Analysis
-
max time kernel
174s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
27-07-2022 05:34
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
13 signatures
600 seconds
General
-
Target
vbc.exe
-
Size
73KB
-
MD5
01d52c9116e69104be59982ec44b4f9a
-
SHA1
d6f901d3488a21e6856563c46d560518cb218549
-
SHA256
de3fc0f64c0ea18339e50d84f79e5e7f144f0e4b4ec725bb3cc48208a1491577
-
SHA512
a6731650991c837dfde3666bfeb2214b02c21aa810bca59244f84b5cd7a383b17695d4d6831f45eea6520f1d2b1faa16a74107487580533a2a1927c0569fa2cb
Score
10/10
Malware Config
Signatures
-
BluStealer
A Modular information stealer written in Visual Basic.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2372564722-193526734-2636556182-1000\Control Panel\International\Geo\Nation vbc.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4380 set thread context of 116 4380 vbc.exe 84 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4380 vbc.exe 2736 powershell.exe 2736 powershell.exe 4380 vbc.exe 4380 vbc.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1432 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4380 vbc.exe Token: SeDebugPrivilege 2736 powershell.exe Token: SeDebugPrivilege 1432 taskmgr.exe Token: SeSystemProfilePrivilege 1432 taskmgr.exe Token: SeCreateGlobalPrivilege 1432 taskmgr.exe -
Suspicious use of FindShellTrayWindow 48 IoCs
pid Process 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe -
Suspicious use of SendNotifyMessage 48 IoCs
pid Process 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe 1432 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 116 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 4380 wrote to memory of 2736 4380 vbc.exe 82 PID 4380 wrote to memory of 2736 4380 vbc.exe 82 PID 4380 wrote to memory of 2736 4380 vbc.exe 82 PID 4380 wrote to memory of 116 4380 vbc.exe 84 PID 4380 wrote to memory of 116 4380 vbc.exe 84 PID 4380 wrote to memory of 116 4380 vbc.exe 84 PID 4380 wrote to memory of 116 4380 vbc.exe 84 PID 4380 wrote to memory of 116 4380 vbc.exe 84 PID 4380 wrote to memory of 116 4380 vbc.exe 84 PID 4380 wrote to memory of 116 4380 vbc.exe 84 PID 4380 wrote to memory of 116 4380 vbc.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4380 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2736
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious use of SetWindowsHookEx
PID:116
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1432