Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	April 22, 2021, 10:49 a.m.	April 22, 2021, 10:55 a.m.

Size	964.0KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`71a14ce0723e4de96846bf22eed49d20`
SHA256	`57d6ee60faf10320d9fd37d58aeec59e6735366afece642579ab6d9743c1731b`
CRC32	`81D0C0E4`
ssdeep	`24576:Qu6rydScPwixERRRRRan1c+nZAUxBH+DI6n:D6ryocfiRRRRRYZAsJEI6n`
Yara	PE_Header_Zero - PE File Signature Zero Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult IsPE32 - (no description) IsNET_EXE - (no description) IsWindowsGUI - (no description)

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
5192

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
172.217.25.14	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 22, 2021, 10:49 a.m.			0	0
IsDebuggerPresent April 22, 2021, 10:49 a.m.			0	0
IsDebuggerPresent April 22, 2021, 10:50 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey April 22, 2021, 10:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00273330 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2021, 10:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00272c30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey April 22, 2021, 10:49 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00272c30 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 22, 2021, 10:49 a.m.		1	1	0

Allocates read-write-execute memory (usually to unpack itself) (50 out of 84 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00640000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00700000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba1000 process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6fba2000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00670000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00512000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00645000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0064b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00647000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00850000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00851000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0053a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00537000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00852000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00853000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0051c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef58000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef40000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00536000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:49 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00854000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00855000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0052d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00856000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00857000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00858000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00859000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0085a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0085b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0085c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05020178 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050201a0 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x050201c8 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0508368e process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 11 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05083682 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 72 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05020208 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0505df00 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0505df24 process_handle: 0xffffffff		3221225550
NtProtectVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0505df2c process_handle: 0xffffffff		3221225550

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000f0400', u'virtual_address': u'0x00002000', u'entropy': 6.998497664827444, u'name': u'.text', u'virtual_size': u'0x000f0354'}

entropy

6.99849766483

description

A section with a high entropy has been found

entropy

0.997405293202

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 22, 2021, 10:50 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Terminates another process (10 events)

Time & API	Arguments	Status
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 9100 process_handle: 0x000002f0
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 9100 process_handle: 0x000002f0	1
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 8248 process_handle: 0x000002f8
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 8248 process_handle: 0x000002f8	1
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 5572 process_handle: 0x00000300
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 5572 process_handle: 0x00000300	1
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 2340 process_handle: 0x00000308
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 2340 process_handle: 0x00000308	1
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 4900 process_handle: 0x00000310
NtTerminateProcess April 22, 2021, 10:50 a.m.	status_code: 0xffffffff process_identifier: 4900 process_handle: 0x00000310	1

Communicates with host for which no DNS query was performed (1 event)

host

172.217.25.14

Allocates execute permission to another process indicative of possible code injection (5 events)

Time & API	Arguments	Return
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 9100 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8	3221225496
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 8248 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec	3221225496
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5572 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002f4	3221225496
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 2340 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002fc	3221225496
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 4900 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000304	3221225496

Manipulates memory of a non-child process indicative of process injection (10 events)

Time & API	Arguments	Return	Repeated
Process injection	Process 5192 manipulating memory of non-child process 9100
Process injection	Process 5192 manipulating memory of non-child process 8248
Process injection	Process 5192 manipulating memory of non-child process 5572
Process injection	Process 5192 manipulating memory of non-child process 2340
Process injection	Process 5192 manipulating memory of non-child process 4900
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 9100 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8	3221225496	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 8248 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec	3221225496	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5572 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002f4	3221225496	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 2340 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002fc	3221225496	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 4900 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000304	3221225496	0

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Elastic	malicious (high confidence)
FireEye	Generic.mg.71a14ce0723e4de9
BitDefenderTheta	Gen:NN.ZemsilF.34678.8m0@ay4iFdh
Cyren	W32/MSIL_Kryptik.DZG.gen!Eldorado
Symantec	Scr.Malcode!gdn30
APEX	Malicious
McAfee-GW-Edition	BehavesLike.Win32.Generic.dh
Microsoft	Trojan:Win32/AgentTesla!ml
Cynet	Malicious (score: 100)
Malwarebytes	Malware.AI.4275721012
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_98%
Fortinet	MSIL/Kryptik.ZXG!tr
CrowdStrike	win/malicious_confidence_60% (D)
Qihoo-360	HEUR/QVM03.0.BC45.Malware.Gen

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
NtResumeThread April 22, 2021, 10:49 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 5192	1	0
NtResumeThread April 22, 2021, 10:49 a.m.	thread_handle: 0x00000154 suspend_count: 1 process_identifier: 5192	1	0
NtResumeThread April 22, 2021, 10:49 a.m.	thread_handle: 0x00000198 suspend_count: 1 process_identifier: 5192	1	0
NtResumeThread April 22, 2021, 10:49 a.m.	thread_handle: 0x0000024c suspend_count: 1 process_identifier: 5192	1	0
NtResumeThread April 22, 2021, 10:50 a.m.	thread_handle: 0x00000268 suspend_count: 1 process_identifier: 5192	1	0
NtResumeThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002c0 suspend_count: 1 process_identifier: 5192	1	0
NtResumeThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002d4 suspend_count: 1 process_identifier: 5192	1	0
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 4788 thread_handle: 0x000002e4 process_identifier: 9100 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002e8	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002e4	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 9100 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002e8		3221225496
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 7012 thread_handle: 0x000002f0 process_identifier: 8248 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002ec	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002f0	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 8248 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002ec		3221225496
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 6564 thread_handle: 0x000002f8 process_identifier: 5572 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002f4	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x000002f8	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 5572 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002f4		3221225496
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 6456 thread_handle: 0x00000300 process_identifier: 2340 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000002fc	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x00000300	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 2340 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x000002fc		3221225496
CreateProcessInternalW April 22, 2021, 10:50 a.m.	thread_identifier: 5596 thread_handle: 0x00000308 process_identifier: 4900 current_directory: filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe track: 1 command_line: filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe stack_pivoted: 0 creation_flags: 134217732 (CREATE_NO_WINDOW\|CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x00000304	1	1
NtGetContextThread April 22, 2021, 10:50 a.m.	thread_handle: 0x00000308	1	0
NtAllocateVirtualMemory April 22, 2021, 10:50 a.m.	process_identifier: 4900 region_size: 663552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x00000304		3221225496

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All