4b00533f63e6c7b057952cc776248f0c9f8f64814dc3f8ec0c56380fa8479749

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230220-en
resource tags

arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
submitted
31-03-2023 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

vbc.exe
Size

973KB
MD5

365b20f54b6d5a79052e180bdd304549
SHA1

e773c0bc41b86525001e8b30ec7c3848f42e2710
SHA256

4b00533f63e6c7b057952cc776248f0c9f8f64814dc3f8ec0c56380fa8479749
SHA512

0c6131fa5edbb9214c498194e42126649a58d26bc29c8826a0d63414e7d7787b534d94797572a4c4d6847136aa44acbf59709132d7400cca24c3d1509c0bcb32
SSDEEP

12288:xkwGxdYxSbGdHABLqc+pHmWBeMk9STzQZ9FUjJrObUZKMiY8v+2BDL54UFrE:xbddgBmc+B/kiy273RArE

Score

7^/10

Malware Config

Signatures

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

Suspicious use of SetThreadContext 2 IoCs

Processes:

vbc.exeAddInProcess32.exe

description	pid	process	target process
PID 4504 set thread context of 3324	4504	vbc.exe	AddInProcess32.exe
PID 3324 set thread context of 4504	3324	AddInProcess32.exe	vbc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

vbc.exe

pid	process
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe
4504	vbc.exe

Suspicious behavior: MapViewOfSection 1 IoCs

Processes:

AddInProcess32.exe

pid process

3324 AddInProcess32.exe
Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

vbc.exeAddInProcess32.exe

description pid process

Token: SeDebugPrivilege 4504 vbc.exe
Token: SeDebugPrivilege 3324 AddInProcess32.exe

pid	process
3324	AddInProcess32.exe

description	pid	process
Token: SeDebugPrivilege	4504	vbc.exe
Token: SeDebugPrivilege	3324	AddInProcess32.exe

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

vbc.exe

description	pid	process	target process
PID 4504 wrote to memory of 3324	4504	vbc.exe	AddInProcess32.exe
PID 4504 wrote to memory of 3324	4504	vbc.exe	AddInProcess32.exe
PID 4504 wrote to memory of 3324	4504	vbc.exe	AddInProcess32.exe
PID 4504 wrote to memory of 3324	4504	vbc.exe	AddInProcess32.exe
PID 4504 wrote to memory of 3324	4504	vbc.exe	AddInProcess32.exe
PID 4504 wrote to memory of 3324	4504	vbc.exe	AddInProcess32.exe
PID 4504 wrote to memory of 768	4504	vbc.exe	WWAHost.exe
PID 4504 wrote to memory of 768	4504	vbc.exe	WWAHost.exe
PID 4504 wrote to memory of 768	4504	vbc.exe	WWAHost.exe

C:\Users\Admin\AppData\Local\Temp\vbc.exe
"C:\Users\Admin\AppData\Local\Temp\vbc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4504

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:3324

C:\Windows\SysWOW64\WWAHost.exe
"C:\Windows\SysWOW64\WWAHost.exe"
2⤵
PID:768

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Persistence

Privilege Escalation

Defense Evasion

Scripting

T1064

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3324-146-0x0000000000400000-0x000000000042F000-memory.dmp

Filesize
188KB

Download
memory/3324-148-0x0000000001380000-0x00000000016CA000-memory.dmp

Filesize
3.3MB

Download
memory/4504-141-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4504-142-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4504-137-0x0000000002660000-0x000000000266A000-memory.dmp

Filesize
40KB

Download
memory/4504-138-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4504-139-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4504-140-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4504-133-0x0000000000FF0000-0x00000000010E8000-memory.dmp

Filesize
992KB

Download
memory/4504-136-0x0000000004C00000-0x0000000004C9C000-memory.dmp

Filesize
624KB

Download
memory/4504-143-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4504-144-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4504-145-0x0000000004E30000-0x0000000004E40000-memory.dmp

Filesize
64KB

Download
memory/4504-135-0x0000000004AD0000-0x0000000004B62000-memory.dmp

Filesize
584KB

Download
memory/4504-134-0x00000000051B0000-0x0000000005754000-memory.dmp

Filesize
5.6MB

Download
memory/4504-149-0x0000000000850000-0x000000000091D000-memory.dmp

Filesize
820KB

Download