vbc.exe

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 14, 2021, 4:41 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.wuxer
section	.cowubag
section	.new

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 14, 2021, 4:41 p.m.	process_identifier: 112 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x03f7c000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 14, 2021, 4:41 p.m.	process_identifier: 112 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00330000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 14, 2021, 4:41 p.m.	process_identifier: 1824 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00049400', u'virtual_address': u'0x00001000', u'entropy': 7.50402962764412, u'name': u'.text', u'virtual_size': u'0x0004938f'}				entropy	7.50402962764				description	A section with a high entropy has been found
entropy	0.808275862069				description	Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 14, 2021, 4:41 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (7 events)

description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Bypass DEP				rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 14, 2021, 4:41 p.m.	process_identifier: 1824 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0x00000080	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 14, 2021, 4:41 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1824 process_handle: 0x00000080	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Process injection	Process 112 called NtSetContextThread to modify thread in remote process 1824
Time & API	Arguments	Status	Return	Repeated
NtSetContextThread April 14, 2021, 4:41 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4313072 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 1824	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Process injection	Process 112 resumed a thread in remote process 1824
Time & API	Arguments	Status	Return	Repeated
NtResumeThread April 14, 2021, 4:41 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 1824	1	0	0

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW April 14, 2021, 4:41 p.m.	thread_identifier: 1556 thread_handle: 0x0000007c process_identifier: 1824 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1	0
NtGetContextThread April 14, 2021, 4:41 p.m.	thread_handle: 0x0000007c	1	0	0
NtUnmapViewOfSection April 14, 2021, 4:41 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 1824 process_handle: 0x00000080	1	0	0
NtAllocateVirtualMemory April 14, 2021, 4:41 p.m.	process_identifier: 1824 region_size: 163840 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0x00000080	1	0	0
WriteProcessMemory April 14, 2021, 4:41 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 1824 process_handle: 0x00000080	1	1	0
NtSetContextThread April 14, 2021, 4:41 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4313072 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 1824	1	0	0
NtResumeThread April 14, 2021, 4:41 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 1824	1	0	0

File has been identified by 47 AntiVirus engines on VirusTotal as malicious (47 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
MicroWorld-eScan	Gen:Variant.Graftor.939918
McAfee	RDN/Generic PWS.y
Cylance	Unsafe
AegisLab	Trojan.Win32.Noon.l!c
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0057aa691 )
Alibaba	Trojan:Win32/Kryptik.5ae7c00a
K7GW	Trojan ( 0057aa691 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Graftor.DE578E
Cyren	W32/Kryptik.DVD.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HKJX
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Backdoor.Win32.Mokes.gen
BitDefender	Gen:Variant.Graftor.939918
Avast	Win32:Trojan-gen
Rising	Trojan.Kryptik!1.D4B0 (CLOUD)
Ad-Aware	Gen:Variant.Graftor.939918
Sophos	Mal/Generic-S
DrWeb	Trojan.Siggen13.6179
VIPRE	Trojan.Win32.Generic!BT
McAfee-GW-Edition	BehavesLike.Win32.Generic.fc
FireEye	Generic.mg.6cf0200d66b943e0
Emsisoft	Trojan.Agent (A)
Ikarus	Backdoor.Win32.Kredoor
Kingsoft	Win32.Troj.Undef.(kcloud)
Gridinsoft	Trojan.Win32.Kryptik.oa
Microsoft	Trojan:Win32/Glupteba!ml
ZoneAlarm	HEUR:Backdoor.Win32.Mokes.gen
GData	Gen:Variant.Graftor.939918
Cynet	Malicious (score: 100)
AhnLab-V3	Trojan/Win.MalPE.R415606
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34670.wCX@amS1cOpG
ALYac	Gen:Variant.Graftor.939918
MAX	malware (ai score=99)
Malwarebytes	Trojan.MalPack.GS
Tencent	Win32.Trojan.Inject.Auto
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Kryptik.HKJI!tr
AVG	Win32:Trojan-gen
Cybereason	malicious.85074c
Qihoo-360	Win32/Trojan.Generic.HwoCi3sA