Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Sept. 5, 2021, 8:52 a.m.	Sept. 5, 2021, 8:58 a.m.

Size	272.9KB
Type	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5	`cd6fb772e30b73bae310c242e03bf8ba`
SHA256	`d5c7a93296ccb0dd1d2186107015ee20b14e1e1800a55ae0a5dd2df6e38234d5`
CRC32	`B31BEC4A`
ssdeep	`6144:E9X0G8uH3tWq3zl+knPbhV9xwB5rJAzPaqxG9bwj8:q0LuHoq3zlnDhVAB5Wrav98j8`
Yara	PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE32 - (no description)

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2768
- nkpIlrHsTR.exe "C:\Users\test22\AppData\Local\Temp\FvoqKgDgID\nkpIlrHsTR.exe" "C:\Users\test22\AppData\Local\Temp\VBC.EXE"
  1836
explorer.exe C:\Windows\Explorer.EXE
1848
RegAsm.exe "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
1632

Name	Response	Post-Analysis Lookup
discoveryvipshinjiru2law.ooguy.com	A 91.193.75.238	91.193.75.238

IP Address	Status	Action
164.124.101.2	Active	Moloch
91.193.75.238	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49209 -> 91.193.75.238:56648	2025019	ET MALWARE Possible NanoCore C2 60B	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Queries for the computername (7 events)

Time & API	Arguments	Status	Return
GetComputerNameW Sept. 5, 2021, 8:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 5, 2021, 8:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 5, 2021, 8:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 5, 2021, 8:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 5, 2021, 8:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 5, 2021, 8:53 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Sept. 5, 2021, 8:53 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Sept. 5, 2021, 8:53 a.m.			0	0

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Sept. 5, 2021, 8:52 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.ndata

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

Allocates read-write-execute memory (usually to unpack itself) (50 out of 163 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Sept. 5, 2021, 8:52 a.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 2768 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 2768 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02660000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1836 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02800000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02950000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1836 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02980000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x02990000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x737d2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00680000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00690000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72121000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x720e4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72121000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 8192 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72122000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00722000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00732000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00733000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0077b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00777000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c61000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00734000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00735000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00736000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00940000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 327680 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef60000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef60000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x7ef50000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0076a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00737000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0075a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00757000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0072b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e9e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f91000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x6e9e2000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00756000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00738000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0073a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73701000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00ad0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00941000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00775000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00942000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 1900544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x04d40000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1

Checks whether any human activity is being performed by constantly checking whether the foreground window changed

Queries the disk size which could be used to detect virtual machine with small fixed size or dynamic allocation (1 event)

Time & API	Arguments	Status	Return	Repeated
GetDiskFreeSpaceExW Sept. 5, 2021, 8:46 a.m.	total_number_of_free_bytes: 13727002624 free_bytes_available: 13727002624 root_path: C:\ total_number_of_bytes: 34252779520	1	1	0

Creates executable files on the filesystem (4 events)

file	C:\Users\test22\AppData\Local\Temp\nsz71DE.tmp\coyocucsii.dll
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcSTXENJHc.lnk
file	C:\Users\test22\AppData\Local\Temp\nsx60E6.tmp\coyocucsii.dll
file	C:\Users\test22\AppData\Local\Temp\YJUnVNqlhy\FYtAnHKwuE.vbs

Creates a shortcut to an executable file (2 events)

file	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\lcSTXENJHc.lnk
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcSTXENJHc.lnk

Drops an executable to the user AppData folder (2 events)

file	C:\Users\test22\AppData\Local\Temp\nsx60E6.tmp\coyocucsii.dll
file	C:\Users\test22\AppData\Local\Temp\vbc.exe

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Sept. 5, 2021, 8:53 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Potentially malicious URLs were found in the process memory dump (1 event)

url	http://nsis.sf.net/NSIS_Error

Yara rule detected in process memory (19 events)

description	Communications use DNS	rule	Network_DNS
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep
description	Escalate priviledges	rule	Escalate_priviledges
description	Take ScreenShot	rule	ScreenShot
description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

