vbc.exe

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 16, 2021, 2:58 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	.jasot
section	.kehefu
section	.new

The file contains an unknown PE resource name possibly indicative of a packer (1 event)

resource name

None

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (3 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory April 16, 2021, 2:58 p.m.	process_identifier: 1116 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 131072 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0031c000 process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 16, 2021, 2:58 p.m.	process_identifier: 1116 region_size: 172032 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02200000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0	0
NtAllocateVirtualMemory April 16, 2021, 2:58 p.m.	process_identifier: 2384 region_size: 3158016 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007c0000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section	{u'size_of_data': u'0x00045200', u'virtual_address': u'0x00001000', u'entropy': 7.5324879266726485, u'name': u'.text', u'virtual_size': u'0x0004501f'}				entropy	7.53248792667				description	A section with a high entropy has been found
entropy	0.822916666667				description	Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 16, 2021, 2:58 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (7 events)

description	(no description)				rule	DebuggerCheck__GlobalFlags
description	(no description)				rule	DebuggerCheck__QueryInfo
description	(no description)				rule	DebuggerHiding__Thread
description	(no description)				rule	DebuggerHiding__Active
description	(no description)				rule	ThreadControl__Context
description	(no description)				rule	SEH__vectored
description	Bypass DEP				rule	disable_dep

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory April 16, 2021, 2:58 p.m.	process_identifier: 2384 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0x00000080	1	0	0

Potential code injection by writing to the memory of another process (1 event)

Time & API	Arguments	Status	Return	Repeated
WriteProcessMemory April 16, 2021, 2:58 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2384 process_handle: 0x00000080	1	1	0

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Process injection	Process 1116 called NtSetContextThread to modify thread in remote process 2384
Time & API	Arguments	Status	Return	Repeated
NtSetContextThread April 16, 2021, 2:58 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4313232 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2384	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Process injection	Process 1116 resumed a thread in remote process 2384
Time & API	Arguments	Status	Return	Repeated
NtResumeThread April 16, 2021, 2:58 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2384	1	0	0

Executed a process and injected code into it, probably while unpacking (7 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW April 16, 2021, 2:58 p.m.	thread_identifier: 1772 thread_handle: 0x0000007c process_identifier: 2384 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe" filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000080	1	1	0
NtGetContextThread April 16, 2021, 2:58 p.m.	thread_handle: 0x0000007c	1	0	0
NtUnmapViewOfSection April 16, 2021, 2:58 p.m.	base_address: 0x00400000 region_size: 4096 process_identifier: 2384 process_handle: 0x00000080	1	0	0
NtAllocateVirtualMemory April 16, 2021, 2:58 p.m.	process_identifier: 2384 region_size: 167936 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE) process_handle: 0x00000080	1	0	0
WriteProcessMemory April 16, 2021, 2:58 p.m.	buffer: @ base_address: 0x7efde008 process_identifier: 2384 process_handle: 0x00000080	1	1	0
NtSetContextThread April 16, 2021, 2:58 p.m.	registers.eip: 2000355780 registers.esp: 1638384 registers.edi: 0 registers.eax: 4313232 registers.ebp: 0 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x0000007c process_identifier: 2384	1	0	0
NtResumeThread April 16, 2021, 2:58 p.m.	thread_handle: 0x0000007c suspend_count: 1 process_identifier: 2384	1	0	0

File has been identified by 44 AntiVirus engines on VirusTotal as malicious (44 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.fb861097be51a4c1
McAfee	RDN/Generic PWS.y
Cylance	Unsafe
VIPRE	Trojan.Win32.Generic!BT
SUPERAntiSpyware	Trojan.Agent/Gen-Kryptik
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan ( 0056f9be1 )
Alibaba	Trojan:Win32/runner.ali1000123
K7GW	Trojan ( 0056f9be1 )
Cybereason	malicious.1e66cc
Cyren	W32/Kryptik.DVL.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/Kryptik.HKKV
APEX	Malicious
Avast	Win32:DropperX-gen [Drp]
Cynet	Malicious (score: 100)
Kaspersky	HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender	Trojan.GenericKD.46103070
Paloalto	generic.ml
AegisLab	Trojan.Win32.Noon.l!c
MicroWorld-eScan	Trojan.GenericKD.46103070
Tencent	Win32.Trojan.Inject.Auto
Ad-Aware	Trojan.GenericKD.46103070
Emsisoft	Trojan.Agent (A)
McAfee-GW-Edition	BehavesLike.Win32.Trojan.fc
Sophos	Mal/Generic-R + Troj/Kryptik-UV
Ikarus	Win32.Outbreak
Avira	TR/Kryptik.frqix
Gridinsoft	Trojan.Win32.Kryptik.oa
Microsoft	Trojan:Win32/Ranumbot.RWA!MTB
GData	Win32.Trojan-Stealer.FormBook.1KSJRB
Acronis	suspicious
BitDefenderTheta	Gen:NN.ZexaF.34678.vCX@a8uVUqpG
MAX	malware (ai score=100)
Malwarebytes	Trojan.MalPack.GS
TrendMicro-HouseCall	TROJ_GEN.R06CC0DDF21
Rising	Trojan.Kryptik!1.D4B0 (CLOUD)
SentinelOne	Static AI - Malicious PE
Fortinet	W32/Kryptik.HKLC!tr
AVG	Win32:DropperX-gen [Drp]
CrowdStrike	win/malicious_confidence_100% (W)
Qihoo-360	Win32/Trojan.Kryptik.HwoCmkQA