Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21/11/2024, 20:33

General

  • Target

    vbc.exe

  • Size

    575KB

  • MD5

    2986502fc991bed7cc87122bc481d5b4

  • SHA1

    45d8d4498052803984a49f880d874c659945fc0c

  • SHA256

    45de0a47d8bee8de67d818ea239f0f9c934c3299be3c3faefacb9e1e4800078c

  • SHA512

    54f3fc749923be12396af61b64bbeaf5b12e290159960517989b79d882d4a1ed2af6045a85987ac615b9da1d9232d63db5ceacbf4c907b5fd33735575c75a3d8

  • SSDEEP

    12288:zBqlwSPINx9zVGr5rg3xcnX5pPhdc2WjgDw:yDIxfErgAXc2WjgDw

Malware Config

Extracted

Family

xloader

Version

2.5

Campaign

ns87

Decoy

hcjn998.com

y963257.xyz

upcrunchnow.com

adornor.online

boyhunters.com

mchaskell.com

bayanescort.xyz

jovinodossantossite.com

hubhosted.com

evertownnycapartments.net

mgav40.xyz

lfykjx.com

asscheekspizzaboi.com

chinacxq.com

abovecover.net

listingswithalex.com

hhcreativeartsociety.com

aryanagasosa.xyz

caesarpro.com

junanbolsas.online

Signatures

  • Xloader

    Xloader is a rebranded version of Formbook malware.

  • Xloader family
  • Xloader payload 5 IoCs
  • Uses the VBS compiler for execution 1 TTPs
  • Suspicious use of SetThreadContext 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3412
    • C:\Users\Admin\AppData\Local\Temp\vbc.exe
      "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1388
      • C:\Users\Admin\AppData\Local\Temp\vbc.exe
        "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:1784
    • C:\Windows\SysWOW64\msiexec.exe
      "C:\Windows\SysWOW64\msiexec.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4820
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Users\Admin\AppData\Local\Temp\vbc.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:2836

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1388-14-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1388-1-0x0000000000660000-0x00000000006F4000-memory.dmp

    Filesize

    592KB

  • memory/1388-2-0x0000000005670000-0x0000000005C14000-memory.dmp

    Filesize

    5.6MB

  • memory/1388-3-0x0000000005160000-0x00000000051F2000-memory.dmp

    Filesize

    584KB

  • memory/1388-4-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1388-5-0x0000000005100000-0x000000000510A000-memory.dmp

    Filesize

    40KB

  • memory/1388-6-0x00000000055C0000-0x00000000055CC000-memory.dmp

    Filesize

    48KB

  • memory/1388-7-0x0000000006420000-0x000000000646C000-memory.dmp

    Filesize

    304KB

  • memory/1388-8-0x0000000006510000-0x00000000065AC000-memory.dmp

    Filesize

    624KB

  • memory/1388-9-0x000000007442E000-0x000000007442F000-memory.dmp

    Filesize

    4KB

  • memory/1388-10-0x0000000074420000-0x0000000074BD0000-memory.dmp

    Filesize

    7.7MB

  • memory/1388-11-0x00000000068E0000-0x0000000006948000-memory.dmp

    Filesize

    416KB

  • memory/1388-0-0x000000007442E000-0x000000007442F000-memory.dmp

    Filesize

    4KB

  • memory/1784-17-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1784-18-0x0000000001820000-0x0000000001831000-memory.dmp

    Filesize

    68KB

  • memory/1784-12-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1784-22-0x00000000036E0000-0x00000000036F1000-memory.dmp

    Filesize

    68KB

  • memory/1784-21-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1784-15-0x0000000001880000-0x0000000001BCA000-memory.dmp

    Filesize

    3.3MB

  • memory/3412-32-0x0000000008690000-0x0000000008804000-memory.dmp

    Filesize

    1.5MB

  • memory/3412-19-0x0000000009660000-0x0000000009805000-memory.dmp

    Filesize

    1.6MB

  • memory/3412-23-0x0000000008690000-0x0000000008804000-memory.dmp

    Filesize

    1.5MB

  • memory/3412-39-0x00000000090E0000-0x000000000923C000-memory.dmp

    Filesize

    1.4MB

  • memory/3412-38-0x00000000090E0000-0x000000000923C000-memory.dmp

    Filesize

    1.4MB

  • memory/3412-36-0x00000000090E0000-0x000000000923C000-memory.dmp

    Filesize

    1.4MB

  • memory/4820-28-0x0000000000700000-0x0000000000712000-memory.dmp

    Filesize

    72KB

  • memory/4820-31-0x00000000006B0000-0x00000000006D9000-memory.dmp

    Filesize

    164KB

  • memory/4820-30-0x00000000025C0000-0x000000000290A000-memory.dmp

    Filesize

    3.3MB

  • memory/4820-33-0x00000000024B0000-0x0000000002540000-memory.dmp

    Filesize

    576KB

  • memory/4820-26-0x0000000000700000-0x0000000000712000-memory.dmp

    Filesize

    72KB

  • memory/4820-29-0x00000000006B0000-0x00000000006D9000-memory.dmp

    Filesize

    164KB

  • memory/4820-24-0x0000000000700000-0x0000000000712000-memory.dmp

    Filesize

    72KB