General
-
Target
vbc.exe
-
Size
374KB
-
Sample
221118-hkx34acf9y
-
MD5
7106216b183ca11deba630ff975a53b4
-
SHA1
6c2c163ffd926ea1f7bd6a8e8169957ee8c47dc3
-
SHA256
d3b626acf50c671d6bb5baff02df9f99d09b761c9deff6932d0600cbabb27d49
-
SHA512
6204f56205f38f30f1444f4981a0afb7cc74164aaf8744df2d4324b3c32dbcebb6070299a03927139c74bc078f3970cbd75e3fed27659983dcf51762450bc75a
-
SSDEEP
6144:MEa0Nv9Es7Gavr2RBjyN0fsi6/bFCEy74GhPun6I2aVjLbIozLgl6mJBkghG7PRS:XNGazUyN0ki6/bF21hm68jLbhg6mJBpn
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20221111-en
Malware Config
Extracted
formbook
henz
IxWMb+jVsoinShuZJzk=
TPfKgQZ//oGnKr/J
EsK0WxD5kY65XOW1Td/5CxSUpCUytR7M
KebSmiCP9p8yUw==
HAt/ljkEuqMLHOLCi53Pv8MKX9qk
CY4ogZTwJc4vSw==
WWDIx5UYUDyepntE0YIAPca3/rI=
+Pkr01Lfb2rME7bL
S5nyK0p8jS2xdwQ=
W/oqvlO57LfkLcLHnQ==
zrrwtqkTLwxulm4l8FGopw==
AqucYext8bzFbOKthIm8E6gfVkUHxKY=
OfnjeDs78+RTcz4OHRl+
XKf1wwpZR5hLLjHgmUGOpQ==
JMyhSLoJPTCwn5o9zX2d8i1+
Wk54MBsDhWSVbnIRkQ==
7aaYR/tOhh9piTw5/KHSRwuK2iqgafw7pQ==
hH/EYxN+jC2xdwQ=
S0F4ORqDjS2xdwQ=
0o/UwXnuJ+sJp0cOHRl+
klE+E/jVelhT72wOHRl+
ZGvqyzaT9qfME7bL
czgajHaygm4=
KufYeyTiLhIGlzU6/38IM7IrqzhFa64=
oVNF+2VXWBL9jwGsK3Bw5TE=
iI3g6JaEalRvMDaz8AD4+vt0
nWtRAaSccRlLVg==
NtvDoS2UMcMRSA==
1t5MW/lEfjsUrFJeGXBw5TE=
UFixmi+P2cgqPRj09Sc=
MSuTonT5QhU11IGFYWKB6eJj
k4Lw3r+hTj9NF8+zgnu+Nsa3/rI=
NSN7fCqHln/S+RuZJzk=
dTUV1GY97NlVLsaSJXBw5TE=
8u5OLgNPRShyRRuZJzk=
BLTZ0G3iV0B5PvedL3Bw5TE=
ci8Y27nGCM69
JxF8W9/QoC2xdwQ=
KusZC8MsPClL1oMo8SA=
tW9XIP/VYTmVpWIDjIu1p5/ebhC9
pmc//mhFFgx3l1IOHRl+
MOsl9G5hQT6lhc0oLHWtrQ==
fXvSx46RRSiGjWphOnO0p8a3/rI=
D8Hx4JoDG+znbnIRkQ==
Dsfu2pqFJP0Kv0gX1CGX3Sw=
FcGnEr4fhW7ME7bL
hkc37Y3GF8gTMAw=
dnGZWjqPqYqgTxuZJzk=
iDEV43sIvE1j7psMiQ==
vb8qEoNQBus+mQXst1h2
46qCRt3j3cfneiudJjE=
8eoYvzW2PgDrffLWrav++Mf1TUUHxKY=
vqkFDa0HYztZ+G8ODZ7Qug==
+K/F0qEnTxACrzMR2OocXxecmq31afw7pQ==
Egwn/u1rq2uVbnIRkQ==
nFVH/3fvalaRbnIRkQ==
CvtveEUyyqUJLOiOKnBw5TE=
dmfN5LErTj9l/Icl8FGopw==
VAQtEMawYiNPaTxLIxdbpD9sZL0=
MBSMhSCOHdpCVQ==
jz95eCeaJc4vSw==
85N/Gcy+XicYq0cOHRl+
D/1B46soVTKObnIRkQ==
Hgytgwn25KqyVRuZJzk=
brennancorps.info
Targets
-
-
Target
vbc.exe
-
Size
374KB
-
MD5
7106216b183ca11deba630ff975a53b4
-
SHA1
6c2c163ffd926ea1f7bd6a8e8169957ee8c47dc3
-
SHA256
d3b626acf50c671d6bb5baff02df9f99d09b761c9deff6932d0600cbabb27d49
-
SHA512
6204f56205f38f30f1444f4981a0afb7cc74164aaf8744df2d4324b3c32dbcebb6070299a03927139c74bc078f3970cbd75e3fed27659983dcf51762450bc75a
-
SSDEEP
6144:MEa0Nv9Es7Gavr2RBjyN0fsi6/bFCEy74GhPun6I2aVjLbIozLgl6mJBkghG7PRS:XNGazUyN0ki6/bF21hm68jLbhg6mJBpn
-
Executes dropped EXE
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Uses the VBS compiler for execution
-
Suspicious use of SetThreadContext
-