One or more of the buffers contains an embedded PE file (15 events)

buffer	Buffer with sha1: 9420a2004c14c4a5e31290936a07bd58dcaa15b3
buffer	Buffer with sha1: 636b8187f0cb59d43c9ee1eedf144043941b62d9
buffer	Buffer with sha1: a6768a050af81bc43490e349b5fb2dc91d2252f4
buffer	Buffer with sha1: 4380fb6de89a7776d52214359ce213d24a2239ad
buffer	Buffer with sha1: c19d9db351af75fec019fe76506a455eba7fd168
buffer	Buffer with sha1: c1ef2ca62189121934d1a7944ef1bdc1aa319877
buffer	Buffer with sha1: 063fb8b27c0872c54bff35e2b76d8f522e13f8b4
buffer	Buffer with sha1: 925c5236c59dd8f3efea4b3e091ef735b405a880
buffer	Buffer with sha1: c54e7c5cac5fac68dc564ce64355d948422bf1ce
buffer	Buffer with sha1: 0c6598a0a37eaf12ce188fa66bc6c5db394af8a4
buffer	Buffer with sha1: 874b7c3c97cc5b13b9dd172fec5a54bc1f258005
buffer	Buffer with sha1: b9d30f4906fd38201902ce2735d64e97d274418f
buffer	Buffer with sha1: efa4948abb218e47d809bedd1aff08cfb76d40e1
buffer	Buffer with sha1: 1b68e773e3522fa8edc7cb20d7c7f156b08ec73a
buffer	Buffer with sha1: 874f3caf663265f7dd18fb565d91b7d915031251

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x000001ec	1	0	0

Looks for the Windows Idle Time to determine the uptime (1 event)

Time & API	Arguments	Status	Return	Repeated
NtQuerySystemInformation Sept. 5, 2021, 8:53 a.m.	information_class: 8 (SystemProcessorPerformanceInformation)	1	0	0

A process attempted to delay the analysis task. (1 event)

description

RegAsm.exe tried to sleep 5456686 seconds, actually delayed analysis time by 5456686 seconds

Installs itself for autorun at Windows startup (2 events)

reg_key	HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Host				reg_value	C:\Program Files (x86)\SMTP Host\smtphost.exe
file	C:\Users\test22\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\lcSTXENJHc.lnk

Executes one or more WMI queries (3 events)

wmi	SELECT DisplayName FROM AntiSpywareProduct
wmi	SELECT DisplayName FROM FirewallProduct
wmi	SELECT DisplayName FROM AntiVirusProduct

Manipulates memory of a non-child process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1836 manipulating memory of non-child process 1632
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x000001ec	1	0	0

Potential code injection by writing to the memory of another process (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1836 injected into non-child 1632
WriteProcessMemory Sept. 5, 2021, 8:53 a.m.	buffer: base_address: 0x7efde008 process_identifier: 1632 process_handle: 0x000001ec	1	1	0

File has been identified by 15 AntiVirus engines on VirusTotal as malicious (15 events)

Bkav	W32.AIDetect.malware1
Elastic	malicious (high confidence)
FireEye	Generic.mg.cd6fb772e30b73ba
Cylance	Unsafe
ESET-NOD32	a variant of Win32/GenKryptik.FJXX
Kaspersky	VHO:Trojan.Win32.Scar.gen
McAfee-GW-Edition	BehavesLike.Win32.Dropper.dc
SentinelOne	Static AI - Malicious PE
Sophos	Generic ML PUA (PUA)
APEX	Malicious
Microsoft	Trojan:Win32/Sabsik.FL.B!ml
Cynet	Malicious (score: 100)
VBA32	TScope.Trojan.MSIL
Malwarebytes	Malware.AI.1048382273
Cybereason	malicious.1037bf

