Analysis
-
max time kernel
150s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
22-03-2023 10:12
Static task
static1
Behavioral task
behavioral1
Sample
vbc.exe
Resource
win7-20230220-en
General
-
Target
vbc.exe
-
Size
929KB
-
MD5
a2b6815c9698017685973d659c6fa3ba
-
SHA1
711825fd9865c9b1ca177df8301058a96bf7968d
-
SHA256
bcb2ba08e3ef1e2650c2276989c6d12e2277015deee0e4731f7099be07e63788
-
SHA512
3f943ead12ce94547e336ae9ac16b74f37a2f37c1b44180a606c0155faae0b664ec8bfca1a622309ffa3bf202a7bfd81abfd3b06babc6d02efa10f449837d79c
-
SSDEEP
12288:6cNpFJUGzl06/TgTU48e9NyCGTyIkNOmun7ZI/GYLS+bmtHq75JM/GQsqYn:Pzl06MFxyCGTRkNOpFI/fmEaqVJM/By
Malware Config
Extracted
formbook
4.1
bk08
chloie.net
fastingersecure.monster
foundersterrace.online
ytorly.xyz
kiralayolla.com
corporacionalpi.com
planfortheworld.com
disciplinecoaching.co.uk
rubi33.com
digitlabmedia.com
ky20033.com
h4q7.com
91ye260.xyz
coconceptevents.com
ukusizas.africa
utainnovative.africa
ted-clean.co.uk
haus-huelsche.com
ca-refund.website
football.salon
cloudprovident.com
donesgaiwork.com
lilycandles.com
fiedjapan.com
bioticawater.co.uk
adaptiveinvestmentsllc.com
coreypowers.com
kci.biz
everlegacycoldstorage.online
blackmatchgaming.com
alnour-avocats.com
hotelvillaverdehn.com
furniture-47390.com
bnekesoi.link
hitidigital.net
c66u.xyz
inc64.com
autoe.live
ttl7645.com
ergoconstructionservices.ltd
mythologynme.com
6n899.com
haveskeimany.com
ghhhrhbdfghapi02.xyz
cookiesseedzbank.com
diyet.app
denizatiplushotel.com
indiahalalexpo.com
evklvq.com
distrolution.app
accel.top
laniemade.com
n13ax.com
19luxu.com
funfact-infoworld.com
acnereset.com
jamestownohiochamber.com
leadgeneration.works
1wijjx.top
appsinclouds.site
biz4search.online
houseofperson.com
karencaseyphoto.net
76845.site
7701666.vip
Signatures
-
Formbook payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1412-64-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/1412-68-0x0000000000400000-0x000000000042F000-memory.dmp formbook behavioral1/memory/672-73-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook behavioral1/memory/672-75-0x00000000000D0000-0x00000000000FF000-memory.dmp formbook -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 800 cmd.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
vbc.exevbc.exemstsc.exedescription pid process target process PID 1704 set thread context of 1412 1704 vbc.exe vbc.exe PID 1412 set thread context of 1344 1412 vbc.exe Explorer.EXE PID 672 set thread context of 1344 672 mstsc.exe Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
vbc.exemstsc.exepid process 1412 vbc.exe 1412 vbc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe 672 mstsc.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1344 Explorer.EXE -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
vbc.exemstsc.exepid process 1412 vbc.exe 1412 vbc.exe 1412 vbc.exe 672 mstsc.exe 672 mstsc.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vbc.exemstsc.exedescription pid process Token: SeDebugPrivilege 1412 vbc.exe Token: SeDebugPrivilege 672 mstsc.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1344 Explorer.EXE 1344 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1344 Explorer.EXE 1344 Explorer.EXE -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
vbc.exeExplorer.EXEmstsc.exedescription pid process target process PID 1704 wrote to memory of 1412 1704 vbc.exe vbc.exe PID 1704 wrote to memory of 1412 1704 vbc.exe vbc.exe PID 1704 wrote to memory of 1412 1704 vbc.exe vbc.exe PID 1704 wrote to memory of 1412 1704 vbc.exe vbc.exe PID 1704 wrote to memory of 1412 1704 vbc.exe vbc.exe PID 1704 wrote to memory of 1412 1704 vbc.exe vbc.exe PID 1704 wrote to memory of 1412 1704 vbc.exe vbc.exe PID 1344 wrote to memory of 672 1344 Explorer.EXE mstsc.exe PID 1344 wrote to memory of 672 1344 Explorer.EXE mstsc.exe PID 1344 wrote to memory of 672 1344 Explorer.EXE mstsc.exe PID 1344 wrote to memory of 672 1344 Explorer.EXE mstsc.exe PID 672 wrote to memory of 800 672 mstsc.exe cmd.exe PID 672 wrote to memory of 800 672 mstsc.exe cmd.exe PID 672 wrote to memory of 800 672 mstsc.exe cmd.exe PID 672 wrote to memory of 800 672 mstsc.exe cmd.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\mstsc.exe"C:\Windows\SysWOW64\mstsc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"3⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/672-78-0x0000000000AD0000-0x0000000000B64000-memory.dmpFilesize
592KB
-
memory/672-75-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/672-74-0x0000000002200000-0x0000000002503000-memory.dmpFilesize
3.0MB
-
memory/672-73-0x00000000000D0000-0x00000000000FF000-memory.dmpFilesize
188KB
-
memory/672-72-0x0000000000CF0000-0x0000000000DF4000-memory.dmpFilesize
1.0MB
-
memory/672-71-0x0000000000CF0000-0x0000000000DF4000-memory.dmpFilesize
1.0MB
-
memory/1344-70-0x0000000003B20000-0x0000000003BD7000-memory.dmpFilesize
732KB
-
memory/1344-83-0x0000000005FF0000-0x00000000060C6000-memory.dmpFilesize
856KB
-
memory/1344-81-0x0000000003B20000-0x0000000003BD7000-memory.dmpFilesize
732KB
-
memory/1344-80-0x0000000005FF0000-0x00000000060C6000-memory.dmpFilesize
856KB
-
memory/1344-79-0x0000000005FF0000-0x00000000060C6000-memory.dmpFilesize
856KB
-
memory/1344-77-0x0000000000310000-0x0000000000410000-memory.dmpFilesize
1024KB
-
memory/1412-69-0x00000000002B0000-0x00000000002C5000-memory.dmpFilesize
84KB
-
memory/1412-61-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1412-68-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1412-67-0x0000000000870000-0x0000000000B73000-memory.dmpFilesize
3.0MB
-
memory/1412-64-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1412-63-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1412-62-0x0000000000400000-0x000000000042F000-memory.dmpFilesize
188KB
-
memory/1704-54-0x00000000012E0000-0x00000000013CE000-memory.dmpFilesize
952KB
-
memory/1704-60-0x0000000000740000-0x0000000000778000-memory.dmpFilesize
224KB
-
memory/1704-59-0x0000000005E20000-0x0000000005ECE000-memory.dmpFilesize
696KB
-
memory/1704-58-0x0000000000500000-0x000000000050C000-memory.dmpFilesize
48KB
-
memory/1704-57-0x0000000004E50000-0x0000000004E90000-memory.dmpFilesize
256KB
-
memory/1704-56-0x0000000000380000-0x0000000000392000-memory.dmpFilesize
72KB
-
memory/1704-55-0x0000000004E50000-0x0000000004E90000-memory.dmpFilesize
256KB