Analysis
-
max time kernel
197s -
max time network
222s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
09-11-2022 14:48
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20220812-en
General
-
Target
vbc.exe
-
Size
448KB
-
MD5
0157a88e62b7651bf765bd4fbf73264c
-
SHA1
fba492f92871cbf674563578d3e91ccb4a412c71
-
SHA256
87a7b708cf5f194568ce728a77c5778078720d6ff6346ea269f0a5427398ad60
-
SHA512
821184beaa4e49af6e05583992ea98800a1494fcfe4c0d534dbb048dc2960208545432bb1c59c7f5cb69573bb2e7cb33d90904415c6563873ead802c4e4279c7
-
SSDEEP
12288:w1bVCfn7om/rE7KdHJaKZODGZ5N1Um4ObM1Mjc:w1ofn7X/9dJaSODGZ5f5hoajc
Malware Config
Extracted
formbook
dwdp
4DlAaMhdJtwJ15R2TZiMx6GwCg==
oilWdXwEy3OHItOqfLCNx6GwCg==
Ak8/PHhAG8EabtQ6
6M2Ej6pHE8pIcmJHMnpaZmZN50HzwA==
TbfoWsWBhyisR1OC/WI=
c9L5DAKvlT90Emj/mejR
Q52SsCG4oEvuFmMtB3U=
OpXGZzbo03aPI4RLsRqSjCi+4btteRj9
HXOuQvq3ok8Cm/9OCg==
NR7FUuGQbFKbPFOC/WI=
vCVkAKp/MCYvTA==
EIB9dcNoJczrDx1+2FMCpUWh
AelRyJUy6pU3TPPyep9VeiM=
pxM6rxHct23r9lOC/WI=
Jo+EpynW0bkd8EQ=
c93g9H4q6pCGbWGE6jGTmys=
KxeWJh3IeirmwBLvQ6xa5He4
Y18bQIZHI87qwl3/mejR
UDOSCrReNObV5g8I/0swTl5K50HzwA==
6Wum4j786IYvBgz/fu7G
WE4ZPZA9Damd/ts0fJ9VeiM=
/t2IjaZVOgAz25JBBTgmlCaWfOZZVDg=
Z98NDw7Qo1vfdVj3A2Q=
pZRR+bBDAaVJ4noF6zksdaO5U5m67UpCyg==
0ElEhBa+nFA+UEn+Dh4VEA==
gXf7eDj108gj7e6xi+pc513iqaU=
cFz/pD7muXS6lJVRHw==
aVnbem8uEbxIXP36xgHfBw==
HQlrGyPOok11FLtmNZqJx6GwCg==
MwzH3feUSej9l2dIKJSYrrS1U5m67UpCyg==
AHbMSjNP55iz
GAZORVxP55iz
Oq6vwAWaeB7UZ6hYHQ==
zEAtZ+ytoj3ZZ6hYHQ==
rAfyBEXLhyYxTl/OTrAfx6GwCg==
18d4nNJ9VvopA8h3SZ5a5He4
dKj37qc0F70abtQ6
dtXiZCe8g0DVa2GE6jGTmys=
1TwrUcyJMCYvTA==
Oh97GfzNmz3debrl/11Dpis=
ZUurN/7Fckzrsea8Imo=
g9X+HmcU2YGqxt//fu7G
qKJdXlnnr0xHoa6Nd9TZ
pX/hd2YsDqXNltuKf+PZ
8G+oOteOhii73yvEpPHT
Xk7IPuiKWvyv017/mejR
3MY2uHs8B6ItvKATmPlReimt/SlO
qY0Dx+PQbCpd+lv/mejR
QCuKCsNMCb5HEBD/fu7G
4j12D6t/MCYvTA==
AKG9wcOPD625
7U5TV7BjXwS/kX7vYa4PSTSEiK0=
nwnn/2sqCaiduNA1f59VeiM=
LpDOWAmifStd9lv/mejR
QqGXpOmWRfqKrD6id9Gr88S+Ew==
r4r7hEIC9apiOlOC/WI=
Ny/s8P+4fSqjMgJh90okGjJG50HzwA==
Yb/udvywew6tVKJ5wxvtGEJK50HzwA==
EQPGycyRejDarZfwTKIbx6GwCg==
spgJj2oQybkxTeG8HGo=
TrP2c/a2dxg/BGb/mejR
pYc8Unok/KakiKmSZXTOjDSEiK0=
f1/MZDffs2YQ4NQ0f59VeiM=
T0eBXUr+2JaMIVs=
onlinehealthclubs-d.site
Signatures
-
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
vbc.exeCasPol.exemsdt.exedescription pid process target process PID 3600 set thread context of 3564 3600 vbc.exe CasPol.exe PID 3564 set thread context of 2416 3564 CasPol.exe Explorer.EXE PID 3564 set thread context of 2416 3564 CasPol.exe Explorer.EXE PID 4216 set thread context of 2416 4216 msdt.exe Explorer.EXE -
Processes:
msdt.exedescription ioc process Key created \Registry\User\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 msdt.exe -
Suspicious behavior: EnumeratesProcesses 52 IoCs
Processes:
vbc.exeCasPol.exemsdt.exepid process 3600 vbc.exe 3600 vbc.exe 3600 vbc.exe 3600 vbc.exe 3600 vbc.exe 3600 vbc.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2416 Explorer.EXE -
Suspicious behavior: MapViewOfSection 8 IoCs
Processes:
CasPol.exemsdt.exepid process 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 3564 CasPol.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe 4216 msdt.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vbc.exeCasPol.exemsdt.exedescription pid process Token: SeDebugPrivilege 3600 vbc.exe Token: SeDebugPrivilege 3564 CasPol.exe Token: SeDebugPrivilege 4216 msdt.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
vbc.exeExplorer.EXEmsdt.exedescription pid process target process PID 3600 wrote to memory of 1556 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 1556 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 1556 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 5060 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 5060 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 5060 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 3564 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 3564 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 3564 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 3564 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 3564 3600 vbc.exe CasPol.exe PID 3600 wrote to memory of 3564 3600 vbc.exe CasPol.exe PID 2416 wrote to memory of 4216 2416 Explorer.EXE msdt.exe PID 2416 wrote to memory of 4216 2416 Explorer.EXE msdt.exe PID 2416 wrote to memory of 4216 2416 Explorer.EXE msdt.exe PID 4216 wrote to memory of 2672 4216 msdt.exe Firefox.exe PID 4216 wrote to memory of 2672 4216 msdt.exe Firefox.exe PID 4216 wrote to memory of 2672 4216 msdt.exe Firefox.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2416-143-0x00000000032B0000-0x00000000033AD000-memory.dmpFilesize
1012KB
-
memory/2416-159-0x0000000008D50000-0x0000000008EBE000-memory.dmpFilesize
1.4MB
-
memory/2416-158-0x0000000008D50000-0x0000000008EBE000-memory.dmpFilesize
1.4MB
-
memory/2416-155-0x0000000008A70000-0x0000000008C1B000-memory.dmpFilesize
1.7MB
-
memory/2416-148-0x0000000008A70000-0x0000000008C1B000-memory.dmpFilesize
1.7MB
-
memory/3564-147-0x0000000001480000-0x0000000001490000-memory.dmpFilesize
64KB
-
memory/3564-150-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3564-140-0x0000000001010000-0x000000000135A000-memory.dmpFilesize
3.3MB
-
memory/3564-142-0x0000000000FD0000-0x0000000000FE0000-memory.dmpFilesize
64KB
-
memory/3564-138-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3564-144-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3564-145-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3564-134-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3564-151-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/3564-139-0x0000000000401000-0x000000000042F000-memory.dmpFilesize
184KB
-
memory/3564-135-0x00000000004012B0-mapping.dmp
-
memory/3600-137-0x00007FFAA33F0000-0x00007FFAA3EB1000-memory.dmpFilesize
10.8MB
-
memory/3600-133-0x00007FFAA33F0000-0x00007FFAA3EB1000-memory.dmpFilesize
10.8MB
-
memory/3600-132-0x0000023142910000-0x0000023142984000-memory.dmpFilesize
464KB
-
memory/4216-149-0x0000000000000000-mapping.dmp
-
memory/4216-153-0x0000000001010000-0x000000000103D000-memory.dmpFilesize
180KB
-
memory/4216-156-0x0000000002EE0000-0x0000000002F6F000-memory.dmpFilesize
572KB
-
memory/4216-154-0x00000000030A0000-0x00000000033EA000-memory.dmpFilesize
3.3MB
-
memory/4216-157-0x0000000001010000-0x000000000103D000-memory.dmpFilesize
180KB
-
memory/4216-152-0x0000000000520000-0x0000000000577000-memory.dmpFilesize
348KB