Used NtSetContextThread to modify a thread in a remote process indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 1836 called NtSetContextThread to modify thread in remote process 1632
NtSetContextThread Sept. 5, 2021, 8:53 a.m.	registers.eip: 200 registers.esp: 200 registers.edi: 0 registers.eax: 911250 registers.ebp: 200 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001e4 process_identifier: 1632	1	0	0

Creates known RBot files, registry keys and/or mutexes (1 event)

mutex

Global\{3fe77eab-32ab-4bb1-8b02-0ebd7c384dad}

Resumed a suspended thread in a remote process potentially indicative of process injection (4 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2768 resumed a thread in remote process 1836
Process injection	Process 1836 resumed a thread in remote process 1632
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x0000037c suspend_count: 1 process_identifier: 1836	1	0	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000001e4 suspend_count: 1 process_identifier: 1632	1	0	0

Executed a process and injected code into it, probably while unpacking (22 events)

Time & API	Arguments	Status	Return
CreateProcessInternalW Sept. 5, 2021, 8:53 a.m.	thread_identifier: 3016 thread_handle: 0x0000037c process_identifier: 1836 current_directory: C:\Users\test22\AppData\Local\Temp filepath: C:\Users\test22\AppData\Local\Temp\FvoqKgDgID\nkpIlrHsTR.exe track: 1 command_line: "C:\Users\test22\AppData\Local\Temp\FvoqKgDgID\nkpIlrHsTR.exe" "C:\Users\test22\AppData\Local\Temp\VBC.EXE" filepath_r: C:\Users\test22\AppData\Local\Temp\FvoqKgDgID\nkpIlrHsTR.exe stack_pivoted: 0 creation_flags: 67634196 (CREATE_DEFAULT_ERROR_MODE\|CREATE_NEW_CONSOLE\|CREATE_SUSPENDED\|CREATE_UNICODE_ENVIRONMENT\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x00000384	1	1
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x0000037c suspend_count: 1 process_identifier: 1836	1	0
CreateProcessInternalW Sept. 5, 2021, 8:53 a.m.	thread_identifier: 2112 thread_handle: 0x000001e4 process_identifier: 1632 current_directory: filepath: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe stack_pivoted: 0 creation_flags: 524292 (CREATE_SUSPENDED\|EXTENDED_STARTUPINFO_PRESENT) inherit_handles: 0 process_handle: 0x000001ec	1	1
NtAllocateVirtualMemory Sept. 5, 2021, 8:53 a.m.	process_identifier: 1632 region_size: 229376 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000c0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0x000001ec	1	0
WriteProcessMemory Sept. 5, 2021, 8:53 a.m.	buffer: base_address: 0x000c0000 process_identifier: 1632 process_handle: 0x000001ec	1	1
WriteProcessMemory Sept. 5, 2021, 8:53 a.m.	buffer: base_address: 0x7efde008 process_identifier: 1632 process_handle: 0x000001ec	1	1
NtGetContextThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000001e4	1	0
NtSetContextThread Sept. 5, 2021, 8:53 a.m.	registers.eip: 200 registers.esp: 200 registers.edi: 0 registers.eax: 911250 registers.ebp: 200 registers.edx: 0 registers.ebx: 2130567168 registers.esi: 0 registers.ecx: 0 thread_handle: 0x000001e4 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000001e4 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x00000168 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000001cc suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x00000290 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000002c4 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000002e8 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x00000394 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000003a8 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000003d4 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x00000378 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x00000480 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:53 a.m.	thread_handle: 0x000003b0 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:54 a.m.	thread_handle: 0x00000498 suspend_count: 1 process_identifier: 1632	1	0
NtResumeThread Sept. 5, 2021, 8:54 a.m.	thread_handle: 0x000004a4 suspend_count: 1 process_identifier: 1632	1	0

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All