Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
07-12-2021 14:06
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20211104
General
-
Target
vbc.exe
-
Size
515KB
-
MD5
a8538dba14e963ac7894257f7466bc06
-
SHA1
d5de28b9a2f41519f8ae6fc2be6f9ee75569e192
-
SHA256
7bfabb3e53f70e2ad39155a8af8d7e27a07ec01b0ba8faed52cb569e4f78142f
-
SHA512
04da55fb7dcd87538e284a929b79427bf72241fea7a291f3650853442f889cf21de0352f7a381bae316df852f3b0ea87e5eb9ce8e3e509a27ab34da0b78030ba
Malware Config
Extracted
xloader
2.5
ea0r
http://www.asiapubz-hk.com/ea0r/
lionheartcreativestudios.com
konzertmanagement.com
blackpanther.online
broychim-int.com
takut18.com
txstarsolar.com
herdsherpa.com
igorshestakov.com
shinesbox.com
reflectpkljlt.xyz
oiltoolshub.com
viralmoneychallenge.com
changingalphastrategies.com
mecitiris.com
rdadmin.online
miniambiente.com
kominarcine.com
pino-almond.com
heihit.xyz
junqi888.com
metalumber.com
sclvfu.com
macanostore.online
projecturs.com
ahcprp.com
gztyfnrj.com
lospacenos.com
tak-etranger.com
dingermail.com
skiin.club
ystops.com
tnboxes.com
ccafgz.com
info1337.xyz
platinum24.top
hothess.com
novelfinancewhite.xyz
theselectdifference.com
flufca.com
giftcodefreefirevns.com
kgv-lachswehr.com
report-alfarabilabs.com
skeetones.com
4bcinc.com
americamr.com
wewonacademy.com
evrazavto.store
true-fanbox.com
greencofiji.com
threecommaspartners.com
hgtradingcoltd.com
xihe1919.com
241mk.com
helplockedout.com
wefundprojects.com
neosecure.store
purenewsworldwide.com
luckylottovip999.com
lottidobler.com
proyectohaciendohistoria.com
raintm.com
theproducerformula.com
trademarkitforyourself.com
ottaweed.com
Signatures
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1308-116-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1308-117-0x000000000041D410-mapping.dmp xloader behavioral2/memory/2180-125-0x00000000029B0000-0x00000000029D9000-memory.dmp xloader -
Loads dropped DLL 1 IoCs
Processes:
vbc.exepid process 3760 vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exemstsc.exedescription pid process target process PID 3760 set thread context of 1308 3760 vbc.exe vbc.exe PID 1308 set thread context of 3064 1308 vbc.exe Explorer.EXE PID 2180 set thread context of 3064 2180 mstsc.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 58 IoCs
Processes:
vbc.exemstsc.exepid process 1308 vbc.exe 1308 vbc.exe 1308 vbc.exe 1308 vbc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe 2180 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3064 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exemstsc.exepid process 1308 vbc.exe 1308 vbc.exe 1308 vbc.exe 2180 mstsc.exe 2180 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exemstsc.exedescription pid process Token: SeDebugPrivilege 1308 vbc.exe Token: SeDebugPrivilege 2180 mstsc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
vbc.exeExplorer.EXEmstsc.exedescription pid process target process PID 3760 wrote to memory of 1308 3760 vbc.exe vbc.exe PID 3760 wrote to memory of 1308 3760 vbc.exe vbc.exe PID 3760 wrote to memory of 1308 3760 vbc.exe vbc.exe PID 3760 wrote to memory of 1308 3760 vbc.exe vbc.exe PID 3760 wrote to memory of 1308 3760 vbc.exe vbc.exe PID 3760 wrote to memory of 1308 3760 vbc.exe vbc.exe PID 3064 wrote to memory of 2180 3064 Explorer.EXE mstsc.exe PID 3064 wrote to memory of 2180 3064 Explorer.EXE mstsc.exe PID 3064 wrote to memory of 2180 3064 Explorer.EXE mstsc.exe PID 2180 wrote to memory of 3780 2180 mstsc.exe cmd.exe PID 2180 wrote to memory of 3780 2180 mstsc.exe cmd.exe PID 2180 wrote to memory of 3780 2180 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\nsyF203.tmp\sodxedmub.dllMD5
0dce769f700f91a640a0ac88b9f52cc0
SHA1593939ad9b4c96d84fb8649bd81a670e8036db19
SHA2568ea5809102a56af3cbe2dead5d07c4a740afac59ae44f908dd73dbd2314a6018
SHA512b1546a0ec312e6f4cf50b01c15fd37d911a39eea6e465be113c9e38f87af4f5cde649bdf8939496a7aaceec05988de1bc9249fce8ddc0fce3d1c2f94ead33a52
-
memory/1308-116-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1308-117-0x000000000041D410-mapping.dmp
-
memory/1308-120-0x0000000000DC0000-0x0000000000DD1000-memory.dmpFilesize
68KB
-
memory/1308-119-0x00000000009A0000-0x0000000000CC0000-memory.dmpFilesize
3.1MB
-
memory/2180-122-0x0000000000000000-mapping.dmp
-
memory/2180-125-0x00000000029B0000-0x00000000029D9000-memory.dmpFilesize
164KB
-
memory/2180-124-0x00000000003B0000-0x00000000006AC000-memory.dmpFilesize
3.0MB
-
memory/2180-126-0x0000000004930000-0x0000000004C50000-memory.dmpFilesize
3.1MB
-
memory/2180-127-0x0000000004820000-0x00000000048B0000-memory.dmpFilesize
576KB
-
memory/3064-121-0x00000000027C0000-0x0000000002890000-memory.dmpFilesize
832KB
-
memory/3064-128-0x0000000005C90000-0x0000000005DEF000-memory.dmpFilesize
1.4MB
-
memory/3780-123-0x0000000000000000-mapping.dmp