4b00533f63e6c7b057952cc776248f0c9f8f64814dc3f8ec0c56380fa8479749

General

Target

vbc.exe
Size

973KB
MD5

365b20f54b6d5a79052e180bdd304549
SHA1

e773c0bc41b86525001e8b30ec7c3848f42e2710
SHA256

4b00533f63e6c7b057952cc776248f0c9f8f64814dc3f8ec0c56380fa8479749
SHA512

0c6131fa5edbb9214c498194e42126649a58d26bc29c8826a0d63414e7d7787b534d94797572a4c4d6847136aa44acbf59709132d7400cca24c3d1509c0bcb32
SSDEEP

12288:xkwGxdYxSbGdHABLqc+pHmWBeMk9STzQZ9FUjJrObUZKMiY8v+2BDL54UFrE:xbddgBmc+B/kiy273RArE

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
Suspicious use of SetThreadContext 1 IoCs

Processes:

vbc.exe

description pid process target process

PID 1212 set thread context of 240 1212 vbc.exe AddInProcess32.exe

description	pid	process	target process
PID 1212 set thread context of 240	1212	vbc.exe	AddInProcess32.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

vbc.exe

pid	process
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe
1212	vbc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 1212 vbc.exe
Token: SeDebugPrivilege 240 AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	1212	vbc.exe
Token: SeDebugPrivilege	240	AddInProcess32.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

vbc.exe

description	pid	process	target process
PID 1212 wrote to memory of 544	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 544	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 544	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 544	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 544	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 544	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 544	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 1628	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 1628	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 1628	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 1628	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 1628	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 1628	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 1628	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 240	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 240	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 240	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 240	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 240	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 240	1212	vbc.exe	AddInProcess32.exe
PID 1212 wrote to memory of 240	1212	vbc.exe	AddInProcess32.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1212

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:544

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
PID:1628

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:240

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

1

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

1

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/240-75-0x0000000000800000-0x0000000000B03000-memory.dmp

Filesize
3.0MB

Download
memory/240-74-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/240-73-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/544-65-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/544-67-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/544-66-0x0000000000080000-0x00000000000AF000-memory.dmp

Filesize
188KB

Download
memory/1212-58-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1212-61-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1212-62-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1212-63-0x0000000000480000-0x000000000049A000-memory.dmp

Filesize
104KB

Download
memory/1212-64-0x00000000004A0000-0x00000000004A6000-memory.dmp

Filesize
24KB

Download
memory/1212-60-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1212-59-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1212-54-0x0000000000FC0000-0x00000000010B8000-memory.dmp

Filesize
992KB

Download
memory/1212-57-0x0000000000520000-0x0000000000538000-memory.dmp

Filesize
96KB

Download
memory/1212-56-0x00000000009B0000-0x00000000009FA000-memory.dmp

Filesize
296KB

Download
memory/1212-55-0x0000000004E20000-0x0000000004E60000-memory.dmp

Filesize
256KB

Download
memory/1628-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing