popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 April 9, 2021, 11:32 a.m. April 9, 2021, 11:39 a.m.
Size 378.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 95b9de411f02303856d21e978004cecb
SHA256 5bcba2a09d8758ca07490dfcd3859a64b3a0092ed7873a707e73346eefd4235e
CRC32 FBE1E336
ssdeep 6144:AxsTcyLIWYxn3QDQ+2uDTv7+xJx5Y7CFIMKqZxnGqaz:AxsTd0t3QDQpFPDY7CC2Gtz
Yara
  • win_files_operation - Affect private profile
  • PE_Header_Zero - PE File Signature Zero
  • OS_Processor_Check_Zero - OS Processor Check Signature Zero
  • IsPE32 - (no description)
  • IsWindowsGUI - (no description)
  • HasOverlay - Overlay Check

Name Response Post-Analysis Lookup
www.crochenista.com
CNAME crochenista.com
A 162.241.216.98
162.241.216.98
www.californiaredstate.com
A 34.102.136.180
CNAME californiaredstate.com
34.102.136.180
www.warriornotesgolbalprayer.com
A 34.102.136.180
CNAME warriornotesgolbalprayer.com
34.102.136.180
www.sligogolfacademy.com
A 104.232.64.103
104.232.64.103
www.gritchiecharcoal.com
A 94.136.40.51
94.136.40.51
www.rivcodevelopment.com
CNAME rivcodevelopment.com
A 182.50.132.242
182.50.132.242
www.markokuzmanovicpreduzetnik.com
A 138.201.32.82
CNAME markokuzmanovicpreduzetnik.com
138.201.32.82
www.pursuetech.online
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.212
www.satgurucolorlabs.com
A 176.74.27.193
CNAME satgurucolorlabs.com
176.74.27.193
www.bandinella.com
www.tekirdagvethelp.com
A 160.153.137.210
CNAME tekirdagvethelp.com
160.153.137.210
www.slots-drift-casino.com
www.gailrichardson.com
A 52.58.78.16
52.58.78.16
www.afribus-sarl.com
CNAME afribus-sarl.com
A 156.67.222.15
156.67.222.15
www.startrekepisode.com
A 34.102.136.180
CNAME startrekepisode.com
34.102.136.180
IP Address Status Action
104.232.64.103 Active Moloch
138.201.32.82 Active Moloch
156.67.222.15 Active Moloch
160.153.137.210 Active Moloch
162.241.216.98 Active Moloch
164.124.101.2 Active Moloch
172.217.25.14 Active Moloch
176.74.27.193 Active Moloch
182.50.132.242 Active Moloch
198.54.117.216 Active Moloch
34.102.136.180 Active Moloch
52.58.78.16 Active Moloch
94.136.40.51 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
section .luwohu
section .cunazoc
section .new
resource name None
suspicious_features GET method with no useragent header suspicious_request GET http://www.startrekepisode.com/qjnt/?GVIp=5+BnPckFTRrJGxaMVUv0BF1FKPa8eJDIfTmAxOSqxwEOI5f2tl64h5cJxkg2lQOsq3TBX7Br&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.warriornotesgolbalprayer.com/qjnt/?GVIp=NZEjDeTbQWI4t+jLVj6ckcPfHkTvqBwW1gJjjcociDWZiHYNHkrr42q5Qu5MGWq/DbzHTKzP&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.crochenista.com/qjnt/?GVIp=J6zJO2/PwCYDrPfd6ahXoqg8qe3TXVYRwNW46sX1F3TUCNiZ+HIDBehPRyNHfGKllpDSpMGn&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.gritchiecharcoal.com/qjnt/?GVIp=dVs14fUu2Ven2658hBFx9jliZTLZEVHuVQGBY3ziSv8BPTKHH6vE10KIv0y/hbAn0E72jEmA&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.pursuetech.online/qjnt/?GVIp=UJn/7NokSL2FPuNNwv4FdJrbdlnW4eRV1Lxvc4zBF7oEPJhjtmbCbY73fNr4REBZHryZKKL0&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.sligogolfacademy.com/qjnt/?GVIp=jW8pZHGrNu+IDaEzBY5u1VpwwzeNUmqGp5ujPvgX8FP3RhC0Cv3sVN1JA0V0HBZXOpjzOmY1&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.tekirdagvethelp.com/qjnt/?GVIp=v0dvXvCpAze/PSRLgi5c7IjcC6T7N6slsP66HWsXdGdDDJOBVUv/yIdiTd0J1EHztdsWavry&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.markokuzmanovicpreduzetnik.com/qjnt/?GVIp=i2EsCfZQS6UiXx+U6iTY56sS9p8CyNJUy4JXA/eLNLds3GOyQV3FqgBWYROgxZYT5pRPnhV7&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.afribus-sarl.com/qjnt/?GVIp=6zsJ3I6fnvnvPqNUuHAovJSNRJHpn5EvvBYNRoEL7J7xd/JGdiWMrLKdjv+wu5Vp5UHXoriB&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.satgurucolorlabs.com/qjnt/?GVIp=lFOs3seWHobXZFGYMkHCyCSKoxf9Fp1huCHl5VFj4NoBT+gyoDzqMjsS+A4Ws/tEOa8o/RQV&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.californiaredstate.com/qjnt/?GVIp=zQPqhV0zjwqOH7+4I463/IP/2KgA+kN0HIdOkui6XhPhedEq6pmyyx37MiuAH/2FJlIb70cd&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.gailrichardson.com/qjnt/?GVIp=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&uzu8=jjIxZ4g0M0EpUH
suspicious_features GET method with no useragent header suspicious_request GET http://www.rivcodevelopment.com/qjnt/?GVIp=8NBAzZEp5T2EoF9wMDQ69YhjG3fhuSs/Y3qkwEtmFVQU29n+5biQRN67qVAa42W8gpsiaP+Q&uzu8=jjIxZ4g0M0EpUH
request POST http://www.startrekepisode.com/qjnt/
