Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    21/06/2022, 08:56

General

  • Target

    vbc (2).exe

  • Size

    99KB

  • MD5

    fc2ab61fce7f203add8bd65a77df7de5

  • SHA1

    423261d0362864ecc99f05a726a940b33b69f5df

  • SHA256

    9454ba36d9a763b8543f599961cafb7a33397340ccb59b17921748771d49cd43

  • SHA512

    5c91637dd9083b7a1c98ccf0ad852582710ffe2d733e285e733439a1a0cae3535a1b2473f7d8e6a83ebc0545a106d806c896ae84d62bbe76077dfaeac8686e79

Malware Config

Extracted

Family

xloader

Version

2.6

Campaign

uu0p

Decoy

easeupp.com

ffffcc.xyz

commercialsymposium.com

bahamascargologistics.com

avajwelr.xyz

flipwatch.xyz

serprobumar.com

zlasher.store

zxlsn6.com

xiaojiaowanwan.com

hrkpacking.com

visitprnow.com

stkjzz.com

printfusion.net

blackoakssavannah.com

yuiseika.com

watnefarms.com

oneclickmsp.com

niu-tou.com

wholytraffic.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • suricata: ET MALWARE FormBook CnC Checkin (GET)

    suricata: ET MALWARE FormBook CnC Checkin (GET)

  • suricata: ET MALWARE FormBook CnC Checkin (POST) M2

    suricata: ET MALWARE FormBook CnC Checkin (POST) M2

  • Xloader Payload 4 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Program Files directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 50 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of WriteProcessMemory 30 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Drops file in Program Files directory
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2156
    • C:\Users\Admin\AppData\Local\Temp\vbc (2).exe
      "C:\Users\Admin\AppData\Local\Temp\vbc (2).exe"
      2⤵
      • Checks computer location settings
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4308
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c timeout 20
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1960
        • C:\Windows\SysWOW64\timeout.exe
          timeout 20
          4⤵
          • Delays execution with timeout.exe
          PID:4144
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:236
    • C:\Windows\SysWOW64\autoconv.exe
      "C:\Windows\SysWOW64\autoconv.exe"
      2⤵
        PID:5016
      • C:\Windows\SysWOW64\autoconv.exe
        "C:\Windows\SysWOW64\autoconv.exe"
        2⤵
          PID:5020
        • C:\Windows\SysWOW64\mstsc.exe
          "C:\Windows\SysWOW64\mstsc.exe"
          2⤵
          • Adds Run key to start application
          • Suspicious use of SetThreadContext
          • Drops file in Program Files directory
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3300
          • C:\Windows\SysWOW64\cmd.exe
            /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"
            3⤵
              PID:3768
            • C:\Windows\SysWOW64\cmd.exe
              /c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
              3⤵
                PID:4884
              • C:\Windows\SysWOW64\cmd.exe
                /c copy "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V
                3⤵
                  PID:840
                • C:\Program Files\Mozilla Firefox\Firefox.exe
                  "C:\Program Files\Mozilla Firefox\Firefox.exe"
                  3⤵
                    PID:972
                • C:\Program Files (x86)\Nut6hzlw\userlbopd.exe
                  "C:\Program Files (x86)\Nut6hzlw\userlbopd.exe"
                  2⤵
                  • Executes dropped EXE
                  PID:5012

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Program Files (x86)\Nut6hzlw\userlbopd.exe

                      Filesize

                      41KB

                      MD5

                      5d4073b2eb6d217c19f2b22f21bf8d57

                      SHA1

                      f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

                      SHA256

                      ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

                      SHA512

                      9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

                    • C:\Program Files (x86)\Nut6hzlw\userlbopd.exe

                      Filesize

                      41KB

                      MD5

                      5d4073b2eb6d217c19f2b22f21bf8d57

                      SHA1

                      f0209900fbf08d004b886a0b3ba33ea2b0bf9da8

                      SHA256

                      ac1a3f21fcc88f9cee7bf51581eafba24cc76c924f0821deb2afdf1080ddf3d3

                      SHA512

                      9ac94880684933ba3407cdc135abc3047543436567af14cd9269c4adc5a6535db7b867d6de0d6238a21b94e69f9890dbb5739155871a624520623a7e56872159

                    • C:\Users\Admin\AppData\Local\Temp\DB1

                      Filesize

                      40KB

                      MD5

                      b608d407fc15adea97c26936bc6f03f6

                      SHA1

                      953e7420801c76393902c0d6bb56148947e41571

                      SHA256

                      b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

                      SHA512

                      cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

                    • C:\Users\Admin\AppData\Local\Temp\DB1

                      Filesize

                      48KB

                      MD5

                      349e6eb110e34a08924d92f6b334801d

                      SHA1

                      bdfb289daff51890cc71697b6322aa4b35ec9169

                      SHA256

                      c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

                      SHA512

                      2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

                    • memory/236-147-0x0000000000400000-0x000000000042B000-memory.dmp

                      Filesize

                      172KB

                    • memory/236-141-0x0000000000400000-0x000000000042B000-memory.dmp

                      Filesize

                      172KB

                    • memory/236-143-0x00000000019A0000-0x0000000001CEA000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/236-144-0x0000000001960000-0x0000000001971000-memory.dmp

                      Filesize

                      68KB

                    • memory/2156-155-0x0000000007DC0000-0x0000000007EBA000-memory.dmp

                      Filesize

                      1000KB

                    • memory/2156-153-0x0000000007DC0000-0x0000000007EBA000-memory.dmp

                      Filesize

                      1000KB

                    • memory/2156-145-0x0000000002F60000-0x000000000303A000-memory.dmp

                      Filesize

                      872KB

                    • memory/3300-154-0x0000000000560000-0x000000000058B000-memory.dmp

                      Filesize

                      172KB

                    • memory/3300-149-0x0000000000560000-0x000000000058B000-memory.dmp

                      Filesize

                      172KB

                    • memory/3300-150-0x00000000028F0000-0x0000000002C3A000-memory.dmp

                      Filesize

                      3.3MB

                    • memory/3300-152-0x0000000002680000-0x0000000002710000-memory.dmp

                      Filesize

                      576KB

                    • memory/3300-148-0x0000000000950000-0x0000000000A8A000-memory.dmp

                      Filesize

                      1.2MB

                    • memory/4308-139-0x0000000007090000-0x0000000007122000-memory.dmp

                      Filesize

                      584KB

                    • memory/4308-133-0x0000000000DC0000-0x0000000000DE0000-memory.dmp

                      Filesize

                      128KB

                    • memory/4308-136-0x0000000006CA0000-0x0000000006CBE000-memory.dmp

                      Filesize

                      120KB

                    • memory/4308-135-0x00000000057C0000-0x0000000005836000-memory.dmp

                      Filesize

                      472KB

                    • memory/4308-134-0x0000000005D70000-0x0000000006314000-memory.dmp

                      Filesize

                      5.6MB

                    • memory/5012-163-0x0000000000630000-0x000000000063C000-memory.dmp

                      Filesize

                      48KB

                    • memory/5012-164-0x0000000004DC0000-0x0000000004DDA000-memory.dmp

                      Filesize

                      104KB