Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
19-05-2022 02:23
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20220414-en
General
-
Target
vbc.exe
-
Size
1.0MB
-
MD5
9c57cf589c6ff051d2aec2bbaf515dfb
-
SHA1
846b8e1244b7a7e2cbddbd837c77708b6bb0bb32
-
SHA256
4daead502dfca41fa6e5789eb458e5bc60ed7da6c8af2229596e1e0697f50701
-
SHA512
2947df318501ce13e7b99cf65fc0f18db3086f6ac97727831ffdb253a28fdce3ce10d1d1998b80423d313ae5d375ad2f65ff9b3741774e2a3632de7862364a0e
Malware Config
Extracted
xloader
2.6
arh2
hstorc.com
blackountry.com
dhrbakery.com
dezhouofit.com
defipayout.xyz
ginas4t.com
byzbh63.xyz
qrcrashview.com
mialibaby.com
enhaut.net
samainnova.com
yashveerresort.com
delfos.online
dungcumay.com
lj-counseling.net
fliptheswitch.pro
padogbitelawyer.com
aticarev.com
sederino.site
bestplansforpets-japan3.life
radicallysimplesupps.com
sandbagmaker.com
misdcf.xyz
nbpz.xyz
floridasunbreaks.com
justfinishesofcolorado.com
homemethtestkit.com
chaquetashapticas.com
zodiactshirt.com
tees.email
zxzx999.com
tempepdf.com
watchusroll.com
parotacenter.com
assistcourse.online
paulstilingroup.com
cnbcfx.com
mooncore.xyz
laplugnation.com
gosti24.com
cthomassolutions.com
rkhubs.com
aboutpier.com
multimediaroomandboard.com
iamparrot.com
wifitest.info
nounworld.com
xpartner.biz
128grandviewdrivenewportnsw.com
bakiin.com
suitcell.com
onehitgamerstudios.com
bathingsuitsshoppingus.com
wingstarifa.com
ccasudqi.com
epiconscious.com
ponponshoes.com
cicom.tech
safetynetinc.net
recanto.xyz
sellsidelite.net
kevmoinesproperties.com
hdwallpaperpics.life
57gznfw.xyz
abtys6.online
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3856-137-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/3856-142-0x0000000000400000-0x000000000042C000-memory.dmp xloader behavioral2/memory/3568-148-0x0000000000A90000-0x0000000000ABB000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NETSTAT.EXEdescription ioc process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run NETSTAT.EXE -
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exeshrpubw.exeNETSTAT.EXEdescription pid process target process PID 4840 set thread context of 3856 4840 vbc.exe shrpubw.exe PID 3856 set thread context of 3116 3856 shrpubw.exe Explorer.EXE PID 3856 set thread context of 3116 3856 shrpubw.exe Explorer.EXE PID 3568 set thread context of 3116 3568 NETSTAT.EXE Explorer.EXE -
Drops file in Program Files directory 1 IoCs
Processes:
NETSTAT.EXEdescription ioc process File opened for modification C:\Program Files (x86)\Hgbclr2o\qv1twz8tsndh.exe NETSTAT.EXE -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
Processes:
NETSTAT.EXEpid process 3568 NETSTAT.EXE -
Suspicious behavior: EnumeratesProcesses 60 IoCs
Processes:
vbc.exeshrpubw.exeNETSTAT.EXEpid process 4840 vbc.exe 4840 vbc.exe 4840 vbc.exe 4840 vbc.exe 4840 vbc.exe 4840 vbc.exe 4840 vbc.exe 4840 vbc.exe 3856 shrpubw.exe 3856 shrpubw.exe 3856 shrpubw.exe 3856 shrpubw.exe 4840 vbc.exe 4840 vbc.exe 3856 shrpubw.exe 3856 shrpubw.exe 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE 3568 NETSTAT.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3116 Explorer.EXE -
Suspicious behavior: MapViewOfSection 6 IoCs
Processes:
shrpubw.exeNETSTAT.EXEpid process 3856 shrpubw.exe 3856 shrpubw.exe 3856 shrpubw.exe 3856 shrpubw.exe 3568 NETSTAT.EXE 3568 NETSTAT.EXE -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
