Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	April 13, 2021, 9:57 a.m.	April 13, 2021, 10:19 a.m.

Size	364.5KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`ad93fd487510d127e039ca04ceea6181`
SHA256	`a93612df3a5b159429eb5a2851df1bd34397e0ce76c443dac996ecc8500c0d24`
CRC32	`A04A2687`
ssdeep	`6144:kByAPECLr4dK/eNvPXunHkyP6IGYtvVvneW:kByAf1eNvmEw6hYtle`
Yara	win_files_operation - Affect private profile PE_Header_Zero - PE File Signature Zero OS_Processor_Check_Zero - OS Processor Check Signature Zero IsPE32 - (no description) IsWindowsGUI - (no description) IsPacked - Entropy Check HasOverlay - Overlay Check

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2020
- vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
  540

Name	Response	Post-Analysis Lookup
www.frotaconceitos.com	CNAME frotaconceitos.myshopify.com CNAME shops.myshopify.com A 23.227.38.74	23.227.38.74
www.forrealmodels.com	A 188.93.150.60	188.93.150.60
www.laayoune4seasons.com	CNAME laayoune4seasons.com A 160.153.133.214	160.153.133.214
www.relaxxation.com	A 52.58.78.16	52.58.78.16
www.funeralinsurancetoppro.info	A 18.219.49.238 A 18.218.104.7	18.219.49.238
www.buckhead-meat.com	CNAME buckhead-meat.com A 34.102.136.180	34.102.136.180
www.warriormovers.com	CNAME warriormovers.com A 182.50.132.242	182.50.132.242
www.classicshopin.com
www.houstonwingate.com	CNAME houstonwingate.com A 34.102.136.180	34.102.136.180
www.graniteinaminute.com	CNAME graniteinaminute.com A 182.50.132.242	182.50.132.242
www.gailrichardson.com	A 52.58.78.16	52.58.78.16
www.markokuzmanovicpreduzetnik.com	A 138.201.32.82 CNAME markokuzmanovicpreduzetnik.com	138.201.32.82
www.ndsplan.com	A 151.101.1.195 A 151.101.65.195	151.101.1.195
www.querofalardesaude.com
www.investiose.info	CNAME investiose.info A 34.102.136.180	34.102.136.180

IP Address	Status	Action
138.201.32.82	Active	Moloch
151.101.1.195	Active	Moloch
160.153.133.214	Active	Moloch
164.124.101.2	Active	Moloch
18.219.49.238	Active	Moloch
182.50.132.242	Active	Moloch
188.93.150.60	Active	Moloch
23.227.38.74	Active	Moloch
34.102.136.180	Active	Moloch
52.58.78.16	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 13, 2021, 9:57 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.lopevi
section	.nodes
section	.new

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (13 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.markokuzmanovicpreduzetnik.com/qjnt/?mlvx=i2EsCfZQS6UiXx+U6iTY56sS9p8CyNJUy4JXA/eLNLds3GOyQV3FqgBWYROgxZYT5pRPnhV7&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.buckhead-meat.com/qjnt/?mlvx=/eERDYDYg8Pjpk/w148+Jv3JxRRGqAllXY9DrwYjMBHW71fIc6WywKuPNHthuS6BfUUI+/zo&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.forrealmodels.com/qjnt/?mlvx=/8UA4kKoPYWid4Wy4SiZil89tJjdT7ic7hTrtZ5fAe41kMJ49sOOTLg7IOgO80aghp25g4RJ&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.laayoune4seasons.com/qjnt/?mlvx=XxCNNDdE0nnMoZJegK9IRWJB/iuqF7H0guvnuK5beGVYhhifxg4lqMNy7rY6vl9fOe+xyR5I&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.ndsplan.com/qjnt/?mlvx=409VEscmxhGhn2kjsNBSYZ81rwPnbusvlCtuGf7QRivOwkGAR0eK2ipEcznp67DdWqS8MJrG&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.graniteinaminute.com/qjnt/?mlvx=Kc40ChrvGMsz5sDUgJdI1Tm80ndRwqOobrZe5CnH/KVtq0OHhWuXcnL+C6x+hGBLT8rXGqGg&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.investiose.info/qjnt/?mlvx=ZxcvZy8ZLczqtvfEla7uZ1L3KAM6BWVTFYDKbjT+DQ7ivFAcZk5kBU1oTK1xQfOK60beZP/V&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.warriormovers.com/qjnt/?mlvx=ZloBTpog1XpNf+wk1FYIj/PbKl44EdMQG0QlJcdkzx7vf5IbO8Fhxe+U6jjqYB73pzbLmZvg&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.frotaconceitos.com/qjnt/?mlvx=SklQbBNIGDp60jmvc81YaO0+TakJjqFF7kfS9N7pp+kjm4De+jDioVGollGezL8QEhW81teu&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.houstonwingate.com/qjnt/?mlvx=CzEu8ZxrHnRoIa1yxDkB+HouEa3BiY3cm4vRhwDecVIGXXoKItZ0uSpGs804ymz2gjLlGyUN&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.relaxxation.com/qjnt/?mlvx=mxaFhsYpdbWAcRjreClqDIL9OHFKPqnw/WaD4R8v0Y7MiHTOLhCg3x68N9MAlpNWynvCyQkZ&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.gailrichardson.com/qjnt/?mlvx=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&NjBDlv=8p4plXBx
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.funeralinsurancetoppro.info/qjnt/?mlvx=LPK6/ZZmecylnPQHmmc0+oSuT0+zz+F74Xw+uImePqFt3mHqU1FOQjOO/4KEthU7c6djewSp&NjBDlv=8p4plXBx

Performs some HTTP requests (26 events)

request	POST http://www.markokuzmanovicpreduzetnik.com/qjnt/
request	GET http://www.markokuzmanovicpreduzetnik.com/qjnt/?mlvx=i2EsCfZQS6UiXx+U6iTY56sS9p8CyNJUy4JXA/eLNLds3GOyQV3FqgBWYROgxZYT5pRPnhV7&NjBDlv=8p4plXBx
request	POST http://www.buckhead-meat.com/qjnt/
request	GET http://www.buckhead-meat.com/qjnt/?mlvx=/eERDYDYg8Pjpk/w148+Jv3JxRRGqAllXY9DrwYjMBHW71fIc6WywKuPNHthuS6BfUUI+/zo&NjBDlv=8p4plXBx
request	POST http://www.forrealmodels.com/qjnt/
request	GET http://www.forrealmodels.com/qjnt/?mlvx=/8UA4kKoPYWid4Wy4SiZil89tJjdT7ic7hTrtZ5fAe41kMJ49sOOTLg7IOgO80aghp25g4RJ&NjBDlv=8p4plXBx
request	POST http://www.laayoune4seasons.com/qjnt/
request	GET http://www.laayoune4seasons.com/qjnt/?mlvx=XxCNNDdE0nnMoZJegK9IRWJB/iuqF7H0guvnuK5beGVYhhifxg4lqMNy7rY6vl9fOe+xyR5I&NjBDlv=8p4plXBx
request	POST http://www.ndsplan.com/qjnt/
request	GET http://www.ndsplan.com/qjnt/?mlvx=409VEscmxhGhn2kjsNBSYZ81rwPnbusvlCtuGf7QRivOwkGAR0eK2ipEcznp67DdWqS8MJrG&NjBDlv=8p4plXBx
request	POST http://www.graniteinaminute.com/qjnt/
request	GET http://www.graniteinaminute.com/qjnt/?mlvx=Kc40ChrvGMsz5sDUgJdI1Tm80ndRwqOobrZe5CnH/KVtq0OHhWuXcnL+C6x+hGBLT8rXGqGg&NjBDlv=8p4plXBx
request	POST http://www.investiose.info/qjnt/
request	GET http://www.investiose.info/qjnt/?mlvx=ZxcvZy8ZLczqtvfEla7uZ1L3KAM6BWVTFYDKbjT+DQ7ivFAcZk5kBU1oTK1xQfOK60beZP/V&NjBDlv=8p4plXBx
request	POST http://www.warriormovers.com/qjnt/
request	GET http://www.warriormovers.com/qjnt/?mlvx=ZloBTpog1XpNf+wk1FYIj/PbKl44EdMQG0QlJcdkzx7vf5IbO8Fhxe+U6jjqYB73pzbLmZvg&NjBDlv=8p4plXBx
request	POST http://www.frotaconceitos.com/qjnt/
request	GET http://www.frotaconceitos.com/qjnt/?mlvx=SklQbBNIGDp60jmvc81YaO0+TakJjqFF7kfS9N7pp+kjm4De+jDioVGollGezL8QEhW81teu&NjBDlv=8p4plXBx
request	POST http://www.houstonwingate.com/qjnt/
request	GET http://www.houstonwingate.com/qjnt/?mlvx=CzEu8ZxrHnRoIa1yxDkB+HouEa3BiY3cm4vRhwDecVIGXXoKItZ0uSpGs804ymz2gjLlGyUN&NjBDlv=8p4plXBx
request	POST http://www.relaxxation.com/qjnt/
request	GET http://www.relaxxation.com/qjnt/?mlvx=mxaFhsYpdbWAcRjreClqDIL9OHFKPqnw/WaD4R8v0Y7MiHTOLhCg3x68N9MAlpNWynvCyQkZ&NjBDlv=8p4plXBx
request	POST http://www.gailrichardson.com/qjnt/
request	GET http://www.gailrichardson.com/qjnt/?mlvx=cQpYuVHVGObCoOy3oJObHgw0bCNAclVj5U/7sRdD/qRSo/tXEB2YKGAusTd/rcUBeGIQZ61D&NjBDlv=8p4plXBx
request	POST http://www.funeralinsurancetoppro.info/qjnt/
request	GET http://www.funeralinsurancetoppro.info/qjnt/?mlvx=LPK6/ZZmecylnPQHmmc0+oSuT0+zz+F74Xw+uImePqFt3mHqU1FOQjOO/4KEthU7c6djewSp&NjBDlv=8p4plXBx