request GET http://www.startrekepisode.com/qjnt/?GVIp=5+BnPckFTRrJGxaMVUv0BF1FKPa8eJDIfTmAxOSqxwEOI5f2tl64h5cJxkg2lQOsq3TBX7Br&uzu8=jjIxZ4g0M0EpUH
request POST http://www.warriornotesgolbalprayer.com/qjnt/
request GET http://www.warriornotesgolbalprayer.com/qjnt/?GVIp=NZEjDeTbQWI4t+jLVj6ckcPfHkTvqBwW1gJjjcociDWZiHYNHkrr42q5Qu5MGWq/DbzHTKzP&uzu8=jjIxZ4g0M0EpUH
request POST http://www.crochenista.com/qjnt/
request GET http://www.crochenista.com/qjnt/?GVIp=J6zJO2/PwCYDrPfd6ahXoqg8qe3TXVYRwNW46sX1F3TUCNiZ+HIDBehPRyNHfGKllpDSpMGn&uzu8=jjIxZ4g0M0EpUH
request POST http://www.gritchiecharcoal.com/qjnt/
request GET http://www.gritchiecharcoal.com/qjnt/?GVIp=dVs14fUu2Ven2658hBFx9jliZTLZEVHuVQGBY3ziSv8BPTKHH6vE10KIv0y/hbAn0E72jEmA&uzu8=jjIxZ4g0M0EpUH
request POST http://www.pursuetech.online/qjnt/
request GET http://www.pursuetech.online/qjnt/?GVIp=UJn/7NokSL2FPuNNwv4FdJrbdlnW4eRV1Lxvc4zBF7oEPJhjtmbCbY73fNr4REBZHryZKKL0&uzu8=jjIxZ4g0M0EpUH
request GET http://www.sligogolfacademy.com/qjnt/?GVIp=jW8pZHGrNu+IDaEzBY5u1VpwwzeNUmqGp5ujPvgX8FP3RhC0Cv3sVN1JA0V0HBZXOpjzOmY1&uzu8=jjIxZ4g0M0EpUH
request GET http://www.tekirdagvethelp.com/qjnt/?GVIp=v0dvXvCpAze/PSRLgi5c7IjcC6T7N6slsP66HWsXdGdDDJOBVUv/yIdiTd0J1EHztdsWavry&uzu8=jjIxZ4g0M0EpUH
request POST http://www.markokuzmanovicpreduzetnik.com/qjnt/
request GET http://www.markokuzmanovicpreduzetnik.com/qjnt/?GVIp=i2EsCfZQS6UiXx+U6iTY56sS9p8CyNJUy4JXA/eLNLds3GOyQV3FqgBWYROgxZYT5pRPnhV7&uzu8=jjIxZ4g0M0EpUH
request POST http://www.afribus-sarl.com/qjnt/
request GET http://www.afribus-sarl.com/qjnt/?GVIp=6zsJ3I6fnvnvPqNUuHAovJSNRJHpn5EvvBYNRoEL7J7xd/JGdiWMrLKdjv+wu5Vp5UHXoriB&uzu8=jjIxZ4g0M0EpUH
request POST http://www.satgurucolorlabs.com/qjnt/
request GET http://www.satgurucolorlabs.com/qjnt/?GVIp=lFOs3seWHobXZFGYMkHCyCSKoxf9Fp1huCHl5VFj4NoBT+gyoDzqMjsS+A4Ws/tEOa8o/RQV&uzu8=jjIxZ4g0M0EpUH
request POST http://www.californiaredstate.com/qjnt/
request GET http://www.californiaredstate.com/qjnt/?GVIp=zQPqhV0zjwqOH7+4I463/IP/2KgA+kN0HIdOkui6XhPhedEq6pmyyx37MiuAH/2FJlIb70cd&uzu8=jjIxZ4g0M0EpUH
request POST http://www.gailrichardson.com/qjnt/
request GET http://www.gailrichardson.com/qjnt/?GVIp=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&uzu8=jjIxZ4g0M0EpUH
request POST http://www.rivcodevelopment.com/qjnt/
request GET http://www.rivcodevelopment.com/qjnt/?GVIp=8NBAzZEp5T2EoF9wMDQ69YhjG3fhuSs/Y3qkwEtmFVQU29n+5biQRN67qVAa42W8gpsiaP+Q&uzu8=jjIxZ4g0M0EpUH
request POST http://www.startrekepisode.com/qjnt/
request POST http://www.warriornotesgolbalprayer.com/qjnt/
request POST http://www.crochenista.com/qjnt/
request POST http://www.gritchiecharcoal.com/qjnt/
request POST http://www.pursuetech.online/qjnt/
request POST http://www.markokuzmanovicpreduzetnik.com/qjnt/
request POST http://www.afribus-sarl.com/qjnt/
request POST http://www.satgurucolorlabs.com/qjnt/
request POST http://www.californiaredstate.com/qjnt/
request POST http://www.gailrichardson.com/qjnt/
request POST http://www.rivcodevelopment.com/qjnt/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2952
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
length: 131072
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x03e5c000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2952
region_size: 172032
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 652
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00910000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
section {u'size_of_data': u'0x0004ae00', u'virtual_address': u'0x00001000', u'entropy': 7.492372542678223, u'name': u'.text', u'virtual_size': u'0x0004ac13'} entropy 7.49237254268 description A section with a high entropy has been found
entropy 0.795484727756 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
host 172.217.25.14
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 652
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 652
process_handle: 0x00000080
1 1 0
Process injection Process 2952 called NtSetContextThread to modify thread in remote process 652
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313232
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 652
1 0 0
Process injection Process 2952 resumed a thread in remote process 652
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 652
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 812
thread_handle: 0x0000007c
process_identifier: 652
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000080
1 1 0

