Analysis
-
max time kernel
148s -
max time network
179s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
29-10-2021 11:36
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20210920
General
-
Target
vbc.exe
-
Size
380KB
-
MD5
2953a7fb129cbb29a3f913e5e1f01d1b
-
SHA1
88cc356cf7566c6c5fff68821023c97f4c79d151
-
SHA256
9508c04b4c1dd578c8c3b8597a68bb73548b107edcbb37f13909a18d85f78b3a
-
SHA512
ae6da55999c04bf051744147f8caabf283b1b12f88385b1279a1109e72c4589be015e7f3338df2a4f9a673e332d156eb801fd74baeb6ba6b0192869303e9bcdc
Malware Config
Extracted
xloader
2.5
euzn
http://www.heser.net/euzn/
235296tyc.com
gold12guide.art
baibuaherb.com
weberwines.tax
chezvitoria.com
aidenb.tech
pitchdeckservice.com
surgeryforfdf.xyz
workunvaccinated.com
hrtaro.com
yourotcs.com
sonimultispecialityclinic.com
consultantadvisors.com
pentesting-consulting.com
dantechs.digital
longshifa.online
taweilai.net
imyusuke.com
cashndashfinancial.com
fasiglimt.quest
jakital.com
graywolfdesign.com
pepeavatar.com
predixlogisticscourier.com
football-transfer-news.pro
herbalmedication.xyz
esd66.com
janesgalant.quest
abcrefreshments.com
chaoxy.com
rediscoveringyouhealing.com
mcrjadr5.xyz
n4sins.com
faithful-presence.com
013yu.xyz
isystemslanka.com
newbeautydk.com
ethiopia-info.com
hgaffiliates.net
anodynemedicalmassage.com
esohgroup.com
clinicamonicabarros.com
rafathecook.com
londonescort.xyz
dreamites.com
webtiyan.com
cnnautorepair.com
soposhshop.com
aarohaninsight2021.com
arceprojects.com
mecasso.store
mirai-energy.com
barwg.com
angeescollections-shop.com
xinlishiqiaoqiao.xyz
linuxsauce.net
dirbn.com
anandiaper.xyz
blackpanther.online
livinwoodbridgefarms.com
diepraxiskommunikation.com
radiosaptshahid.com
gofieldtest.com
minxtales.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1804-61-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1804-62-0x000000000041D420-mapping.dmp xloader behavioral1/memory/1924-70-0x00000000000D0000-0x00000000000F9000-memory.dmp xloader -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 756 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exewuapp.exedescription pid process target process PID 764 set thread context of 1804 764 vbc.exe vbc.exe PID 1804 set thread context of 1408 1804 vbc.exe Explorer.EXE PID 1924 set thread context of 1408 1924 wuapp.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
vbc.exewuapp.exepid process 1804 vbc.exe 1804 vbc.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe 1924 wuapp.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exewuapp.exepid process 1804 vbc.exe 1804 vbc.exe 1804 vbc.exe 1924 wuapp.exe 1924 wuapp.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exewuapp.exedescription pid process Token: SeDebugPrivilege 1804 vbc.exe Token: SeDebugPrivilege 1924 wuapp.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1408 Explorer.EXE 1408 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1408 Explorer.EXE 1408 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
vbc.exeExplorer.EXEwuapp.exedescription pid process target process PID 764 wrote to memory of 1804 764 vbc.exe vbc.exe PID 764 wrote to memory of 1804 764 vbc.exe vbc.exe PID 764 wrote to memory of 1804 764 vbc.exe vbc.exe PID 764 wrote to memory of 1804 764 vbc.exe vbc.exe PID 764 wrote to memory of 1804 764 vbc.exe vbc.exe PID 764 wrote to memory of 1804 764 vbc.exe vbc.exe PID 764 wrote to memory of 1804 764 vbc.exe vbc.exe PID 1408 wrote to memory of 1924 1408 Explorer.EXE wuapp.exe PID 1408 wrote to memory of 1924 1408 Explorer.EXE wuapp.exe PID 1408 wrote to memory of 1924 1408 Explorer.EXE wuapp.exe PID 1408 wrote to memory of 1924 1408 Explorer.EXE wuapp.exe PID 1408 wrote to memory of 1924 1408 Explorer.EXE wuapp.exe PID 1408 wrote to memory of 1924 1408 Explorer.EXE wuapp.exe PID 1408 wrote to memory of 1924 1408 Explorer.EXE wuapp.exe PID 1924 wrote to memory of 756 1924 wuapp.exe cmd.exe PID 1924 wrote to memory of 756 1924 wuapp.exe cmd.exe PID 1924 wrote to memory of 756 1924 wuapp.exe cmd.exe PID 1924 wrote to memory of 756 1924 wuapp.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\wuapp.exe"C:\Windows\SysWOW64\wuapp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/756-68-0x0000000000000000-mapping.dmp
-
memory/764-56-0x0000000004950000-0x0000000004951000-memory.dmpFilesize
4KB
-
memory/764-57-0x00000000006D0000-0x00000000006D6000-memory.dmpFilesize
24KB
-
memory/764-58-0x00000000020B0000-0x00000000020FB000-memory.dmpFilesize
300KB
-
memory/764-54-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/1408-66-0x0000000007540000-0x00000000076DB000-memory.dmpFilesize
1.6MB
-
memory/1408-73-0x0000000009700000-0x0000000009890000-memory.dmpFilesize
1.6MB
-
memory/1804-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1804-64-0x0000000000930000-0x0000000000C33000-memory.dmpFilesize
3.0MB
-
memory/1804-65-0x00000000002F0000-0x0000000000301000-memory.dmpFilesize
68KB
-
memory/1804-62-0x000000000041D420-mapping.dmp
-
memory/1804-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1804-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1924-67-0x0000000000000000-mapping.dmp
-
memory/1924-70-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1924-71-0x0000000000B40000-0x0000000000E43000-memory.dmpFilesize
3.0MB
-
memory/1924-69-0x0000000000EC0000-0x0000000000ECB000-memory.dmpFilesize
44KB
-
memory/1924-72-0x0000000000430000-0x00000000004C0000-memory.dmpFilesize
576KB