Analysis

  • max time kernel
    148s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    25-01-2022 17:12

General

  • Target

    vbc.exe

  • Size

    845KB

  • MD5

    0becd341e0585b0c5a278e62a9727a9a

  • SHA1

    71b8b08ab44bb93a2bacb3948a8dee5273f78488

  • SHA256

    ee5dd80f9946c3b8221409e1aed242cd36a8188850718f89722b48404906275e

  • SHA512

    9edfca50d1ebe082bd13ba32de078bca96a06c8bf18b56471f12adfd3a05830eb821f5ce26404d1e2bea48b3dda3b74b06ae3f4922de2c1842f17329173a1cb9

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

nt3f

Decoy

tricyclee.com

kxsw999.com

wisteria-pavilion.com

bellaclancy.com

promissioskincare.com

hzy001.xyz

checkouthomehd.com

soladere.com

point4sales.com

socalmafia.com

libertadysarmiento.online

nftthirty.com

digitalgoldcryptostock.net

tulekiloscaird.com

austinfishandchicken.com

wlxxch.com

mgav51.xyz

landbanking.global

saprove.com

babyfaces.skin

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • Xloader Payload 2 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 19 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\vbc.exe
      "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1940
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\szzAArbkCRJS.exe"
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1512
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\szzAArbkCRJS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAE87.tmp"
        3⤵
        • Creates scheduled task(s)
        PID:580
      • C:\Users\Admin\AppData\Local\Temp\vbc.exe
        "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1404
    • C:\Windows\SysWOW64\raserver.exe
      "C:\Windows\SysWOW64\raserver.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      PID:1760

Network

MITRE ATT&CK Matrix ATT&CK v6

Execution

Scripting

1
T1064

Scheduled Task

1
T1053

Persistence

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Scripting

1
T1064

Discovery

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\tmpAE87.tmp
    MD5

    581192fce416bcb372caab725dc686ba

    SHA1

    df1f087d15ce1d12d7172052bc33354dd15d6026

    SHA256

    4e37c5d310089c96191ebef5a30855d48b6bffb21a62f13edf0f48c57cb18c2a

    SHA512

    e65d86ebe9a30723340ca76eb24c57a96393626b83baaeb58696b60024d387fe3de550f50d0d88cf671493734d5c5d9ccd1f9b03c69aa917fb7618859a0f816b

  • memory/1284-78-0x0000000006A70000-0x0000000006B84000-memory.dmp
    Filesize

    1.1MB

  • memory/1284-70-0x00000000051A0000-0x0000000005269000-memory.dmp
    Filesize

    804KB

  • memory/1404-68-0x00000000008A0000-0x0000000000BA3000-memory.dmp
    Filesize

    3.0MB

  • memory/1404-69-0x0000000000430000-0x0000000000441000-memory.dmp
    Filesize

    68KB

  • memory/1404-62-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1404-63-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1404-64-0x0000000000400000-0x0000000000429000-memory.dmp
    Filesize

    164KB

  • memory/1512-72-0x0000000002480000-0x00000000030CA000-memory.dmp
    Filesize

    12.3MB

  • memory/1512-71-0x0000000002480000-0x00000000030CA000-memory.dmp
    Filesize

    12.3MB

  • memory/1760-74-0x0000000000220000-0x000000000023C000-memory.dmp
    Filesize

    112KB

  • memory/1760-75-0x0000000000080000-0x00000000000A9000-memory.dmp
    Filesize

    164KB

  • memory/1760-76-0x0000000001FB0000-0x00000000022B3000-memory.dmp
    Filesize

    3.0MB

  • memory/1760-77-0x0000000001E20000-0x0000000001EB0000-memory.dmp
    Filesize

    576KB

  • memory/1940-59-0x0000000005720000-0x00000000057CA000-memory.dmp
    Filesize

    680KB

  • memory/1940-58-0x000000007EF40000-0x000000007EF41000-memory.dmp
    Filesize

    4KB

  • memory/1940-57-0x0000000000A80000-0x0000000000A8E000-memory.dmp
    Filesize

    56KB

  • memory/1940-56-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
    Filesize

    4KB

  • memory/1940-54-0x0000000000C20000-0x0000000000CFA000-memory.dmp
    Filesize

    872KB

  • memory/1940-55-0x00000000760F1000-0x00000000760F3000-memory.dmp
    Filesize

    8KB