vbc.exeshrpubw.exeExplorer.EXENETSTAT.EXEdescription pid process Token: SeDebugPrivilege 4840 vbc.exe Token: SeDebugPrivilege 3856 shrpubw.exe Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE Token: SeShutdownPrivilege 3116 Explorer.EXE Token: SeCreatePagefilePrivilege 3116 Explorer.EXE Token: SeDebugPrivilege 3568 NETSTAT.EXE -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
vbc.exeExplorer.EXENETSTAT.EXEdescription pid process target process PID 4840 wrote to memory of 3856 4840 vbc.exe shrpubw.exe PID 4840 wrote to memory of 3856 4840 vbc.exe shrpubw.exe PID 4840 wrote to memory of 3856 4840 vbc.exe shrpubw.exe PID 4840 wrote to memory of 3856 4840 vbc.exe shrpubw.exe PID 4840 wrote to memory of 3856 4840 vbc.exe shrpubw.exe PID 4840 wrote to memory of 3856 4840 vbc.exe shrpubw.exe PID 4840 wrote to memory of 3856 4840 vbc.exe shrpubw.exe PID 3116 wrote to memory of 3568 3116 Explorer.EXE NETSTAT.EXE PID 3116 wrote to memory of 3568 3116 Explorer.EXE NETSTAT.EXE PID 3116 wrote to memory of 3568 3116 Explorer.EXE NETSTAT.EXE PID 3568 wrote to memory of 2824 3568 NETSTAT.EXE cmd.exe PID 3568 wrote to memory of 2824 3568 NETSTAT.EXE cmd.exe PID 3568 wrote to memory of 2824 3568 NETSTAT.EXE cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4840 -
C:\Windows\SysWOW64\shrpubw.exe"C:\Windows\SysWOW64\shrpubw.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3856 -
C:\Windows\SysWOW64\NETSTAT.EXE"C:\Windows\SysWOW64\NETSTAT.EXE"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Drops file in Program Files directory
- Gathers network information
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3568 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\SysWOW64\shrpubw.exe"3⤵PID:2824
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2824-146-0x0000000000000000-mapping.dmp
-
memory/3116-141-0x00000000028C0000-0x000000000298D000-memory.dmpFilesize
820KB
-
memory/3116-144-0x0000000002990000-0x0000000002AED000-memory.dmpFilesize
1.4MB
-
memory/3116-151-0x0000000002E90000-0x0000000002F2C000-memory.dmpFilesize
624KB
-
memory/3568-145-0x0000000000000000-mapping.dmp
-
memory/3568-147-0x00000000001B0000-0x00000000001BB000-memory.dmpFilesize
44KB
-
memory/3568-148-0x0000000000A90000-0x0000000000ABB000-memory.dmpFilesize
172KB
-
memory/3568-149-0x00000000011F0000-0x000000000153A000-memory.dmpFilesize
3.3MB
-
memory/3568-150-0x00000000010D0000-0x0000000001160000-memory.dmpFilesize
576KB
-
memory/3856-142-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3856-137-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3856-139-0x0000000001430000-0x000000000177A000-memory.dmpFilesize
3.3MB
-
memory/3856-143-0x0000000000DB0000-0x0000000000DC1000-memory.dmpFilesize
68KB
-
memory/3856-136-0x0000000000000000-mapping.dmp
-
memory/3856-140-0x0000000000D40000-0x0000000000D51000-memory.dmpFilesize
68KB
-
memory/4840-134-0x0000000008E00000-0x0000000008E76000-memory.dmpFilesize
472KB
-
memory/4840-132-0x0000000005100000-0x0000000005192000-memory.dmpFilesize
584KB
-
memory/4840-131-0x00000000056B0000-0x0000000005C54000-memory.dmpFilesize
5.6MB
-
memory/4840-135-0x0000000008ED0000-0x0000000008EEE000-memory.dmpFilesize
120KB
-
memory/4840-130-0x0000000000840000-0x0000000000950000-memory.dmpFilesize
1.1MB
-
memory/4840-133-0x00000000050D0000-0x00000000050DA000-memory.dmpFilesize
40KB