Analysis
-
max time kernel
118s -
max time network
120s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
10-09-2024 23:16
Static task
static1
General
-
Target
VBCNBEW.exe
-
Size
237KB
-
MD5
5bac332642f907ed254f85c6b60fa79d
-
SHA1
75a9bef69eb70ae57d7d8735ece203a97f37950e
-
SHA256
ae74b8c9e1f56b45a7cd04935a720d3bb42a5e58d257a648474c89def6b54a01
-
SHA512
8017043cfceba71ad9e42f5bd684e922a16134e023ae84de60fd4a0c94f07e27202e1f0de6a871f907fbb0566d5f38542a0babda6e2e488e3bd38d5bb9e2c6e6
-
SSDEEP
6144:DOmkNEhXdfslyuJPEXyiaKTrz+MJSz19M90U8x:iaXsAu1EXyvUPJS9MGx
Malware Config
Extracted
xloader
2.6
tqug
sns138.com
hiddenevents.us
plantandseedswap.com
ayomvp.com
buildoaxaca.com
pkxshopingit.website
youdoyoutoys.com
n-musicoffice.com
sushi-yoneki.com
towardstech.com
jerrilynnfike.com
fxivcama.com
202206.com
energrove.com
nohonet.com
deta.group
kristenajohnson.com
russodevleopment.com
liine.me
hiegi.icu
koliya1.com
caspian.energy
pizzeriadonluca.com
jt88888888.com
londonm52.com
prioritycargologistics.net
pillaiuniversity.com
pworldlogistics.com
270riversidedrive10d.com
wizi.tech
theregarded.com
uben.group
piqevou.xyz
scbkb.com
falasp.com
miaouifique.com
vandmhvac.net
slimdownne.com
bsd178.com
jeanhonoremus.com
chilledstartup.com
xyslqckx.com
run-anzx.com
czcionki.xyz
kristennicoledesigns.com
kaidcota.art
zqykj.top
y4learning.com
ctepb9x.com
ilrosso.com
vetlife.pet
mujieber.com
huongvibien.com
direitaparana.com
earthdancefarm.com
everyway.online
optionhumidity.top
quadcountycs.com
akcessoires.com
iwantsoho.com
shopmarket-24.online
cnytwl.com
thybestestates.com
texuka.com
ihq48.beauty
Signatures
-
Xloader payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1980-6-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/1980-11-0x0000000000400000-0x000000000042B000-memory.dmp xloader behavioral1/memory/2684-16-0x0000000000370000-0x000000000039B000-memory.dmp xloader -
Suspicious use of SetThreadContext 3 IoCs
Processes:
VBCNBEW.execvtres.exemsdt.exedescription pid Process procid_target PID 4232 set thread context of 1980 4232 VBCNBEW.exe 85 PID 1980 set thread context of 3548 1980 cvtres.exe 56 PID 2684 set thread context of 3548 2684 msdt.exe 56 -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
msdt.execmd.exeVBCNBEW.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language msdt.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language VBCNBEW.exe -
Suspicious behavior: EnumeratesProcesses 50 IoCs
Processes:
cvtres.exemsdt.exepid Process 1980 cvtres.exe 1980 cvtres.exe 1980 cvtres.exe 1980 cvtres.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe 2684 msdt.exe -
Suspicious behavior: MapViewOfSection 5 IoCs
Processes:
cvtres.exemsdt.exepid Process 1980 cvtres.exe 1980 cvtres.exe 1980 cvtres.exe 2684 msdt.exe 2684 msdt.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
cvtres.exemsdt.exedescription pid Process Token: SeDebugPrivilege 1980 cvtres.exe Token: SeDebugPrivilege 2684 msdt.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid Process 3548 Explorer.EXE -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
VBCNBEW.exeExplorer.EXEmsdt.exedescription pid Process procid_target PID 4232 wrote to memory of 1980 4232 VBCNBEW.exe 85 PID 4232 wrote to memory of 1980 4232 VBCNBEW.exe 85 PID 4232 wrote to memory of 1980 4232 VBCNBEW.exe 85 PID 4232 wrote to memory of 1980 4232 VBCNBEW.exe 85 PID 4232 wrote to memory of 1980 4232 VBCNBEW.exe 85 PID 4232 wrote to memory of 1980 4232 VBCNBEW.exe 85 PID 3548 wrote to memory of 2684 3548 Explorer.EXE 87 PID 3548 wrote to memory of 2684 3548 Explorer.EXE 87 PID 3548 wrote to memory of 2684 3548 Explorer.EXE 87 PID 2684 wrote to memory of 2288 2684 msdt.exe 90 PID 2684 wrote to memory of 2288 2684 msdt.exe 90 PID 2684 wrote to memory of 2288 2684 msdt.exe 90
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Local\Temp\VBCNBEW.exe"C:\Users\Admin\AppData\Local\Temp\VBCNBEW.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1980
-
-
-
C:\Windows\SysWOW64\msdt.exe"C:\Windows\SysWOW64\msdt.exe"2⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"3⤵
- System Location Discovery: System Language Discovery
PID:2288
-
-