Analysis

  • max time kernel
    122s
  • max time network
    122s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    16-12-2021 17:14

General

  • Target

    tmp/9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe

  • Size

    482KB

  • MD5

    81b76350a44f6356246271612e6f23f2

  • SHA1

    bfafb16fcc983399191cf2596d700aa03ee6f75c

  • SHA256

    a9704735e10e7b769bebf6b33f8fd17d8a1f2d97ef774bf2f8d3ff3694ccf6d9

  • SHA512

    e275f3b36eff3788b3da3a8c05002660e8454e44ddd1ee4a38c85fe54d310c61ffc7228026f74b1e33ac1bcab5144cb65a289566229d1524f46c75d9e6532b1a

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ea0r

Decoy

lionheartcreativestudios.com

konzertmanagement.com

blackpanther.online

broychim-int.com

takut18.com

txstarsolar.com

herdsherpa.com

igorshestakov.com

shinesbox.com

reflectpkljlt.xyz

oiltoolshub.com

viralmoneychallenge.com

changingalphastrategies.com

mecitiris.com

rdadmin.online

miniambiente.com

kominarcine.com

pino-almond.com

heihit.xyz

junqi888.com

Signatures

  • Detect Neshta Payload 3 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader Payload 2 IoCs
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 21 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe"
    1⤵
    • Modifies system executable filetype association
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:2712
    • C:\Users\Admin\AppData\Local\Temp\3582-490\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe
      "C:\Users\Admin\AppData\Local\Temp\3582-490\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2644
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\WINDOW~1\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\HWDkRuZX.exe"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:4032
        • C:\Windows\SysWOW64\WINDOW~1\v1.0\powershell.exe
          C:\Windows\System32\WINDOW~1\v1.0\powershell.exe Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Roaming\HWDkRuZX.exe
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2032
      • C:\Windows\svchost.com
        "C:\Windows\svchost.com" "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\HWDkRuZX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp50DB.tmp"
        3⤵
        • Executes dropped EXE
        • Drops file in Windows directory
        • Suspicious use of WriteProcessMemory
        PID:604
        • C:\Windows\SysWOW64\schtasks.exe
          C:\Windows\System32\schtasks.exe /Create /TN Updates\HWDkRuZX /XML C:\Users\Admin\AppData\Local\Temp\tmp50DB.tmp
          4⤵
          • Creates scheduled task(s)
          PID:852
      • C:\Users\Admin\AppData\Local\Temp\3582-490\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        PID:3660

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scheduled Task

1
T1053

Persistence

Change Default File Association

1
T1042

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Credentials in Files

1
T1081

Discovery

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\3582-490\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe
    MD5

    35971270d5d0406535ba77fa74bf4f21

    SHA1

    2ae768c1dd51a1bbefa32f2f8b620490ec026aae

    SHA256

    8f14202d038576081a716747d905248877b873edcec27a6406201d57b090ae8b

    SHA512

    e4f164fbdca5636b60e7f015b3f39e46f7188fc7eadc0557a8cce88c3150f2de18f6eb7e51659c3b91b82a5ff8325e7067e7d2061d32f9bc8de31ba7814031cf

  • C:\Users\Admin\AppData\Local\Temp\3582-490\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe
    MD5

    35971270d5d0406535ba77fa74bf4f21

    SHA1

    2ae768c1dd51a1bbefa32f2f8b620490ec026aae

    SHA256

    8f14202d038576081a716747d905248877b873edcec27a6406201d57b090ae8b

    SHA512

    e4f164fbdca5636b60e7f015b3f39e46f7188fc7eadc0557a8cce88c3150f2de18f6eb7e51659c3b91b82a5ff8325e7067e7d2061d32f9bc8de31ba7814031cf

  • C:\Users\Admin\AppData\Local\Temp\3582-490\9cd2cae2-77a3-491e-bd6e-bd8b6d45fde0_vbc.exe
    MD5

    35971270d5d0406535ba77fa74bf4f21

    SHA1

    2ae768c1dd51a1bbefa32f2f8b620490ec026aae

    SHA256

    8f14202d038576081a716747d905248877b873edcec27a6406201d57b090ae8b

    SHA512

    e4f164fbdca5636b60e7f015b3f39e46f7188fc7eadc0557a8cce88c3150f2de18f6eb7e51659c3b91b82a5ff8325e7067e7d2061d32f9bc8de31ba7814031cf

  • C:\Users\Admin\AppData\Local\Temp\tmp5023.tmp
    MD5

    85a2e9b9437fbd154d4a9fd826a90a9f

    SHA1

    a86d57937771d59000113c87e722bf3b57cb0239

    SHA256

    2816b5b146b5a7ee3b9e0e0e8ef4c7cd4056de26541d8fd96d9fb78b59699ad5

    SHA512

    f1e79e50ebfcb74019f7636e715b795572dbd45d4db41a0596837e1a95c023df555fb15457ec895c3e5ddba112176c2005b697dbfab98e38ee13e22f4cc1c053

  • C:\Users\Admin\AppData\Roaming\HWDkRuZX.exe
    MD5

    35971270d5d0406535ba77fa74bf4f21

    SHA1

    2ae768c1dd51a1bbefa32f2f8b620490ec026aae

    SHA256

    8f14202d038576081a716747d905248877b873edcec27a6406201d57b090ae8b

    SHA512

    e4f164fbdca5636b60e7f015b3f39e46f7188fc7eadc0557a8cce88c3150f2de18f6eb7e51659c3b91b82a5ff8325e7067e7d2061d32f9bc8de31ba7814031cf

