Analysis
- max time kernel
148s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
30/11/2021, 12:11
General
- Target vbc.exe
- Size 1.5MB
- Sample211130-pcl47aehan
- SHA256 bd7cddd657e0144076352a60664ca134c2ddee8ffe8da70793d5b97f17cf9318
Malware Config
Extracted
-
xloader
-
2.5
-
fqiq
-
http://www.esyscoloradosprings.com/fqiq/
-
driventow.com
-
ipatchwork.today
-
bolder.equipment
-
seal-brother.com
-
mountlaketerraceapartments.com
-
weeden.xyz
-
sanlifalan.com
-
athafood.com
-
isshinn1.com
-
creationslazzaroni.com
-
eclecticrenaissancewoman.com
-
satellitephonstore.com
-
cotchildcare.com
-
yamacorp.digital
-
ff4cuno43.xyz
-
quicksticks.community
-
govindfinance.com
-
farmersfirstseed.com
-
megacinema.club
-
tablescaperendezvous4two.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 4 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Suspicious behavior: EnumeratesProcesses 38 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\SysWOW64\cmd.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2820-117-0x0000000006050000-0x0000000006051000-memory.dmp
memory/2820-118-0x0000000005A80000-0x0000000005A81000-memory.dmp
memory/2820-119-0x0000000005C70000-0x0000000005C71000-memory.dmp
memory/2820-120-0x0000000005B50000-0x000000000604E000-memory.dmp
memory/2820-121-0x0000000005B20000-0x0000000005B21000-memory.dmp
memory/2820-122-0x00000000065F0000-0x00000000065F1000-memory.dmp
memory/2820-123-0x00000000082D0000-0x00000000082E8000-memory.dmp
memory/2820-124-0x00000000086E0000-0x000000000873C000-memory.dmp
memory/2820-115-0x0000000000F30000-0x0000000000F31000-memory.dmp
memory/2920-129-0x0000000004760000-0x00000000048C3000-memory.dmp
memory/2920-137-0x00000000048D0000-0x0000000004A05000-memory.dmp
memory/2940-133-0x0000000002E10000-0x0000000003130000-memory.dmp
memory/2940-134-0x0000000002930000-0x0000000002959000-memory.dmp
memory/2940-132-0x0000000000280000-0x00000000002D9000-memory.dmp
memory/2940-136-0x00000000032C0000-0x0000000003350000-memory.dmp
memory/3984-130-0x0000000001350000-0x000000000149A000-memory.dmp
memory/3984-128-0x0000000001920000-0x0000000001C40000-memory.dmp
memory/3984-125-0x0000000000400000-0x0000000000429000-memory.dmp