Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
03-12-2021 14:27
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20211014
General
-
Target
vbc.exe
-
Size
441KB
-
MD5
35971270d5d0406535ba77fa74bf4f21
-
SHA1
2ae768c1dd51a1bbefa32f2f8b620490ec026aae
-
SHA256
8f14202d038576081a716747d905248877b873edcec27a6406201d57b090ae8b
-
SHA512
e4f164fbdca5636b60e7f015b3f39e46f7188fc7eadc0557a8cce88c3150f2de18f6eb7e51659c3b91b82a5ff8325e7067e7d2061d32f9bc8de31ba7814031cf
Malware Config
Extracted
xloader
2.5
ea0r
http://www.asiapubz-hk.com/ea0r/
lionheartcreativestudios.com
konzertmanagement.com
blackpanther.online
broychim-int.com
takut18.com
txstarsolar.com
herdsherpa.com
igorshestakov.com
shinesbox.com
reflectpkljlt.xyz
oiltoolshub.com
viralmoneychallenge.com
changingalphastrategies.com
mecitiris.com
rdadmin.online
miniambiente.com
kominarcine.com
pino-almond.com
heihit.xyz
junqi888.com
metalumber.com
sclvfu.com
macanostore.online
projecturs.com
ahcprp.com
gztyfnrj.com
lospacenos.com
tak-etranger.com
dingermail.com
skiin.club
ystops.com
tnboxes.com
ccafgz.com
info1337.xyz
platinum24.top
hothess.com
novelfinancewhite.xyz
theselectdifference.com
flufca.com
giftcodefreefirevns.com
kgv-lachswehr.com
report-alfarabilabs.com
skeetones.com
4bcinc.com
americamr.com
wewonacademy.com
evrazavto.store
true-fanbox.com
greencofiji.com
threecommaspartners.com
hgtradingcoltd.com
xihe1919.com
241mk.com
helplockedout.com
wefundprojects.com
neosecure.store
purenewsworldwide.com
luckylottovip999.com
lottidobler.com
proyectohaciendohistoria.com
raintm.com
theproducerformula.com
trademarkitforyourself.com
ottaweed.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2216-135-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/2216-136-0x000000000041D410-mapping.dmp xloader behavioral2/memory/3968-282-0x0000000002880000-0x00000000028A9000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exeNETSTAT.EXEdescription pid process target process PID 2680 set thread context of 2216 2680 vbc.exe vbc.exe PID 2216 set thread context of 3040 2216 vbc.exe Explorer.EXE PID 3968 set thread context of 3040 3968 NETSTAT.EXE Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 3968 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 51 IoCs
Processes:
vbc.exepowershell.exevbc.exeNETSTAT.EXEpid process 2680 vbc.exe 2680 vbc.exe 1724 powershell.exe 1724 powershell.exe 2216 vbc.exe 2216 vbc.exe 2216 vbc.exe 2216 vbc.exe 1724 powershell.exe 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE 3968 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3040 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeNETSTAT.EXEpid process 2216 vbc.exe 2216 vbc.exe 2216 vbc.exe 3968 NETSTAT.EXE 3968 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vbc.exepowershell.exevbc.exeNETSTAT.EXEExplorer.EXEdescription pid process Token: SeDebugPrivilege 2680 vbc.exe Token: SeDebugPrivilege 1724 powershell.exe Token: SeDebugPrivilege 2216 vbc.exe Token: SeDebugPrivilege 3968 NETSTAT.EXE Token: SeShutdownPrivilege 3040 Explorer.EXE Token: SeCreatePagefilePrivilege 3040 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
vbc.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 2680 wrote to memory of 1724 2680 vbc.exe powershell.exe PID 2680 wrote to memory of 1724 2680 vbc.exe powershell.exe PID 2680 wrote to memory of 1724 2680 vbc.exe powershell.exe PID 2680 wrote to memory of 1676 2680 vbc.exe schtasks.exe PID 2680 wrote to memory of 1676 2680 vbc.exe schtasks.exe PID 2680 wrote to memory of 1676 2680 vbc.exe schtasks.exe PID 2680 wrote to memory of 2216 2680 vbc.exe vbc.exe PID 2680 wrote to memory of 2216 2680 vbc.exe vbc.exe PID 2680 wrote to memory of 2216 2680 vbc.exe vbc.exe PID 2680 wrote to memory of 2216 2680 vbc.exe vbc.exe PID 2680 wrote to memory of 2216 2680 vbc.exe vbc.exe PID 2680 wrote to memory of 2216 2680 vbc.exe vbc.exe PID 3040 wrote to memory of 3968 3040 Explorer.EXE NETSTAT.EXE PID 3040 wrote to memory of 3968 3040 Explorer.EXE NETSTAT.EXE PID 3040 wrote to memory of 3968 3040 Explorer.EXE NETSTAT.EXE PID 3968 wrote to memory of 3172 3968 NETSTAT.EXE cmd.exe PID 3968 wrote to memory of 3172 3968 NETSTAT.EXE cmd.exe PID 3968 wrote to memory of 3172 3968 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HWDkRuZX.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HWDkRuZX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4A92.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp4A92.tmpMD5
