-
memory/4016-128-0x00000000013B0000-0x000000000145E000-memory.dmpFilesize
696KB
-
memory/4016-125-0x000000000041D420-mapping.dmp
-
memory/4016-127-0x0000000001930000-0x0000000001C50000-memory.dmpFilesize
3.1MB
-
memory/4016-124-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4076-115-0x0000000000FB0000-0x0000000000FB1000-memory.dmpFilesize
4KB
-
memory/4076-123-0x0000000008EF0000-0x0000000008F3B000-memory.dmpFilesize
300KB
-
memory/4076-122-0x0000000008E00000-0x0000000008E01000-memory.dmpFilesize
4KB
-
memory/4076-121-0x0000000005980000-0x0000000005E7E000-memory.dmpFilesize
5.0MB
-
memory/4076-120-0x0000000005A00000-0x0000000005A06000-memory.dmpFilesize
24KB
-
memory/4076-119-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/4076-118-0x0000000005850000-0x0000000005851000-memory.dmpFilesize
4KB
-
memory/4076-117-0x0000000005E80000-0x0000000005E81000-memory.dmpFilesize
4KB