Analysis

  • max time kernel
    175s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08-12-2022 11:44

General

  • Target

    vbc(1).exe

  • Size

    694KB

  • MD5

    5113abb28878ff293661fc23685a48bf

  • SHA1

    175aa3169fe7112cead1a550dd702c552bbe832c

  • SHA256

    0911f0bf9c55b8b1388b01524a3d37bbe843c3a3d5a5db4047812ec1a436ec10

  • SHA512

    c4e447cba8dafa4f9744e09a2bbd39b1c59025f1d2f5cf879f0fbae121779a56e42174580cfbd760c48e55a5c997cdec96d1189a4724ff4a6f06d3632dda780f

  • SSDEEP

    12288:RIn+H+LD9IlljoZ9bQGhQwDZF4J40l+BrNGqWOl1u/OfzgYWvwddkydK4akFXRyy:RILOHjoDQGhHQ40loJGts42fz4YTkydp

Malware Config

Extracted

Family

formbook

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb

jcfGYzPgZTqFZVO9FV2yIw==

laIfrdSC8/4CNg==

Q73ilev5GIWuOrAAFV2yIw==

Q2u/pMw7pv4sPA==

TbqvIUHwlQscPo0HFV2yIw==

8PNWfGPyE8n0IQ==

WtgROxXzvY2L

PryaRBNjm4eP

Y9Hdi06Cry1um9Sj68YAu1o=

3Gulyp7CMQtR78jvLkk=

JJ3GasTVTCRQT6Tfz6S6GlI=

RnS42bhb9tI0R6UpD6wOxriNxw==

he1mi2sOGfzTRGHnuA==

eaYjCtjxVjdU5XLRtBMBLKk9quA=

k9rTeEqYzzw8WaTfz6S6GlI=

5luVQwe2vJWKEAiMdF4=

MGW14L9OVk5Y5TaR6w/DqdhYxXVY

mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

y5klhuMbE8n0IQ==

Extracted

Family

xloader

Version

3.�E

Campaign

pgnt

Decoy

0WG18LbM4lR9iqMRa4nlBzTb

jcfGYzPgZTqFZVO9FV2yIw==

laIfrdSC8/4CNg==

Q73ilev5GIWuOrAAFV2yIw==

Q2u/pMw7pv4sPA==

TbqvIUHwlQscPo0HFV2yIw==

8PNWfGPyE8n0IQ==

WtgROxXzvY2L

PryaRBNjm4eP

Y9Hdi06Cry1um9Sj68YAu1o=

3Gulyp7CMQtR78jvLkk=

JJ3GasTVTCRQT6Tfz6S6GlI=

RnS42bhb9tI0R6UpD6wOxriNxw==

he1mi2sOGfzTRGHnuA==

eaYjCtjxVjdU5XLRtBMBLKk9quA=

k9rTeEqYzzw8WaTfz6S6GlI=

5luVQwe2vJWKEAiMdF4=

MGW14L9OVk5Y5TaR6w/DqdhYxXVY

mAsYz6k6sQkDC0/DoHj9t1RPWLSgFQ==

y5klhuMbE8n0IQ==

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 34 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    PID:1192
    • C:\Users\Admin\AppData\Local\Temp\vbc(1).exe
      "C:\Users\Admin\AppData\Local\Temp\vbc(1).exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1796
        • C:\Windows\SysWOW64\cmmon32.exe
          "C:\Windows\SysWOW64\cmmon32.exe"
          4⤵
          • Suspicious use of SetThreadContext
          • Modifies Internet Explorer settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:2824
          • C:\Program Files\Mozilla Firefox\Firefox.exe
            "C:\Program Files\Mozilla Firefox\Firefox.exe"
            5⤵
              PID:4184
      • C:\Windows\SysWOW64\cmmon32.exe
        "C:\Windows\SysWOW64\cmmon32.exe"
        2⤵
          PID:1884

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1192-158-0x0000000008A70000-0x0000000008BAE000-memory.dmp

        Filesize

        1.2MB

      • memory/1192-156-0x0000000008A70000-0x0000000008BAE000-memory.dmp

        Filesize

        1.2MB

      • memory/1192-148-0x00000000082C0000-0x000000000841C000-memory.dmp

        Filesize

        1.4MB

      • memory/1192-144-0x0000000007D80000-0x0000000007E89000-memory.dmp

        Filesize

        1.0MB

      • memory/1720-140-0x00007FFA124E0000-0x00007FFA12FA1000-memory.dmp

        Filesize

        10.8MB

      • memory/1720-136-0x00007FFA124E0000-0x00007FFA12FA1000-memory.dmp

        Filesize

        10.8MB

      • memory/1720-132-0x000002069D380000-0x000002069D434000-memory.dmp

        Filesize

        720KB

      • memory/1796-146-0x0000000000422000-0x0000000000424000-memory.dmp

        Filesize

        8KB

      • memory/1796-150-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1796-143-0x0000000000E50000-0x0000000000E60000-memory.dmp

        Filesize

        64KB

      • memory/1796-139-0x0000000001850000-0x0000000001B9A000-memory.dmp

        Filesize

        3.3MB

      • memory/1796-145-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1796-138-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1796-147-0x0000000001760000-0x0000000001770000-memory.dmp

        Filesize

        64KB

      • memory/1796-137-0x0000000000401000-0x000000000042F000-memory.dmp

        Filesize

        184KB

      • memory/1796-133-0x0000000000400000-0x000000000042F000-memory.dmp

        Filesize

        188KB

      • memory/1796-142-0x0000000000422000-0x0000000000424000-memory.dmp

        Filesize

        8KB

      • memory/1796-151-0x0000000000401000-0x000000000042F000-memory.dmp

        Filesize

        184KB

      • memory/1796-134-0x00000000004012B0-mapping.dmp

      • memory/2824-153-0x0000000000A40000-0x0000000000A6D000-memory.dmp

        Filesize

        180KB

      • memory/2824-154-0x00000000028E0000-0x0000000002C2A000-memory.dmp

        Filesize

        3.3MB

      • memory/2824-155-0x00000000027C0000-0x000000000284F000-memory.dmp

        Filesize

        572KB

      • memory/2824-152-0x00000000000D0000-0x00000000000DC000-memory.dmp

        Filesize

        48KB

      • memory/2824-157-0x0000000000A40000-0x0000000000A6D000-memory.dmp

        Filesize

        180KB

      • memory/2824-149-0x0000000000000000-mapping.dmp