Analysis
-
max time kernel
151s -
max time network
186s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
07-05-2022 04:28
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20220414-en
General
-
Target
vbc.exe
-
Size
790KB
-
MD5
14f5bfcb44b9511f2cfac6f29ab55898
-
SHA1
f8dd1f7ec5259168dc98367c3eaa998f08b41a9d
-
SHA256
8ba3166fa29eedff427b62c2d1b05984949a1ac87a34ffa2ab95f4404e96d0e7
-
SHA512
0bd4db6d4f45a58b25445726956876d5546bcf73436b0b7c0411ef3d0e683fd91707551a146e775482399896ea6581caaa3d57d3e966a17a451315dcdf1f3b02
Malware Config
Extracted
xloader
2.5
arh2
anniversaryalert.com
kinship.space
buabdullagroup.com
ghostprotectionagency.com
scion-go-getter.com
skindeepapp.com
kysp3.xyz
bonitaspringshomesearch.com
bestdeals2022.online
themarketingstinger.com
chengkayouxuan.com
fendoremi.com
j-stra.com
klingelecn.net
deluxecarepro.com
huanbaodg.com
mes-dents-blanches.com
solutionsemissionsimplifiee.com
abedbashir.tech
good-collection.store
zulijian1.com
deuxtonnes.com
va-products.com
limpiezaspricila.com
hollyweednc.com
liylaehamartoyof4.xyz
lauraloewendesign.com
gozabank.com
iconicbeauty.co
huashiren.xyz
bdsdaivietphat.com
josephgoddard.com
bburagotr.xyz
produkoriginal.store
6156yy.com
cellfacility.com
elictriczone.com
regaldock.com
yourvitalstatistics.com
nextgen-shareholder.com
charlie-dean.com
abodebuildinggroup.com
fortunabs.com
elizabethsilvasuarez.com
setsrl.net
neskasdreams.com
abubuntunginxsetup.xyz
ubspropertyservices.com
spiritpriest.com
altaingenieriainc.net
oldhamcars.com
daimaoart.com
5u8n.com
ppcpowered.com
pmariutto.com
opendialogmonaco.com
project66bug.com
goddesscodes.love
talkingwithmarcus.com
tranvantuan.xyz
priexalidomoi.store
un2030.com
loancreditscan.com
tg88.bet
rshedm.com
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3384-137-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral2/memory/3384-139-0x0000000000400000-0x000000000042A000-memory.dmp xloader behavioral2/memory/616-145-0x0000000000D60000-0x0000000000D89000-memory.dmp xloader -
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion vbc.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
vbc.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum vbc.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 vbc.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exeWPDShextAutoplay.exesvchost.exedescription pid process target process PID 4368 set thread context of 3384 4368 vbc.exe WPDShextAutoplay.exe PID 3384 set thread context of 2576 3384 WPDShextAutoplay.exe Explorer.EXE PID 616 set thread context of 2576 616 svchost.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
vbc.exeWPDShextAutoplay.exesvchost.exepid process 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 4368 vbc.exe 3384 WPDShextAutoplay.exe 3384 WPDShextAutoplay.exe 3384 WPDShextAutoplay.exe 3384 WPDShextAutoplay.exe 4368 vbc.exe 4368 vbc.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe 616 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2576 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
WPDShextAutoplay.exesvchost.exepid process 3384 WPDShextAutoplay.exe 3384 WPDShextAutoplay.exe 3384 WPDShextAutoplay.exe 616 svchost.exe 616 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exeWPDShextAutoplay.exesvchost.exedescription pid process Token: SeDebugPrivilege 4368 vbc.exe Token: SeDebugPrivilege 3384 WPDShextAutoplay.exe Token: SeDebugPrivilege 616 svchost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
vbc.exeExplorer.EXEsvchost.exedescription pid process target process PID 4368 wrote to memory of 1320 4368 vbc.exe netbtugc.exe PID 4368 wrote to memory of 1320 4368 vbc.exe netbtugc.exe PID 4368 wrote to memory of 1320 4368 vbc.exe netbtugc.exe PID 4368 wrote to memory of 3384 4368 vbc.exe WPDShextAutoplay.exe PID 4368 wrote to memory of 3384 4368 vbc.exe WPDShextAutoplay.exe PID 4368 wrote to memory of 3384 4368 vbc.exe WPDShextAutoplay.exe PID 4368 wrote to memory of 3384 4368 vbc.exe WPDShextAutoplay.exe PID 4368 wrote to memory of 3384 4368 vbc.exe WPDShextAutoplay.exe PID 4368 wrote to memory of 3384 4368 vbc.exe WPDShextAutoplay.exe PID 4368 wrote to memory of 3384 4368 vbc.exe WPDShextAutoplay.exe PID 2576 wrote to memory of 616 2576 Explorer.EXE svchost.exe PID 2576 wrote to memory of 616 2576 Explorer.EXE svchost.exe PID 2576 wrote to memory of 616 2576 Explorer.EXE svchost.exe PID 616 wrote to memory of 2408 616 svchost.exe cmd.exe PID 616 wrote to memory of 2408 616 svchost.exe cmd.exe PID 616 wrote to memory of 2408 616 svchost.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\srdelayed.exe"C:\Windows\SysWOW64\srdelayed.exe"2⤵
-
C:\Windows\SysWOW64\netbtugc.exe"C:\Windows\SysWOW64\netbtugc.exe"2⤵
-
C:\Windows\SysWOW64\autofmt.exe"C:\Windows\SysWOW64\autofmt.exe"2⤵
-
C:\Windows\SysWOW64\WPDShextAutoplay.exe"C:\Windows\SysWOW64\WPDShextAutoplay.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\WPDShextAutoplay.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/616-148-0x0000000001890000-0x0000000001920000-memory.dmpFilesize
576KB
-
memory/616-147-0x0000000001A00000-0x0000000001D4A000-memory.dmpFilesize
3.3MB
-
memory/616-145-0x0000000000D60000-0x0000000000D89000-memory.dmpFilesize
164KB
-
memory/616-144-0x00000000003B0000-0x00000000003BE000-memory.dmpFilesize
56KB
-
memory/616-143-0x0000000000000000-mapping.dmp
-
memory/1320-135-0x0000000000000000-mapping.dmp
-
memory/2408-146-0x0000000000000000-mapping.dmp
-
memory/2576-142-0x0000000002DF0000-0x0000000002F4F000-memory.dmpFilesize
1.4MB
-
memory/2576-149-0x0000000008920000-0x00000000089E4000-memory.dmpFilesize
784KB
-
memory/3384-139-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/3384-140-0x0000000001860000-0x0000000001BAA000-memory.dmpFilesize
3.3MB
-
memory/3384-141-0x0000000001830000-0x0000000001841000-memory.dmpFilesize
68KB
-
memory/3384-136-0x0000000000000000-mapping.dmp
-
memory/3384-137-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/4368-130-0x0000000000520000-0x00000000005EC000-memory.dmpFilesize
816KB
-
memory/4368-134-0x0000000006C10000-0x0000000006C76000-memory.dmpFilesize
408KB
-
memory/4368-133-0x00000000050B0000-0x000000000514C000-memory.dmpFilesize
624KB
-
memory/4368-132-0x0000000004F70000-0x0000000005002000-memory.dmpFilesize
584KB
-
memory/4368-131-0x0000000005430000-0x00000000059D4000-memory.dmpFilesize
5.6MB