Analysis
- max time kernel
151s - max time network
150s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
10/01/2022, 13:45
General
- Target vbc.exe
- Size 721KB
- Sample220110-q2ebbaecf4
- SHA256 2ff07642867f534743f26a3783850d83f59d74bf6860831577ccf26d52ae88ee
Malware Config
Extracted
-
xloader
-
2.5
-
cxbz
-
daligtemno.quest
-
785686.com
-
jttengineering.com
-
papayaflorida.com
-
qinuxshop.net
-
mihaialexandruhash.com
-
ezzycoins.com
-
bseafacepharma.online
-
relaymondbe.com
-
straightuppokeronline.com
-
thebranddanymz.com
-
derrickgolden.net
-
missedyou.quest
-
palmstone-realestate.com
-
windoors.net
-
freakyhamster.com
-
boodtv.com
-
softsellingsystem.com
-
axiemng.com
-
officejava.store
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 46 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2164-138-0x0000000004F90000-0x00000000050EA000-memory.dmp
memory/2164-131-0x0000000004E10000-0x0000000004F8B000-memory.dmp
memory/2548-126-0x0000000000400000-0x0000000000429000-memory.dmp
memory/2548-130-0x0000000001CA0000-0x0000000001CB1000-memory.dmp
memory/2548-129-0x00000000017A0000-0x0000000001AC0000-memory.dmp
memory/2672-137-0x0000000005170000-0x0000000005200000-memory.dmp
memory/2672-136-0x0000000005360000-0x0000000005680000-memory.dmp
memory/2672-133-0x0000000000CC0000-0x0000000000CCA000-memory.dmp
memory/2672-134-0x0000000000AF0000-0x0000000000B19000-memory.dmp
memory/2860-120-0x0000000004C10000-0x000000000510E000-memory.dmp
memory/2860-125-0x0000000008B40000-0x0000000008BA0000-memory.dmp
memory/2860-124-0x0000000008AA0000-0x0000000008B3C000-memory.dmp
memory/2860-123-0x0000000008730000-0x000000000877B000-memory.dmp
memory/2860-122-0x0000000008720000-0x000000000872E000-memory.dmp
memory/2860-121-0x00000000056D0000-0x00000000056DA000-memory.dmp
memory/2860-115-0x00000000003D0000-0x000000000048C000-memory.dmp
memory/2860-119-0x0000000004D90000-0x00000000050E0000-memory.dmp
memory/2860-118-0x0000000004CF0000-0x0000000004D82000-memory.dmp
memory/2860-117-0x0000000005110000-0x000000000560E000-memory.dmp
memory/2860-116-0x00000000003D0000-0x000000000048C000-memory.dmp