Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-06-2022 11:10
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20220414-en
General
-
Target
vbc.exe
-
Size
273KB
-
MD5
c52ecabaed16aba5fac89d694e7508dc
-
SHA1
492c8828a332dbcc0f68d5ee5b17d9ae994b48c4
-
SHA256
276c6876c250e5ebfd761d05937f5a48f7e4c9a6851293a77ab9bf683c8bbf80
-
SHA512
e8ab6c6c0388f879ba9b2a5628ba1d21b2a21c4c4d99dde017596e8107e5a439b840bc4e751e1af6444fd56046d7a567363aa1edb19d8094329c4324147d777f
Malware Config
Extracted
xloader
2.6
vweq
malang-media.com
mrsfence.com
lubetops.com
aitimedia.net
montecryptocapital.com
ahwmedia.com
bvmnc.site
bggearstore.com
bcsantacoloma.online
alltimephotography.com
santacruz-roofings.com
leaplifestyleenterprises.com
censovet.com
similkameenfarms.com
undisclosed.email
thetrinityco.com
rapiturs.com
jedlersdorf.info
mh7jk12e.xyz
flygurlblogwordpress.com
goodbaddesign.com
equipmentrentalpartyplus.com
ohyoutube.com
projetoarvore.com
2379.flights
implemedescribed.com
kreasinesia.com
ownitoffice.com
fortekofteacizyemeknerde.store
my-wh-webproject.com
518499.com
naples-us.com
tlrohio.com
kanchava.com
lcloudfindin.com
cybermatrix.tech
i6lqi.xyz
ebay-online-selling-24.com
afrisectelecoms.com
tiantian997.xyz
strategyvenues.com
marketnear.watch
thebrooklynyogi.com
sonikbuilder.online
voyagesconsulting.com
ledgel0ungers.com
youhadtobethere.biz
disabled-long.com
dental-implants-encounter.life
zydssq.com
livingwell.green
doumao334.xyz
moodysoot.online
licos.xyz
maqitashop.com
doroos.online
laikemiao.com
petrolverse.xyz
apostolicpraise.net
todaychance.com
helightville.com
st-john-fisher-school.com
agwly.com
dashop.pro
zxc3426.xyz
Signatures
-
suricata: ET MALWARE FormBook CnC Checkin (GET)
suricata: ET MALWARE FormBook CnC Checkin (GET)
-
Xloader Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1936-59-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1936-60-0x000000000041F280-mapping.dmp xloader behavioral1/memory/1936-62-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1104-69-0x00000000000C0000-0x00000000000EB000-memory.dmp xloader -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.execvtres.execolorcpl.exedescription pid process target process PID 1052 set thread context of 1936 1052 vbc.exe cvtres.exe PID 1936 set thread context of 1236 1936 cvtres.exe Explorer.EXE PID 1104 set thread context of 1236 1104 colorcpl.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
cvtres.execolorcpl.exepid process 1936 cvtres.exe 1936 cvtres.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe 1104 colorcpl.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cvtres.execolorcpl.exepid process 1936 cvtres.exe 1936 cvtres.exe 1936 cvtres.exe 1104 colorcpl.exe 1104 colorcpl.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.execolorcpl.exedescription pid process Token: SeDebugPrivilege 1936 cvtres.exe Token: SeDebugPrivilege 1104 colorcpl.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
vbc.exeExplorer.EXEdescription pid process target process PID 1052 wrote to memory of 1936 1052 vbc.exe cvtres.exe PID 1052 wrote to memory of 1936 1052 vbc.exe cvtres.exe PID 1052 wrote to memory of 1936 1052 vbc.exe cvtres.exe PID 1052 wrote to memory of 1936 1052 vbc.exe cvtres.exe PID 1052 wrote to memory of 1936 1052 vbc.exe cvtres.exe PID 1052 wrote to memory of 1936 1052 vbc.exe cvtres.exe PID 1052 wrote to memory of 1936 1052 vbc.exe cvtres.exe PID 1236 wrote to memory of 1104 1236 Explorer.EXE colorcpl.exe PID 1236 wrote to memory of 1104 1236 Explorer.EXE colorcpl.exe PID 1236 wrote to memory of 1104 1236 Explorer.EXE colorcpl.exe PID 1236 wrote to memory of 1104 1236 Explorer.EXE colorcpl.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\colorcpl.exe"C:\Windows\SysWOW64\colorcpl.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1052-54-0x0000000000A90000-0x0000000000AD8000-memory.dmpFilesize
288KB
-
memory/1052-55-0x00000000003C0000-0x00000000003F4000-memory.dmpFilesize
208KB
-
memory/1104-71-0x0000000000440000-0x00000000004D0000-memory.dmpFilesize
576KB
-
memory/1104-70-0x00000000022C0000-0x00000000025C3000-memory.dmpFilesize
3.0MB
-
memory/1104-69-0x00000000000C0000-0x00000000000EB000-memory.dmpFilesize
172KB
-
memory/1104-68-0x0000000000EA0000-0x0000000000EB8000-memory.dmpFilesize
96KB
-
memory/1104-67-0x00000000763E1000-0x00000000763E3000-memory.dmpFilesize
8KB
-
memory/1104-66-0x0000000000000000-mapping.dmp
-
memory/1236-65-0x0000000004130000-0x000000000421C000-memory.dmpFilesize
944KB
-
memory/1236-72-0x0000000004E00000-0x0000000004EB3000-memory.dmpFilesize
716KB
-
memory/1236-73-0x0000000004E00000-0x0000000004EB3000-memory.dmpFilesize
716KB
-
memory/1936-64-0x0000000000220000-0x0000000000231000-memory.dmpFilesize
68KB
-
memory/1936-63-0x0000000000880000-0x0000000000B83000-memory.dmpFilesize
3.0MB
-
memory/1936-62-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1936-60-0x000000000041F280-mapping.dmp
-
memory/1936-59-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1936-56-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/1936-57-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB