Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
25-01-2022 17:12
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-en-20211208
General
-
Target
vbc.exe
-
Size
845KB
-
MD5
0becd341e0585b0c5a278e62a9727a9a
-
SHA1
71b8b08ab44bb93a2bacb3948a8dee5273f78488
-
SHA256
ee5dd80f9946c3b8221409e1aed242cd36a8188850718f89722b48404906275e
-
SHA512
9edfca50d1ebe082bd13ba32de078bca96a06c8bf18b56471f12adfd3a05830eb821f5ce26404d1e2bea48b3dda3b74b06ae3f4922de2c1842f17329173a1cb9
Malware Config
Extracted
xloader
2.5
nt3f
tricyclee.com
kxsw999.com
wisteria-pavilion.com
bellaclancy.com
promissioskincare.com
hzy001.xyz
checkouthomehd.com
soladere.com
point4sales.com
socalmafia.com
libertadysarmiento.online
nftthirty.com
digitalgoldcryptostock.net
tulekiloscaird.com
austinfishandchicken.com
wlxxch.com
mgav51.xyz
landbanking.global
saprove.com
babyfaces.skin
elainemaxwellcoaching.com
1388xc.com
juveniscloud.com
bsauksjon.com
the-waterkooler.com
comment-changer-sa-vie.com
psmcnd.top
rhodesleadingedge.com
mccuelawfirm.com
skinnscience.club
hype-clicks.com
liaojinc.xyz
okmakers.com
ramblertour.online
wickedhunterworld.com
fit-threads.com
cookidoo.website
magentabin.com
pynch1.com
best-paper-to-know-today.info
allmight.net
monicraftsprintables.com
avataroasis.com
10dian-4.com
cozastore.net
capitalcased.com
spacezanome.xyz
feiyangmi.com
11opus.com
getinteriorsolution.com
tidyhutstore.com
amazingpomskyfamily.com
tfcvintage.com
halfanape.com
rotakb.com
martinasfood.com
the-thanks.com
mithilmehta.com
em-photo.art
primerepro.com
lankasirinspa.com
gtbaibang.com
zealandiatobacco.com
deepikatransportpackers.com
eagle-meter.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1444-128-0x0000000000400000-0x0000000000429000-memory.dmp xloader behavioral2/memory/1736-148-0x0000000000530000-0x0000000000559000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.execmstp.exedescription pid process target process PID 2632 set thread context of 1444 2632 vbc.exe vbc.exe PID 1444 set thread context of 1928 1444 vbc.exe Explorer.EXE PID 1736 set thread context of 1928 1736 cmstp.exe Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 41 IoCs
Processes:
vbc.exepowershell.exevbc.execmstp.exepid process 2632 vbc.exe 2632 vbc.exe 3068 powershell.exe 1444 vbc.exe 1444 vbc.exe 1444 vbc.exe 1444 vbc.exe 3068 powershell.exe 3068 powershell.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe 1736 cmstp.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1928 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.execmstp.exepid process 1444 vbc.exe 1444 vbc.exe 1444 vbc.exe 1736 cmstp.exe 1736 cmstp.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
vbc.exepowershell.exevbc.execmstp.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 2632 vbc.exe Token: SeDebugPrivilege 3068 powershell.exe Token: SeDebugPrivilege 1444 vbc.exe Token: SeDebugPrivilege 1736 cmstp.exe Token: SeShutdownPrivilege 1928 Explorer.EXE Token: SeCreatePagefilePrivilege 1928 Explorer.EXE -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
vbc.exeExplorer.EXEdescription pid process target process PID 2632 wrote to memory of 3068 2632 vbc.exe powershell.exe PID 2632 wrote to memory of 3068 2632 vbc.exe powershell.exe PID 2632 wrote to memory of 3068 2632 vbc.exe powershell.exe PID 2632 wrote to memory of 688 2632 vbc.exe schtasks.exe PID 2632 wrote to memory of 688 2632 vbc.exe schtasks.exe PID 2632 wrote to memory of 688 2632 vbc.exe schtasks.exe PID 2632 wrote to memory of 1556 2632 vbc.exe vbc.exe PID 2632 wrote to memory of 1556 2632 vbc.exe vbc.exe PID 2632 wrote to memory of 1556 2632 vbc.exe vbc.exe PID 2632 wrote to memory of 1444 2632 vbc.exe vbc.exe PID 2632 wrote to memory of 1444 2632 vbc.exe vbc.exe PID 2632 wrote to memory of 1444 2632 vbc.exe vbc.exe PID 2632 wrote to memory of 1444 2632 vbc.exe vbc.exe PID 2632 wrote to memory of 1444 2632 vbc.exe vbc.exe PID 2632 wrote to memory of 1444 2632 vbc.exe vbc.exe PID 1928 wrote to memory of 1736 1928 Explorer.EXE cmstp.exe PID 1928 wrote to memory of 1736 1928 Explorer.EXE cmstp.exe PID 1928 wrote to memory of 1736 1928 Explorer.EXE cmstp.