Sends data using the HTTP POST Method (13 events)

request	POST http://www.markokuzmanovicpreduzetnik.com/qjnt/
request	POST http://www.buckhead-meat.com/qjnt/
request	POST http://www.forrealmodels.com/qjnt/
request	POST http://www.laayoune4seasons.com/qjnt/
request	POST http://www.ndsplan.com/qjnt/
request	POST http://www.graniteinaminute.com/qjnt/
request	POST http://www.investiose.info/qjnt/
request	POST http://www.warriormovers.com/qjnt/
request	POST http://www.frotaconceitos.com/qjnt/
request	POST http://www.houstonwingate.com/qjnt/
request	POST http://www.relaxxation.com/qjnt/
request	POST http://www.gailrichardson.com/qjnt/
request	POST http://www.funeralinsurancetoppro.info/qjnt/

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 13, 2021, 9:57 a.m.	process_identifier: 2020 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03e6c000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 13, 2021, 9:57 a.m.	process_identifier: 2020 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 13, 2021, 9:57 a.m.	process_identifier: 540 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x008f0000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0xffffffff	1

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00049600', u'virtual_address': u'0x00001000', u'entropy': 7.503666344690391, u'name': u'.text', u'virtual_size': u'0x000494ef'}

entropy

7.50366634469

description

A section with a high entropy has been found

entropy

0.808539944904

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 13, 2021, 9:57 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (7 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Bypass DEP	rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 13, 2021, 9:57 a.m.	process_identifier: 540 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 13, 2021, 9:57 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 540 process_handle: 0x00000080	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2020 called NtSetContextThread to modify thread in remote process 540
NtSetContextThread April 13, 2021, 9:57 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4313232 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 540	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2020 resumed a thread in remote process 540
NtResumeThread April 13, 2021, 9:57 a.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 540	1	0	0

Generates some ICMP traffic

File has been identified by 29 AntiVirus engines on VirusTotal as malicious (29 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.ad93fd487510d127
McAfee	Artemis!AD93FD487510
Cylance	Unsafe
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_80% (D)
K7GW	Riskware ( 800800801 )
BitDefenderTheta	Gen:NN.ZexaF.34670.wCX@aywMDYiG
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HKJF
Avast	Win32:Malware-gen
Kaspersky	UDS:Trojan-Spy.Win32.Noon
Paloalto	generic.ml
Tencent	Win32.Trojan.Inject.Auto
Emsisoft	Trojan.Agent (A)
McAfee-GW-Edition	BehavesLike.Win32.Lockbit.fc
Sophos	ML/PE-A
APEX	Malicious
Microsoft	Trojan:Win32/Caynamer.A!ml
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.MalPE.R415606
Ikarus	Win32.Outbreak
Rising	Malware.Heuristic!ET#76% (RDMK:cmRtazqGl6iiSTNh7eT6wN8rJqLx)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/GenKryptik.FDXJ!tr
AVG	Win32:Malware-gen
Cybereason	malicious.5dcbd1
Qihoo-360	HEUR/QVM10.1.8928.Malware.Gen

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW April 13, 2021, 9:57 a.m.	thread_identifier: 1224 thread_handle: 0x0000007c process_identifier: 540 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1
NtGetContextThread April 13, 2021, 9:57 a.m.	thread_handle: 0x0000007c	1	0
NtUnmapViewOfSection April 13, 2021, 9:57 a.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 540 process_handle: 0x00000080	1	0
NtAllocateVirtualMemory April 13, 2021, 9:57 a.m.	process_identifier: 540 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000080	1	0
WriteProcessMemory April 13, 2021, 9:57 a.m.	buffer: @ base_address: 0x7efde008 process_identifier: 540 process_handle: 0x00000080	1	1
NtSetContextThread April 13, 2021, 9:57 a.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4313232 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 540	1	0
NtResumeThread April 13, 2021, 9:57 a.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 540	1	0

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All