Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 17:12
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20211208
General
-
Target
vbc.exe
-
Size
845KB
-
MD5
0becd341e0585b0c5a278e62a9727a9a
-
SHA1
71b8b08ab44bb93a2bacb3948a8dee5273f78488
-
SHA256
ee5dd80f9946c3b8221409e1aed242cd36a8188850718f89722b48404906275e
-
SHA512
9edfca50d1ebe082bd13ba32de078bca96a06c8bf18b56471f12adfd3a05830eb821f5ce26404d1e2bea48b3dda3b74b06ae3f4922de2c1842f17329173a1cb9
Malware Config
Extracted
xloader
2.5
nt3f
tricyclee.com
kxsw999.com
wisteria-pavilion.com
bellaclancy.com
promissioskincare.com
hzy001.xyz
checkouthomehd.com
soladere.com
point4sales.com
socalmafia.com
libertadysarmiento.online
nftthirty.com
digitalgoldcryptostock.net
tulekiloscaird.com
austinfishandchicken.com
wlxxch.com
mgav51.xyz
landbanking.global
saprove.com
babyfaces.skin
elainemaxwellcoaching.com
1388xc.com
juveniscloud.com
bsauksjon.com
the-waterkooler.com
comment-changer-sa-vie.com
psmcnd.top
rhodesleadingedge.com
mccuelawfirm.com
skinnscience.club
hype-clicks.com
liaojinc.xyz
okmakers.com
ramblertour.online
wickedhunterworld.com
fit-threads.com
cookidoo.website
magentabin.com
pynch1.com
best-paper-to-know-today.info
allmight.net
monicraftsprintables.com
avataroasis.com
10dian-4.com
cozastore.net
capitalcased.com
spacezanome.xyz
feiyangmi.com
11opus.com
getinteriorsolution.com
tidyhutstore.com
amazingpomskyfamily.com
tfcvintage.com
halfanape.com
rotakb.com
martinasfood.com
the-thanks.com
mithilmehta.com
em-photo.art
primerepro.com
lankasirinspa.com
gtbaibang.com
zealandiatobacco.com
deepikatransportpackers.com
eagle-meter.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1404-64-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral1/memory/1760-75-0x0000000000080000-0x00000000000A9000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exeraserver.exedescription pid process target process PID 1940 set thread context of 1404 1940 vbc.exe vbc.exe PID 1404 set thread context of 1284 1404 vbc.exe Explorer.EXE PID 1760 set thread context of 1284 1760 raserver.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
vbc.exepowershell.exeraserver.exepid process 1404 vbc.exe 1404 vbc.exe 1512 powershell.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe 1760 raserver.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exeraserver.exepid process 1404 vbc.exe 1404 vbc.exe 1404 vbc.exe 1760 raserver.exe 1760 raserver.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exepowershell.exeraserver.exedescription pid process Token: SeDebugPrivilege 1404 vbc.exe Token: SeDebugPrivilege 1512 powershell.exe Token: SeDebugPrivilege 1760 raserver.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
vbc.exeExplorer.EXEdescription pid process target process PID 1940 wrote to memory of 1512 1940 vbc.exe powershell.exe PID 1940 wrote to memory of 1512 1940 vbc.exe powershell.exe PID 1940 wrote to memory of 1512 1940 vbc.exe powershell.exe PID 1940 wrote to memory of 1512 1940 vbc.exe powershell.exe PID 1940 wrote to memory of 580 1940 vbc.exe schtasks.exe PID 1940 wrote to memory of 580 1940 vbc.exe schtasks.exe PID 1940 wrote to memory of 580 1940 vbc.exe schtasks.exe PID 1940 wrote to memory of 580 1940 vbc.exe schtasks.exe PID 1940 wrote to memory of 1404 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 1404 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 1404 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 1404 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 1404 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 1404 1940 vbc.exe vbc.exe PID 1940 wrote to memory of 1404 1940 vbc.exe vbc.exe PID 1284 wrote to memory of 1760 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 1760 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 1760 1284 Explorer.EXE raserver.exe PID 1284 wrote to memory of 1760 1284 Explorer.EXE raserver.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\szzAArbkCRJS.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\szzAArbkCRJS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAE87.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\raserver.exe"C:\Windows\SysWOW64\raserver.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpAE87.tmpMD5
581192fce416bcb372caab725dc686ba
SHA1df1f087d15ce1d12d7172052bc33354dd15d6026
SHA2564e37c5d310089c96191ebef5a30855d48b6bffb21a62f13edf0f48c57cb18c2a
SHA512e65d86ebe9a30723340ca76eb24c57a96393626b83baaeb58696b60024d387fe3de550f50d0d88cf671493734d5c5d9ccd1f9b03c69aa917fb7618859a0f816b
-
memory/1284-78-0x0000000006A70000-0x0000000006B84000-memory.dmpFilesize
1.1MB
-
memory/1284-70-0x00000000051A0000-0x0000000005269000-memory.dmpFilesize
804KB
-
memory/1404-68-0x00000000008A0000-0x0000000000BA3000-memory.dmpFilesize
3.0MB
-
memory/1404-69-0x0000000000430000-0x0000000000441000-memory.dmpFilesize
68KB
-
memory/1404-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1404-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1404-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1512-72-0x0000000002480000-0x00000000030CA000-memory.dmpFilesize
12.3MB
-
memory/1512-71-0x0000000002480000-0x00000000030CA000-memory.dmpFilesize
12.3MB
-
memory/1760-74-0x0000000000220000-0x000000000023C000-memory.dmpFilesize
112KB
-
memory/1760-75-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1760-76-0x0000000001FB0000-0x00000000022B3000-memory.dmpFilesize
3.0MB
-
memory/1760-77-0x0000000001E20000-0x0000000001EB0000-memory.dmpFilesize
576KB
-
memory/1940-59-0x0000000005720000-0x00000000057CA000-memory.dmpFilesize
680KB
-
memory/1940-58-0x000000007EF40000-0x000000007EF41000-memory.dmpFilesize
4KB
-
memory/1940-57-0x0000000000A80000-0x0000000000A8E000-memory.dmpFilesize
56KB
-
memory/1940-56-0x0000000004EC0000-0x0000000004EC1000-memory.dmpFilesize
4KB
-
memory/1940-54-0x0000000000C20000-0x0000000000CFA000-memory.dmpFilesize
872KB
-
memory/1940-55-0x00000000760F1000-0x00000000760F3000-memory.dmpFilesize
8KB