Analysis
- max time kernel
151s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
03/03/2022, 16:31
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
vbc.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target vbc.exe
- Size 357KB
- Sample220303-t1c9eadebl
- SHA256 d618d086cdfc61b69e6d93a13cea06e98ac2ad7d846f044990f2ce8305fe8d1b
- MD5 d2660f79c6ed3fa6e6d9e2d261a07085
- SHA1 6f62d52b374fa52a1d3d188cab916a451937deb2
- SHA512 00b3b044985da851c70057d458e76830acea93d76769d7a42db1fd803905b63aa6e81154f5582d4c7c70f738654d5cfbc565dd8e573b2f9f277dc0f77c368cff
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://venis.ml/
-
http://tootoo.ga/
-
http://eyecosl.ga/
-
http://bullions.tk/
-
http://mizangs.tw/
-
http://xpowebs.ga/
rc4.i32
rc4.i32
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
description pid Process procid_target PID 368 created 4956 368 WerFault.exe 88 PID 2632 created 2396 2632 WerFault.exe 96 - Executes dropped EXE 1 IoCs
pid Process 4080 941F.exe - Uses the VBS compiler for execution 1 TTPs
- Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
pid pid_target Process procid_target 932 4956 WerFault.exe 88 4404 2396 WerFault.exe 96 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vbc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vbc.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI vbc.exe - Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe - Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1556 vbc.exe 1556 vbc.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found - Suspicious behavior: MapViewOfSection 15 IoCs
pid Process 1556 vbc.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeRestorePrivilege 932 WerFault.exe Token: SeBackupPrivilege 932 WerFault.exe Token: SeBackupPrivilege 932 WerFault.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found - Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 3024 wrote to memory of 4080 3024 Process not Found 87 PID 3024 wrote to memory of 4080 3024 Process not Found 87 PID 3024 wrote to memory of 4080 3024 Process not Found 87 PID 3024 wrote to memory of 4956 3024 Process not Found 88 PID 3024 wrote to memory of 4956 3024 Process not Found 88 PID 3024 wrote to memory of 4956 3024 Process not Found 88 PID 3024 wrote to memory of 4956 3024 Process not Found 88 PID 368 wrote to memory of 4956 368 WerFault.exe 88 PID 368 wrote to memory of 4956 368 WerFault.exe 88 PID 3024 wrote to memory of 4372 3024 Process not Found 92 PID 3024 wrote to memory of 4372 3024 Process not Found 92 PID 3024 wrote to memory of 4372 3024 Process not Found 92 PID 3024 wrote to memory of 1376 3024 Process not Found 93 PID 3024 wrote to memory of 1376 3024 Process not Found 93 PID 3024 wrote to memory of 1376 3024 Process not Found 93 PID 3024 wrote to memory of 1376 3024 Process not Found 93 PID 3024 wrote to memory of 1552 3024 Process not Found 95 PID 3024 wrote to memory of 1552 3024 Process not Found 95 PID 3024 wrote to memory of 1552 3024 Process not Found 95 PID 3024 wrote to memory of 1552 3024 Process not Found 95 PID 3024 wrote to memory of 2396 3024 Process not Found 96 PID 3024 wrote to memory of 2396 3024 Process not Found 96 PID 3024 wrote to memory of 2396 3024 Process not Found 96 PID 3024 wrote to memory of 1876 3024 Process not Found 97 PID 3024 wrote to memory of 1876 3024 Process not Found 97 PID 3024 wrote to memory of 1876 3024 Process not Found 97 PID 3024 wrote to memory of 1876 3024 Process not Found 97 PID 2632 wrote to memory of 2396 2632 WerFault.exe 96 PID 2632 wrote to memory of 2396 2632 WerFault.exe 96 PID 3024 wrote to memory of 3172 3024 Process not Found 100 PID 3024 wrote to memory of 3172 3024 Process not Found 100 PID 3024 wrote to memory of 3172 3024 Process not Found 100
Processes
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1556
-
C:\Users\Admin\AppData\Local\Temp\941F.exeC:\Users\Admin\AppData\Local\Temp\941F.exe1⤵
- Executes dropped EXE
PID:4080
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:4956
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4956 -s 8722⤵
- Drops file in Windows directory
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:932
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 4956 -ip 49561⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:368
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:4372
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1376
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1552
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:2396
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2396 -s 1202⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
PID:4404
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵PID:1876
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 508 -p 2396 -ip 23961⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:2632
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵PID:3172