popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Gen1 CryptBot Emotet Formbook Generic Malware NSIS ASPack Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) Antivirus UPX ScreenShot KeyLogger Anti_VM PWS AntiDebug OS Processor Check .NET EXE PE File AntiVM PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Sept. 24, 2021, 9:07 a.m. Sept. 24, 2021, 9:09 a.m.
Size 1.1MB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 8fdf6032932fa1a0c9b0fd342ee8bee1
SHA256 ec0627ef1feef5903f5771bdb6df060a295af132e90ed023f2e1ad14d5ffb40b
CRC32 E83DFEFF
ssdeep 24576:ci+Fo/2+GdtMsZjGSeSz19YaXfFe7SMeBtEFkri:76owdtMsNGSeKteGMeBt62i
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • Is_DotNET_EXE - (no description)
  • Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT
  • IsPE32 - (no description)
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GetComputerNameW

 computer_name: TEST22-PC
1 1 0
Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

WriteConsoleW

 buffer: ERROR:
console_handle: 0x0000000b
1 1 0

WriteConsoleW

 buffer: The system cannot find the file specified.
console_handle: 0x0000000b
1 1 0
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 1572864
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00870000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009b0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2620
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x731a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2620
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x731a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 1507328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00d10000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00e40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00322000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00455000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0045b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00457000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00670000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0032a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00447000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00671000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2620
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70692000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00446000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 327680
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef50000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef58000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 65536
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 1056768 (MEM_RESERVE|MEM_TOP_DOWN)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x7ef40000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00672000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00673000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0092f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00920000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00674000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00675000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00676000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00677000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0067c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b01000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b06000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b07000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b08000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b09000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b0a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b0b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2620
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x04b0c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file C:\Program Files (x86)\G2BRUN\jre7\bin\jqs.exe
file C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file C:\Program Files (x86)\Mozilla Thunderbird\plugin-container.exe
file C:\Program Files (x86)\G2BRUN\jre7\bin\javacpl.exe
file C:\Program Files (x86)\iniLINE\CrossEX\crossex\UnInstallCrossEXLocal.exe
file C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
file C:\Program Files (x86)\Wizvera\Delfino-G3\unins000.exe
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssvagent.exe
file C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
file C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateBroker.exe
file C:\Program Files (x86)\Microsoft Office\Office14\1042\ONELEV.EXE
file C:\Windows\svchost.com
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
file C:\Python27\Scripts\easy_install.exe
file C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE
file C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEPADSV.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE
file C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file C:\Program Files (x86)\7-Zip\7z.exe
file C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\unpack200.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file C:\Program Files (x86)\Wizvera\Common\wpmsvc\unins000.exe
file C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.82\GoogleUpdateSetup.exe
file C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
file C:\Program Files (x86)\EditPlus\editplus.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file C:\MSOCache\All Users\{90140000-006E-0412-0000-0000000FF1CE}-C\dwtrig20.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
file C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE
file C:\Program Files (x86)\Common Files\Adobe\__ARM\1.0\AdobeARM.exe
file C:\Program Files (x86)\Mozilla Thunderbird\minidump-analyzer.exe
file C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file C:\Program Files (x86)\markany\maeps\MaPrtDataUpdater.exe
file C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
file C:\Program Files (x86)\Mozilla Thunderbird\pingsender.exe
file C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler.exe
file C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateCore.exe
file C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE
file C:\util\TCPView\Tcpvcon.exe
file C:\Program Files (x86)\G2BRUN\jre7\bin\java.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WKhqxqLdmqoS" /XML "C:\Users\test22\AppData\Local\Temp\tmp2A31.tmp"
cmdline schtasks.exe /Create /TN "Updates\WKhqxqLdmqoS" /XML "C:\Users\test22\AppData\Local\Temp\tmp2A31.tmp"
file C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\vcredist_x64[1].exe
Time & API Arguments Status Return Repeated

ShellExecuteExW

 show_type: 0
filepath_r: schtasks.exe
parameters: /Create /TN "Updates\WKhqxqLdmqoS" /XML "C:\Users\test22\AppData\Local\Temp\tmp2A31.tmp"
filepath: schtasks.exe
1 1 0
section {u'size_of_data': u'0x000e0c00', u'virtual_address': u'0x00002000', u'entropy': 7.882211321338346, u'name': u'.text', u'virtual_size': u'0x000e0bbc'} entropy 7.88221132134 description A section with a high entropy has been found
entropy 0.828953434763 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
cmdline "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WKhqxqLdmqoS" /XML "C:\Users\test22\AppData\Local\Temp\tmp2A31.tmp"
cmdline schtasks.exe /Create /TN "Updates\WKhqxqLdmqoS" /XML "C:\Users\test22\AppData\Local\Temp\tmp2A31.tmp"
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2512
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000003ac
1 0 0
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) reg_value C:\Windows\svchost.com "%1" %*
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@t@ @„#@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ=@@´F@ÌN@O@ØY@äY@øY@üY@üY@Z@$Z@LZ@PZ@Z@´Z@àZ@ @øà€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿ @ ,Eí͘û¤W€É<AïË½ïW‡Ý{JÖçöJÞ>…@}ü„{댐íêÄþGÌA2ÿœNۂõ¥Ð2ªË+^þÇºãW—Ë µáÙnÊXý±.štÛNóĞt“îâhî„‹À`ˆ²òTø5ýœ‘@@
base_address: 0x00409000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer: XRÜPàS4Q T@QLTPQ€T\QÌTpQ U€QöVôQÄW(R8XLRfR~R–R®RÊRØRèRôRSS&S8SJS\SnS|SŠS–S²S¾SÐSìSþST.T>TZTjTŽTœTªT¸TÚTìTüTU$U.U@UVUfU~UŽUšU²UÂUÖUìUVV&V4VJVZVlVzVŠVœV¨V¶VÆVÔVèVWWW,W:WFWVWbWvWŠW WºWÐWÜWêWøWX XX&XDXTXkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetVersionGetCurrentThreadIdGetThreadLocaleGetStartupInfoAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenkernel32.dllTlsSetValueTlsGetValueLocalAllocGetModuleHandleAadvapi32.dllRegSetValueExARegOpenKeyExARegCloseKeykernel32.dllWriteFileWinExecSetFilePointerSetFileAttributesASetEndOfFileSetCurrentDirectoryAReleaseMutexReadFileGetWindowsDirectoryAGetTempPathAGetShortPathNameAGetModuleFileNameAGetLogicalDriveStringsAGetLocalTimeGetLastErrorGetFileSizeGetFileAttributesAGetDriveTypeAGetCommandLineAFreeLibraryFindNextFileAFindFirstFileAFindCloseDeleteFileACreateMutexACreateFileACreateDirectoryACloseHandlegdi32.dllStretchDIBitsSetDIBitsSelectObjectGetObjectAGetDIBitsDeleteObjectDeleteDCCreateSolidBrushCreateDIBSectionCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSysColorGetIconInfoGetDCFillRectDestroyIconCopyImageCharLowerBuffAshell32.dllShellExecuteAExtractIconA
base_address: 0x00415000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer: `A`A@pA
base_address: 0x00417000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer:  0 000"0*020:0B0J0R0Z0b0j0r0z0‚0Š0’0¾0Æ0Î0Ö0Þ0æ0î0ö0ÿ0 1(11—1ß2V3¥3ë3þ3t4¸4ù4-595T5ç567r77š7¥7­7·7Á7Ë7á7ç7õ7888&8,848F8R8a8m8u8€8†8“8™8³8º8Ä8Î8Ø8ä8ï89999/9:9[9s9’9ª9²9ò9:W:w:•:¿;Ì;ÿ;<<'<0<;<D<K<Z<a<ƒ<Ü<ä<i=‡=Œ=’=þ=>>>b>k>>§>³>»>î>?2?\?e?u?}?ƒ?Œ?“?˜?ž?±?º?Ø?Þ?æ? 00(0@0L0T0k0z0Š0ª0Â0æ0î0ô0ú0,1P1n1~1„1Œ1ñ1ü12 22$2u2|2Œ2–2œ2¤2ª2°2·2Á2h3‘3¯3»3Ã34#4+4O4o4—4°4É4Ú4ï4ü45Ù5…668A8Q8g8…8›8²8Ç899*929H9`9n9¢9¾9Ê9Þ9è9û9+:X:a:“:œ:Ñ:Ø:ú:G;o;·<ß<æ<þ< =T=\=g=“=¨=ó=>>N>R>X>\>a>h>n>v>>>˜>Ä>Ï>ì>ö>?%?/?7?=?K?f?{?…?Š?©?®?³?Õ?é?0 N0W0}0Š0466?6:7C7¡;²;ò;ù; <)<2<><E<Ä< =/=;=B=L=V=m=~=‹=’=–=œ= =¦=­=±=Ë=Ô=Ý=é=ó=>/>@>J>R>Z>b>j>’>¼>Ê>Ï>è>ø> ??&?+?0?7?>?H?_?k?x?Š?—?£?°?Â?È?â?ê?ò?ú?@0 00:0B0J0R0Z0b0j0r0z0‚0Š0’0š0¢0ª0²0º0Â0Ê0Ò0Ú0â0ê0ò0ú01 111"1*121:1B1J1R1Z1b1j1r1z1‚1Š1’1§1³1À1Ò1ß1ë1ø1 22#202B2J2R2_2k2x2Š2—2£2°2Â2Ï2Û2è2ú233 323?3K3X3j3w3ƒ33¢3¯3»3È3Ú3ç3ó3444$4(4,484<4@4L4P4T4`4d4h4t4x4|4ˆ4Œ4•4¡4n5í9Ê:ò:;<Y<‘<Ù<Z=ž=ù=>Ô>ï>?¨?ê?P\ 0b0¸0å0]1¹12I22¸23¸3ü3 4œ4À4é45»5ß5ü5~66_8H9®9,;:;A;H;c;o;Š;˜;Ÿ;¦;Ý;‚<¢<š?¼?Ê?`L0Œ3“3Î4‚5¶6ô:(;=;c;Ø;„<<Â<ç<ó<û<===*=:=Z=ì=>A>v>§>Ã>ý>?K?Œ?º?p˜ 040R0…0«0·0Ä0Ö0å011I1™1²12-2É2_3n34o4Ñ4ß4y5ª5Â5Ö5 6J6Œ6¯6ì67U7w7Ö7u8’8 9_9d9w9°9»9Ò9:.:E:c:z:²:ê:;;e;;­;<<¤<==u=¸=.>c>¤>¾>ñ> ?Æ?ñ?€h030F0X0\0`0d0h0l0p0t0x0|0€0„0ˆ0Œ00”0˜0œ0 0¤0¨0¬0°0´0¸0¼0À0Ä0È0Ì0Ð0Ô0Ø0à0ù011%191M1a11Ë120004080è0ì0ð0ô0ø0ü0111111 1$1(122p000 0
base_address: 0x00418000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2512
process_handle: 0x000003ac
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0
Process injection Process 2620 called NtSetContextThread to modify thread in remote process 2512
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4227300
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000003b4
process_identifier: 2512
1 0 0
Process injection Process 2620 resumed a thread in remote process 2512
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000003b4
suspend_count: 1
process_identifier: 2512
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2620
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2620
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2620
1 0 0

NtResumeThread

 thread_handle: 0x00000264
suspend_count: 1
process_identifier: 2620
1 0 0

NtResumeThread

 thread_handle: 0x000002b4
suspend_count: 1
process_identifier: 2620
1 0 0

CreateProcessInternalW

 thread_identifier: 2320
thread_handle: 0x00000430
process_identifier: 2324
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Windows\System32\schtasks.exe
track: 1
command_line: "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\WKhqxqLdmqoS" /XML "C:\Users\test22\AppData\Local\Temp\tmp2A31.tmp"
filepath_r: C:\Windows\System32\schtasks.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000438
1 1 0

CreateProcessInternalW

 thread_identifier: 2812
thread_handle: 0x000003b4
process_identifier: 2512
current_directory:
filepath: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
track: 1
command_line:
filepath_r: C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x000003ac
1 1 0

NtGetContextThread

 thread_handle: 0x000003b4
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2512
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x000003ac
1 0 0

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@t@ @„#@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ=@@´F@ÌN@O@ØY@äY@øY@üY@üY@Z@$Z@LZ@PZ@Z@´Z@àZ@ @øà€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿ @ ,Eí͘û¤W€É<AïË½ïW‡Ý{JÖçöJÞ>…@}ü„{댐íêÄþGÌA2ÿœNۂõ¥Ð2ªË+^þÇºãW—Ë µáÙnÊXý±.štÛNóĞt“îâhî„‹À`ˆ²òTø5ýœ‘@@
base_address: 0x00409000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer: XRÜPàS4Q T@QLTPQ€T\QÌTpQ U€QöVôQÄW(R8XLRfR~R–R®RÊRØRèRôRSS&S8SJS\SnS|SŠS–S²S¾SÐSìSþST.T>TZTjTŽTœTªT¸TÚTìTüTU$U.U@UVUfU~UŽUšU²UÂUÖUìUVV&V4VJVZVlVzVŠVœV¨V¶VÆVÔVèVWWW,W:WFWVWbWvWŠW WºWÐWÜWêWøWX XX&XDXTXkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetVersionGetCurrentThreadIdGetThreadLocaleGetStartupInfoAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenkernel32.dllTlsSetValueTlsGetValueLocalAllocGetModuleHandleAadvapi32.dllRegSetValueExARegOpenKeyExARegCloseKeykernel32.dllWriteFileWinExecSetFilePointerSetFileAttributesASetEndOfFileSetCurrentDirectoryAReleaseMutexReadFileGetWindowsDirectoryAGetTempPathAGetShortPathNameAGetModuleFileNameAGetLogicalDriveStringsAGetLocalTimeGetLastErrorGetFileSizeGetFileAttributesAGetDriveTypeAGetCommandLineAFreeLibraryFindNextFileAFindFirstFileAFindCloseDeleteFileACreateMutexACreateFileACreateDirectoryACloseHandlegdi32.dllStretchDIBitsSetDIBitsSelectObjectGetObjectAGetDIBitsDeleteObjectDeleteDCCreateSolidBrushCreateDIBSectionCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSysColorGetIconInfoGetDCFillRectDestroyIconCopyImageCharLowerBuffAshell32.dllShellExecuteAExtractIconA
base_address: 0x00415000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer: `A`A@pA
base_address: 0x00417000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer:  0 000"0*020:0B0J0R0Z0b0j0r0z0‚0Š0’0¾0Æ0Î0Ö0Þ0æ0î0ö0ÿ0 1(11—1ß2V3¥3ë3þ3t4¸4ù4-595T5ç567r77š7¥7­7·7Á7Ë7á7ç7õ7888&8,848F8R8a8m8u8€8†8“8™8³8º8Ä8Î8Ø8ä8ï89999/9:9[9s9’9ª9²9ò9:W:w:•:¿;Ì;ÿ;<<'<0<;<D<K<Z<a<ƒ<Ü<ä<i=‡=Œ=’=þ=>>>b>k>>§>³>»>î>?2?\?e?u?}?ƒ?Œ?“?˜?ž?±?º?Ø?Þ?æ? 00(0@0L0T0k0z0Š0ª0Â0æ0î0ô0ú0,1P1n1~1„1Œ1ñ1ü12 22$2u2|2Œ2–2œ2¤2ª2°2·2Á2h3‘3¯3»3Ã34#4+4O4o4—4°4É4Ú4ï4ü45Ù5…668A8Q8g8…8›8²8Ç899*929H9`9n9¢9¾9Ê9Þ9è9û9+:X:a:“:œ:Ñ:Ø:ú:G;o;·<ß<æ<þ< =T=\=g=“=¨=ó=>>N>R>X>\>a>h>n>v>>>˜>Ä>Ï>ì>ö>?%?/?7?=?K?f?{?…?Š?©?®?³?Õ?é?0 N0W0}0Š0466?6:7C7¡;²;ò;ù; <)<2<><E<Ä< =/=;=B=L=V=m=~=‹=’=–=œ= =¦=­=±=Ë=Ô=Ý=é=ó=>/>@>J>R>Z>b>j>’>¼>Ê>Ï>è>ø> ??&?+?0?7?>?H?_?k?x?Š?—?£?°?Â?È?â?ê?ò?ú?@0 00:0B0J0R0Z0b0j0r0z0‚0Š0’0š0¢0ª0²0º0Â0Ê0Ò0Ú0â0ê0ò0ú01 111"1*121:1B1J1R1Z1b1j1r1z1‚1Š1’1§1³1À1Ò1ß1ë1ø1 22#202B2J2R2_2k2x2Š2—2£2°2Â2Ï2Û2è2ú233 323?3K3X3j3w3ƒ33¢3¯3»3È3Ú3ç3ó3444$4(4,484<4@4L4P4T4`4d4h4t4x4|4ˆ4Œ4•4¡4n5í9Ê:ò:;<Y<‘<Ù<Z=ž=ù=>Ô>ï>?¨?ê?P\ 0b0¸0å0]1¹12I22¸23¸3ü3 4œ4À4é45»5ß5ü5~66_8H9®9,;:;A;H;c;o;Š;˜;Ÿ;¦;Ý;‚<¢<š?¼?Ê?`L0Œ3“3Î4‚5¶6ô:(;=;c;Ø;„<<Â<ç<ó<û<===*=:=Z=ì=>A>v>§>Ã>ý>?K?Œ?º?p˜ 040R0…0«0·0Ä0Ö0å011I1™1²12-2É2_3n34o4Ñ4ß4y5ª5Â5Ö5 6J6Œ6¯6ì67U7w7Ö7u8’8 9_9d9w9°9»9Ò9:.:E:c:z:²:ê:;;e;;­;<<¤<==u=¸=.>c>¤>¾>ñ> ?Æ?ñ?€h030F0X0\0`0d0h0l0p0t0x0|0€0„0ˆ0Œ00”0˜0œ0 0¤0¨0¬0°0´0¸0¼0À0Ä0È0Ì0Ð0Ô0Ø0à0ù011%191M1a11Ë120004080è0ì0ð0ô0ø0ü0111111 1$1(122p000 0
base_address: 0x00418000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00419000
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0xfffde008
process_identifier: 2512
process_handle: 0x000003ac
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4227300
registers.ebp: 0
registers.edx: 0
registers.ebx: -139264
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000003b4
process_identifier: 2512
1 0 0

