Analysis
- max time kernel
154s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
20/01/2022, 15:00
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target vbc.exe
- Size 953KB
- Sample220120-sdd2raaddr
- SHA256 5683bdb2fc2b2f0bfd524ea328ead3cb7d405f888c54a96fe05dff6ee4d91bd7
- MD5 6d656f77b56cafe4c1684261b99f2aaf
- SHA1 bc8d6ab10897163ca494c29a752ea4d9b1bfe778
- SHA512 c5ad1b62b71ba4f786b805f5167df5faba5b0328bda667bbe76bc66524d3a9283c1b587f8a43a9a46e83e4621406f5ce8ac4db779cb763b39526eb26c27af9ca
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
xloader
Version
-
2.5
Campaign
-
cxbz
Decoy
-
daligtemno.quest
-
785686.com
-
jttengineering.com
-
papayaflorida.com
-
qinuxshop.net
-
mihaialexandruhash.com
-
ezzycoins.com
-
bseafacepharma.online
-
relaymondbe.com
-
straightuppokeronline.com
-
thebranddanymz.com
-
derrickgolden.net
-
missedyou.quest
-
palmstone-realestate.com
-
windoors.net
-
freakyhamster.com
-
boodtv.com
-
softsellingsystem.com
-
axiemng.com
-
officejava.store
-
songbirdandfrog.com
-
dogiadunggiare.online
-
88y4.com
-
newtls.com
-
yeahluck.com
-
kisah.xyz
-
sickred.com
-
infinityinformations.net
-
impqtantaou.com
-
gesips.com
-
elnejjarconsulting.com
-
cbbworld.com
-
vaidix.com
-
cloudx1.com
-
recoveringerasedhistories.com
-
botoxbackbay.com
-
markkevinvirtual.online
-
cavalli-tower.com
-
rhynonnfginc.com
-
sosglobalus.com
-
yourhandyhelper.biz
-
carton.tools
-
millionairedatingnow.com
-
maderascarril.com
-
fuju168.com
-
memf.xyz
-
fromtotravel.com
-
timo-music.com
-
freezecraft.xyz
-
odieuxclothing.com
-
besthealthretreats.info
-
alyum.solutions
-
classisst.com
-
skillfulexoticpets.com
-
luxuryhotelnearme.com
-
igingood.com
-
addmarket.agency
-
crosschainloan.com
-
indigeneex.com
-
vanisconsulting.com
-
lznbe.com
-
mrssmileys.com
-
tomessagenow0382.com
-
gsjbd27.club
-
spirtlenders.com
Signatures
- suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
- Xloader Payload 5 IoCs
resource yara_rule behavioral2/memory/2536-133-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral2/memory/2536-138-0x0000000000930000-0x000000000331A000-memory.dmp xloader behavioral2/memory/1572-141-0x0000000000960000-0x0000000000989000-memory.dmp xloader behavioral2/memory/1572-142-0x00000000030F0000-0x0000000004EBA000-memory.dmp xloader behavioral2/memory/1572-143-0x00000000030F0000-0x0000000004EBA000-memory.dmp xloader - Sets service image path in registry 2 TTPs
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2628 set thread context of 2536 2628 vbc.exe 54 PID 2536 set thread context of 2412 2536 subst.exe 30 PID 1572 set thread context of 2412 1572 systray.exe 30 - Modifies data under HKEY_USERS 41 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed WaaSMedicAgent.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs WaaSMedicAgent.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2628 vbc.exe 2628 vbc.exe 2628 vbc.exe 2628 vbc.exe 2628 vbc.exe 2628 vbc.exe 2628 vbc.exe 2628 vbc.exe 2536 subst.exe 2536 subst.exe 2536 subst.exe 2536 subst.exe 2628 vbc.exe 2628 vbc.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe 1572 systray.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2412 Explorer.EXE - Suspicious behavior: MapViewOfSection 5 IoCs
pid Process 2536 subst.exe 2536 subst.exe 2536 subst.exe 1572 systray.exe 1572 systray.exe - Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2628 vbc.exe Token: SeDebugPrivilege 2536 subst.exe Token: SeDebugPrivilege 1572 systray.exe Token: SeShutdownPrivilege 2412 Explorer.EXE Token: SeCreatePagefilePrivilege 2412 Explorer.EXE - Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2628 wrote to memory of 2536 2628 vbc.exe 54 PID 2628 wrote to memory of 2536 2628 vbc.exe 54 PID 2628 wrote to memory of 2536 2628 vbc.exe 54 PID 2628 wrote to memory of 2536 2628 vbc.exe 54 PID 2628 wrote to memory of 2536 2628 vbc.exe 54 PID 2628 wrote to memory of 2536 2628 vbc.exe 54 PID 2628 wrote to memory of 2536 2628 vbc.exe 54 PID 2412 wrote to memory of 1572 2412 Explorer.EXE 57 PID 2412 wrote to memory of 1572 2412 Explorer.EXE 57 PID 2412 wrote to memory of 1572 2412 Explorer.EXE 57 PID 1572 wrote to memory of 1956 1572 systray.exe 59 PID 1572 wrote to memory of 1956 1572 systray.exe 59 PID 1572 wrote to memory of 1956 1572 systray.exe 59
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2412 -
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2628 -
C:\Windows\SysWOW64\subst.exe"C:\Windows\SysWOW64\subst.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2536
-
-
-
C:\Windows\SysWOW64\systray.exe"C:\Windows\SysWOW64\systray.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\subst.exe"3⤵PID:1956
-
-
-
C:\Windows\System32\WaaSMedicAgent.exeC:\Windows\System32\WaaSMedicAgent.exe 9dc5ec1bd49c4f102d619d2181c08a7a rgc2K9PA90qmuRN9NPYDtA.0.1.0.0.01⤵
- Modifies data under HKEY_USERS
PID:2292