NtGetContextThread

 thread_handle: 0x0000007c
1 0 0

NtUnmapViewOfSection

 base_address: 0x00400000
region_size: 4096
process_identifier: 652
process_handle: 0x00000080
1 0 0

NtAllocateVirtualMemory

 process_identifier: 652
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000080
1 0 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 652
process_handle: 0x00000080
1 1 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4313232
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000007c
process_identifier: 652
1 0 0

NtResumeThread

 thread_handle: 0x0000007c
suspend_count: 1
process_identifier: 652
1 0 0
Bkav W32.AIDetect.malware1
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKDZ.74040
FireEye Generic.mg.95b9de411f023038
McAfee Artemis!95B9DE411F02
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
CrowdStrike win/malicious_confidence_60% (D)
Cyren W32/Kryptik.DTT.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Kryptik.HKII
APEX Malicious
Avast Win32:DropperX-gen [Drp]
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.GenericKDZ.74040
Paloalto generic.ml
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKDZ.74040
Sophos ML/PE-A
McAfee-GW-Edition BehavesLike.Win32.Generic.fh
Emsisoft Trojan.Agent (A)
Ikarus Trojan.Win32.Crypt
MAX malware (ai score=86)
Microsoft Trojan:Win32/Wacatac.B!ml
GData Trojan.GenericKDZ.74040
Cynet Malicious (score: 100)
Acronis suspicious
VBA32 BScope.Trojan.Wacatac
Malwarebytes Trojan.MalPack.GS
Rising Trojan.Kryptik!1.D4B0 (CLASSIC)
SentinelOne Static AI - Malicious PE
Fortinet W32/Kryptik.HKID!tr
BitDefenderTheta Gen:NN.ZexaF.34670.xC1@aS4psLfG
AVG Win32:DropperX-gen [Drp]
Cybereason malicious.2f8bbe
Qihoo-360 HEUR/QVM10.1.731B.Malware.Gen