Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
15/03/2022, 13:00
General
- Target vbc.exe
- Size 683KB
- Sample220315-p8rpjsbdf8
- SHA256 39ce700e582c22bf87f67241aa5537b74991a30d016878bdd6c2dfd6dc114f9d
Malware Config
Extracted
-
xloader
-
2.5
-
e3rs
-
padisarealtygroup.com
-
sagedermatology.com
-
drlonnrobertson.com
-
carlesabadtent.com
-
sophisticatedsignings.com
-
xn--laufgefhl-w9a.com
-
sutnsdmxq.icu
-
atasteofcal.com
-
ocvcoins.com
-
trakauto.quest
-
l2plusleft.com
-
in-cruise.online
-
ybappdl.com
-
county7.com
-
tenlog020.xyz
-
eventsweekend.net
-
zxzxmail.com
-
65backyard.com
-
sunnycraftsman.com
-
sailorswife.online
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 2 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
- Suspicious behavior: EnumeratesProcesses 58 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\logagent.exeC:\Windows\System32\logagent.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\SysWOW64\ipconfig.exe"2⤵
- Suspicious use of SetThreadContext
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1012-131-0x0000000002120000-0x0000000002121000-memory.dmp
memory/1476-141-0x0000000000E30000-0x0000000000E59000-memory.dmp
memory/1476-140-0x0000000000A30000-0x0000000000A3B000-memory.dmp
memory/1476-142-0x0000000001680000-0x00000000019CA000-memory.dmp
memory/1476-143-0x0000000001410000-0x00000000014A0000-memory.dmp
memory/1832-133-0x00000000005A0000-0x00000000005A1000-memory.dmp
memory/1832-134-0x0000000072480000-0x00000000724A9000-memory.dmp
memory/1832-136-0x0000000002860000-0x0000000002BAA000-memory.dmp
memory/1832-137-0x000000007249D000-0x000000007249E000-memory.dmp
memory/1832-138-0x0000000002690000-0x00000000026A1000-memory.dmp
memory/2416-139-0x0000000007C20000-0x0000000007D96000-memory.dmp
memory/2416-144-0x0000000007DA0000-0x0000000007EEB000-memory.dmp