NtResumeThread

 thread_handle: 0x000003b4
suspend_count: 1
process_identifier: 2512
1 0 0

NtResumeThread

 thread_handle: 0x00000424
suspend_count: 1
process_identifier: 2620
1 0 0

CreateProcessInternalW

 thread_identifier: 0
thread_handle: 0x00000000
process_identifier: 0
current_directory: C:\Windows\Microsoft.NET\Framework\v4.0.30319
filepath: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
track: 0
command_line: "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000
0 0
Lionic Trojan.MSIL.Stealer.i!c
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.GenericKD.37609056
FireEye Trojan.GenericKD.37609056
ALYac Trojan.GenericKD.37609056
Cylance Unsafe
CrowdStrike win/malicious_confidence_90% (W)
Alibaba TrojanPSW:MSIL/AgentTesla.10836d70
K7GW Trojan ( 0058297b1 )
K7AntiVirus Trojan ( 0058297b1 )
Cyren W32/MSIL_Kryptik.FPE.gen!Eldorado
Symantec Trojan.Gen.MBT
ESET-NOD32 a variant of MSIL/Kryptik.ACVN
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.MSIL.Stealer.gen
BitDefender Trojan.GenericKD.37609056
Avast Win32:PWSX-gen [Trj]
Tencent Win32.Trojan.Inject.Auto
Ad-Aware Trojan.GenericKD.37609056
DrWeb Trojan.Fbng.68
McAfee-GW-Edition BehavesLike.Win32.Generic.tc
Emsisoft Trojan.Crypt (A)
Ikarus Trojan.MSIL.Inject
Avira TR/Kryptik.zcwaj
Microsoft Trojan:MSIL/AgentTesla.CVB!MTB
GData Trojan.GenericKD.37609056
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win.Generic.C4639711
McAfee PWS-FCZF!8FDF6032932F
MAX malware (ai score=100)
Malwarebytes Trojan.Crypt.MSIL
TrendMicro-HouseCall TROJ_FRS.VSNW15I21
SentinelOne Static AI - Malicious PE
Fortinet MSIL/GenKryptik.FKWI!tr
AVG Win32:PWSX-gen [Trj]
Panda Trj/GdSda.A
MaxSecure Trojan.Malware.300983.susgen