Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
21/04/2023, 11:02
General
- Target vbc.exe
- Size 479KB
- Sample230421-m47tvsfb77
- SHA256 38d07c5d734acebaac3e4882726bb9cee05a51ce0f85a79b303cb1e133254be1
Malware Config
Signatures
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Program crash 1 IoCs
- Modifies Internet Explorer settings 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\vbc.exe"C:\Users\Admin\AppData\Local\Temp\vbc.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\cscript.exe"C:\Windows\SysWOW64\cscript.exe"2⤵
- Suspicious use of SetThreadContext
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Mozilla Firefox\Firefox.exe"C:\Program Files\Mozilla Firefox\Firefox.exe"3⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4624 -s 1404⤵
- Program crash
-
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 4624 -ip 46241⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1264-142-0x0000000001650000-0x0000000001660000-memory.dmp
memory/1264-145-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1264-141-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1264-140-0x00000000016B0000-0x00000000019FA000-memory.dmp
memory/1264-137-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1264-139-0x0000000000400000-0x000000000042F000-memory.dmp
memory/1532-147-0x0000000000DB0000-0x0000000000DDD000-memory.dmp
memory/1532-146-0x00000000009C0000-0x00000000009E7000-memory.dmp
memory/1532-149-0x0000000002C80000-0x0000000002D0F000-memory.dmp
memory/1532-144-0x00000000009C0000-0x00000000009E7000-memory.dmp
memory/1532-148-0x0000000002F50000-0x000000000329A000-memory.dmp
memory/2100-133-0x000001FC73D90000-0x000001FC73E0C000-memory.dmp
memory/2100-136-0x000001FC77190000-0x000001FC771AE000-memory.dmp
memory/2100-134-0x000001FC741F0000-0x000001FC74200000-memory.dmp
memory/2100-135-0x000001FC77010000-0x000001FC77086000-memory.dmp
memory/3144-150-0x0000000002D00000-0x0000000002D9A000-memory.dmp
memory/3144-143-0x0000000002BB0000-0x0000000002C76000-memory.dmp
memory/3144-151-0x0000000002D00000-0x0000000002D9A000-memory.dmp
memory/3144-153-0x0000000002D00000-0x0000000002D9A000-memory.dmp