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\szzAArbkCRJS.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\szzAArbkCRJS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpA072.tmp"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmstp.exe"C:\Windows\SysWOW64\cmstp.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpA072.tmpMD5
34d973ae14ad50092ecc0ec53afbe30a
SHA1c1abd631ab5fe08024477f51ce1400eaed43eacc
SHA25630d2fcfe1d3c93eadd76945ae28396dbc9a76825d4e4b8b4ed3ecc201b86c0fc
SHA5123b82decb57dd9e8c9e06a1d3e9e0ae7f70566eae078366ad65804a8eca494a00d0cbdcf9c91e266ccb6c8fb88ed8c698355d384d975f1fe94ee0076d26672d1b
-
memory/1444-139-0x0000000001110000-0x0000000001430000-memory.dmpFilesize
3.1MB
-
memory/1444-140-0x0000000000B00000-0x0000000000C4A000-memory.dmpFilesize
1.3MB
-
memory/1444-128-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1736-149-0x00000000046D0000-0x00000000049F0000-memory.dmpFilesize
3.1MB
-
memory/1736-147-0x00000000009B0000-0x00000000009C6000-memory.dmpFilesize
88KB
-
memory/1736-148-0x0000000000530000-0x0000000000559000-memory.dmpFilesize
164KB
-
memory/1736-163-0x0000000004530000-0x00000000046C2000-memory.dmpFilesize
1.6MB
-
memory/1928-166-0x0000000004F60000-0x00000000050EA000-memory.dmpFilesize
1.5MB
-
memory/1928-141-0x0000000004E30000-0x0000000004F5D000-memory.dmpFilesize
1.2MB
-
memory/2632-118-0x0000000004F90000-0x000000000548E000-memory.dmpFilesize
5.0MB
-
memory/2632-117-0x0000000004E50000-0x0000000004EE2000-memory.dmpFilesize
584KB
-
memory/2632-119-0x0000000004E20000-0x0000000004E2A000-memory.dmpFilesize
40KB
-
memory/2632-120-0x0000000005160000-0x00000000051FC000-memory.dmpFilesize
624KB
-
memory/2632-115-0x0000000000520000-0x00000000005FA000-memory.dmpFilesize
872KB
-
memory/2632-123-0x0000000005DF0000-0x0000000005E9A000-memory.dmpFilesize
680KB
-
memory/2632-122-0x000000007EAF0000-0x000000007EAF1000-memory.dmpFilesize
4KB
-
memory/2632-121-0x0000000005240000-0x000000000524E000-memory.dmpFilesize
56KB
-
memory/2632-116-0x0000000005490000-0x000000000598E000-memory.dmpFilesize
5.0MB
-
memory/3068-130-0x0000000004290000-0x0000000004291000-memory.dmpFilesize
4KB
-
memory/3068-154-0x000000007E6A0000-0x000000007E6A1000-memory.dmpFilesize
4KB
-
memory/3068-137-0x00000000074F0000-0x000000000750C000-memory.dmpFilesize
112KB
-
memory/3068-135-0x0000000007700000-0x0000000007A50000-memory.dmpFilesize
3.3MB
-
memory/3068-134-0x0000000007680000-0x00000000076E6000-memory.dmpFilesize
408KB
-
memory/3068-142-0x0000000007E20000-0x0000000007E96000-memory.dmpFilesize
472KB
-
memory/3068-133-0x0000000007430000-0x0000000007496000-memory.dmpFilesize
408KB
-
memory/3068-132-0x0000000006C30000-0x0000000006C52000-memory.dmpFilesize
136KB
-
memory/3068-131-0x0000000004270000-0x0000000004293000-memory.dmpFilesize
140KB
-
memory/3068-138-0x0000000007B10000-0x0000000007B5B000-memory.dmpFilesize
300KB
-
memory/3068-155-0x0000000008CC0000-0x0000000008CF3000-memory.dmpFilesize
204KB
-
memory/3068-156-0x0000000007F20000-0x0000000007F3E000-memory.dmpFilesize
120KB
-
memory/3068-161-0x0000000008DF0000-0x0000000008E95000-memory.dmpFilesize
660KB
-
memory/3068-162-0x0000000004293000-0x0000000004294000-memory.dmpFilesize
4KB
-
memory/3068-129-0x0000000006CD0000-0x00000000072F8000-memory.dmpFilesize
6.2MB
-
memory/3068-164-0x0000000009160000-0x00000000091F4000-memory.dmpFilesize
592KB
-
memory/3068-127-0x0000000006660000-0x0000000006696000-memory.dmpFilesize
216KB
-
memory/3068-358-0x00000000090C0000-0x00000000090DA000-memory.dmpFilesize
104KB
-
memory/3068-363-0x0000000008C30000-0x0000000008C38000-memory.dmpFilesize
32KB