  • C:\Windows\directx.sys
    MD5

    87f3cb6a4551f26f0e1681bff9265671

    SHA1

    0bde0c1d26ee09baaf50b4c88205d1c5b5b8d125

    SHA256

    6ed358c9b7cdc12c8cca3863f080a9a29e83187beb74f67815b321aff6ccfd04

    SHA512

    1c1c3b4a683fb30a2a6f68357e4c1391c7ca97f4977073cebedb1da79cd042d83f43cb91fed0c5fef15132add3c84470c840dc0037055757cbd77a47a7eafe48

  • C:\Windows\svchost.com
    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

  • C:\Windows\svchost.com
    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

  • C:\Windows\svchost.com
    MD5

    36fd5e09c417c767a952b4609d73a54b

    SHA1

    299399c5a2403080a5bf67fb46faec210025b36d

    SHA256

    980bac6c9afe8efc9c6fe459a5f77213b0d8524eb00de82437288eb96138b9a2

    SHA512

    1813a6a5b47a9b2cd3958cf4556714ae240f2aa19d0a241b596830f0f2b89a33ec864d00ce6a791d323a58dfbff42a0fded65eefbf980c92685e25c0ec415d92

  • memory/604-133-0x0000000000000000-mapping.dmp
  • memory/852-137-0x0000000000000000-mapping.dmp
  • memory/2032-178-0x000000007F9F0000-0x000000007F9F1000-memory.dmp
    Filesize

    4KB

  • memory/2032-171-0x0000000008E20000-0x0000000008E21000-memory.dmp
    Filesize

    4KB

  • memory/2032-154-0x00000000080E0000-0x00000000080E1000-memory.dmp
    Filesize

    4KB

  • memory/2032-150-0x0000000007570000-0x0000000007571000-memory.dmp
    Filesize

    4KB

  • memory/2032-151-0x00000000075E0000-0x00000000075E1000-memory.dmp
    Filesize

    4KB

  • memory/2032-148-0x0000000006BF0000-0x0000000006BF1000-memory.dmp
    Filesize

    4KB

  • memory/2032-132-0x0000000000000000-mapping.dmp
  • memory/2032-176-0x0000000008F80000-0x0000000008F81000-memory.dmp
    Filesize

    4KB

  • memory/2032-177-0x0000000009160000-0x0000000009161000-memory.dmp
    Filesize

    4KB

  • memory/2032-153-0x0000000007CF0000-0x0000000007CF1000-memory.dmp
    Filesize

    4KB

  • memory/2032-155-0x0000000004290000-0x0000000004291000-memory.dmp
    Filesize

    4KB

  • memory/2032-152-0x0000000007990000-0x0000000007991000-memory.dmp
    Filesize

    4KB

  • memory/2032-164-0x0000000008E40000-0x0000000008E73000-memory.dmp
    Filesize

    204KB

  • memory/2032-179-0x0000000006793000-0x0000000006794000-memory.dmp
    Filesize

    4KB

  • memory/2032-141-0x0000000004290000-0x0000000004291000-memory.dmp
    Filesize

    4KB

  • memory/2032-142-0x0000000004290000-0x0000000004291000-memory.dmp
    Filesize

    4KB

  • memory/2032-143-0x0000000006730000-0x0000000006731000-memory.dmp
    Filesize

    4KB

  • memory/2032-144-0x0000000006DD0000-0x0000000006DD1000-memory.dmp
    Filesize

    4KB

  • memory/2032-146-0x0000000006792000-0x0000000006793000-memory.dmp
    Filesize

    4KB

  • memory/2032-145-0x0000000006790000-0x0000000006791000-memory.dmp
    Filesize

    4KB

  • memory/2032-149-0x0000000007500000-0x0000000007501000-memory.dmp
    Filesize

    4KB

  • memory/2644-127-0x00000000077C0000-0x0000000007818000-memory.dmp
    Filesize

    352KB

  • memory/2644-121-0x0000000004F90000-0x0000000004F91000-memory.dmp
    Filesize

    4KB

  • memory/2644-115-0x0000000000000000-mapping.dmp
  • memory/2644-118-0x00000000006E0000-0x00000000006E1000-memory.dmp
    Filesize

    4KB

  • memory/2644-120-0x0000000005540000-0x0000000005541000-memory.dmp
    Filesize

    4KB

  • memory/2644-126-0x0000000007720000-0x0000000007721000-memory.dmp
    Filesize

    4KB

  • memory/2644-125-0x00000000073A0000-0x00000000073A1000-memory.dmp
    Filesize

    4KB

  • memory/2644-124-0x0000000005240000-0x0000000005248000-memory.dmp
    Filesize

    32KB

  • memory/2644-123-0x0000000004F80000-0x0000000004F81000-memory.dmp
    Filesize

    4KB

  • memory/2644-122-0x0000000005040000-0x000000000553E000-memory.dmp
    Filesize

    5.0MB

  • memory/3660-147-0x0000000001890000-0x0000000001BB0000-memory.dmp
    Filesize

    3.1MB

  • memory/3660-138-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/3660-139-0x000000000041D410-mapping.dmp
  • memory/4032-128-0x0000000000000000-mapping.dmp