64d9146577ee3187e7a2e206d67404f6
SHA1f3ebcbec06d37eb1ff691f369171fd01cea1028d
SHA256e2aadd5f873e316c7c22093b4fef6523f252bbc0b4378c73dc2d49976632ad35
SHA512ddab59da982390bd9803ff7f9ed6044e1fc6fafd781e74b447460ebf887cf63c6a1e3a975f7a52c5e89fddf798edde460e604faedc904c19a311c64a8c809854
-
memory/1676-129-0x0000000000000000-mapping.dmp
-
memory/1724-141-0x00000000078A0000-0x00000000078A1000-memory.dmpFilesize
4KB
-
memory/1724-128-0x0000000000000000-mapping.dmp
-
memory/1724-143-0x0000000004780000-0x0000000004781000-memory.dmpFilesize
4KB
-
memory/1724-172-0x0000000009480000-0x0000000009481000-memory.dmpFilesize
4KB
-
memory/1724-171-0x0000000004783000-0x0000000004784000-memory.dmpFilesize
4KB
-
memory/1724-170-0x000000007EA90000-0x000000007EA91000-memory.dmpFilesize
4KB
-
memory/1724-169-0x00000000092A0000-0x00000000092A1000-memory.dmpFilesize
4KB
-
memory/1724-142-0x00000000082F0000-0x00000000082F1000-memory.dmpFilesize
4KB
-
memory/1724-164-0x0000000009140000-0x0000000009141000-memory.dmpFilesize
4KB
-
memory/1724-130-0x0000000004570000-0x0000000004571000-memory.dmpFilesize
4KB
-
memory/1724-131-0x0000000004570000-0x0000000004571000-memory.dmpFilesize
4KB
-
memory/1724-132-0x00000000046C0000-0x00000000046C1000-memory.dmpFilesize
4KB
-
memory/1724-157-0x0000000009160000-0x0000000009193000-memory.dmpFilesize
204KB
-
memory/1724-134-0x0000000007220000-0x0000000007221000-memory.dmpFilesize
4KB
-
memory/1724-150-0x0000000004570000-0x0000000004571000-memory.dmpFilesize
4KB
-
memory/1724-147-0x00000000081B0000-0x00000000081B1000-memory.dmpFilesize
4KB
-
memory/1724-137-0x0000000007110000-0x0000000007111000-memory.dmpFilesize
4KB
-
memory/1724-138-0x00000000071B0000-0x00000000071B1000-memory.dmpFilesize
4KB
-
memory/1724-139-0x0000000007BA0000-0x0000000007BA1000-memory.dmpFilesize
4KB
-
memory/1724-140-0x0000000007C10000-0x0000000007C11000-memory.dmpFilesize
4KB
-
memory/1724-144-0x0000000004782000-0x0000000004783000-memory.dmpFilesize
4KB
-
memory/2216-148-0x00000000019D0000-0x00000000019E1000-memory.dmpFilesize
68KB
-
memory/2216-145-0x0000000001A90000-0x0000000001DB0000-memory.dmpFilesize
3.1MB
-
memory/2216-136-0x000000000041D410-mapping.dmp
-
memory/2216-135-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/2680-127-0x0000000007BC0000-0x0000000007C18000-memory.dmpFilesize
352KB
-
memory/2680-120-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/2680-122-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/2680-124-0x00000000077A0000-0x00000000077A1000-memory.dmpFilesize
4KB
-
memory/2680-126-0x0000000007B20000-0x0000000007B21000-memory.dmpFilesize
4KB
-
memory/2680-118-0x0000000000E70000-0x0000000000E71000-memory.dmpFilesize
4KB
-
memory/2680-121-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2680-123-0x0000000005B70000-0x0000000005B78000-memory.dmpFilesize
32KB
-
memory/2680-125-0x0000000005680000-0x0000000005B7E000-memory.dmpFilesize
5.0MB
-
memory/3040-149-0x0000000006E20000-0x0000000006FA4000-memory.dmpFilesize
1.5MB
-
memory/3040-392-0x00000000065A0000-0x00000000066C2000-memory.dmpFilesize
1.1MB
-
memory/3172-259-0x0000000000000000-mapping.dmp
-
memory/3968-242-0x0000000000000000-mapping.dmp
-
memory/3968-280-0x0000000000290000-0x000000000029B000-memory.dmpFilesize
44KB
-
memory/3968-282-0x0000000002880000-0x00000000028A9000-memory.dmpFilesize
164KB
-
memory/3968-284-0x0000000002CF0000-0x0000000003010000-memory.dmpFilesize
3.1MB
-
memory/3968-391-0x0000000002A40000-0x0000000002AD0000-memory.dmpFilesize
576KB