popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Gen1 NPKI CryptBot Emotet Formbook Generic Malware NSIS ASPack Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) Antivirus UPX ScreenShot KeyLogger Anti_VM PWS AntiDebug .NET EXE PE File AntiVM PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 8, 2021, 4:49 p.m. Oct. 8, 2021, 4:51 p.m.
Size 1009.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 13a1c548abf86e0c908fdeca6fb315fe
SHA256 42b3efec41088a0afd2cc17e038169dd572baa116aa734a427012d39917f4107
CRC32 76E10EA3
ssdeep 12288:Sj+EyyHi+EchqKT/VfEFI2Y7HuRAeTCJbUEiOsrxDyL9pD3P:O+1ai+6KT/FE22YSGwililrx+L7Df
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • NPKI_Zero - File included NPKI

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 589824
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00570000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2100
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x731a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2100
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x731a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 1245184
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00910000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a00000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00412000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00445000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0044b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00447000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0041a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00437000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006a1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2100
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x70822000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00436000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006a2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006a3000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0043b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006a4000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0042d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006a5000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006a6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ac000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ad000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006ae000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2100
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x006af000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file C:\Program Files (x86)\G2BRUN\jre7\bin\jqs.exe
file C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file C:\Program Files (x86)\Mozilla Thunderbird\plugin-container.exe
file C:\Program Files (x86)\G2BRUN\jre7\bin\javacpl.exe
file C:\Program Files (x86)\iniLINE\CrossEX\crossex\UnInstallCrossEXLocal.exe
file C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
file C:\Program Files (x86)\Wizvera\Delfino-G3\unins000.exe
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssvagent.exe
file C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
file C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateBroker.exe
file C:\Program Files (x86)\Microsoft Office\Office14\1042\ONELEV.EXE
file C:\Windows\svchost.com
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
file C:\Python27\Scripts\easy_install.exe
file C:\Program Files (x86)\Microsoft Office\Office14\VPREVIEW.EXE
file C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEPADSV.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\LICLUA.EXE
file C:\Program Files (x86)\Microsoft Office\Office14\GROOVEMN.EXE
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file C:\Program Files (x86)\7-Zip\7z.exe
file C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\unpack200.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file C:\Program Files (x86)\Wizvera\Common\wpmsvc\unins000.exe
file C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.82\GoogleUpdateSetup.exe
file C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE
file C:\Program Files (x86)\EditPlus\editplus.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file C:\MSOCache\All Users\{90140000-006E-0412-0000-0000000FF1CE}-C\dwtrig20.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
file C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE
file C:\Program Files (x86)\Common Files\Adobe\__ARM\1.0\AdobeARM.exe
file C:\Program Files (x86)\Mozilla Thunderbird\minidump-analyzer.exe
file C:\Program Files (x86)\Microsoft Office\Office14\MSTORE.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file C:\Program Files (x86)\markany\maeps\MaPrtDataUpdater.exe
file C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\setup.exe
file C:\Program Files (x86)\Mozilla Thunderbird\pingsender.exe
file C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleCrashHandler.exe
file C:\Program Files (x86)\Google\Update\1.3.36.82\GoogleUpdateCore.exe
file C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE
file C:\util\TCPView\Tcpvcon.exe
file C:\Program Files (x86)\G2BRUN\jre7\bin\java.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\FLTLDR.EXE
file C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\VKMIWH9C\vcredist_x64[1].exe
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000328
1 0 0
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) reg_value C:\Windows\svchost.com "%1" %*
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@t@ @„#@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ=@@´F@ÌN@O@ØY@äY@øY@üY@üY@Z@$Z@LZ@PZ@Z@´Z@àZ@ @øà€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿ @ ,Eí͘û¤W€É<AïË½ïW‡Ý{JÖçöJÞ>…@}ü„{댐íêÄþGÌA2ÿœNۂõ¥Ð2ªË+^þÇºãW—Ë µáÙnÊXý±.štÛNóĞt“îâhî„‹À`ˆ²òTø5ýœ‘@@
base_address: 0x00409000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer: XRÜPàS4Q T@QLTPQ€T\QÌTpQ U€QöVôQÄW(R8XLRfR~R–R®RÊRØRèRôRSS&S8SJS\SnS|SŠS–S²S¾SÐSìSþST.T>TZTjTŽTœTªT¸TÚTìTüTU$U.U@UVUfU~UŽUšU²UÂUÖUìUVV&V4VJVZVlVzVŠVœV¨V¶VÆVÔVèVWWW,W:WFWVWbWvWŠW WºWÐWÜWêWøWX XX&XDXTXkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetVersionGetCurrentThreadIdGetThreadLocaleGetStartupInfoAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenkernel32.dllTlsSetValueTlsGetValueLocalAllocGetModuleHandleAadvapi32.dllRegSetValueExARegOpenKeyExARegCloseKeykernel32.dllWriteFileWinExecSetFilePointerSetFileAttributesASetEndOfFileSetCurrentDirectoryAReleaseMutexReadFileGetWindowsDirectoryAGetTempPathAGetShortPathNameAGetModuleFileNameAGetLogicalDriveStringsAGetLocalTimeGetLastErrorGetFileSizeGetFileAttributesAGetDriveTypeAGetCommandLineAFreeLibraryFindNextFileAFindFirstFileAFindCloseDeleteFileACreateMutexACreateFileACreateDirectoryACloseHandlegdi32.dllStretchDIBitsSetDIBitsSelectObjectGetObjectAGetDIBitsDeleteObjectDeleteDCCreateSolidBrushCreateDIBSectionCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSysColorGetIconInfoGetDCFillRectDestroyIconCopyImageCharLowerBuffAshell32.dllShellExecuteAExtractIconA
base_address: 0x00415000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer: `A`A@pA
base_address: 0x00417000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer:  0 000"0*020:0B0J0R0Z0b0j0r0z0‚0Š0’0¾0Æ0Î0Ö0Þ0æ0î0ö0ÿ0 1(11—1ß2V3¥3ë3þ3t4¸4ù4-595T5ç567r77š7¥7­7·7Á7Ë7á7ç7õ7888&8,848F8R8a8m8u8€8†8“8™8³8º8Ä8Î8Ø8ä8ï89999/9:9[9s9’9ª9²9ò9:W:w:•:¿;Ì;ÿ;<<'<0<;<D<K<Z<a<ƒ<Ü<ä<i=‡=Œ=’=þ=>>>b>k>>§>³>»>î>?2?\?e?u?}?ƒ?Œ?“?˜?ž?±?º?Ø?Þ?æ? 00(0@0L0T0k0z0Š0ª0Â0æ0î0ô0ú0,1P1n1~1„1Œ1ñ1ü12 22$2u2|2Œ2–2œ2¤2ª2°2·2Á2h3‘3¯3»3Ã34#4+4O4o4—4°4É4Ú4ï4ü45Ù5…668A8Q8g8…8›8²8Ç899*929H9`9n9¢9¾9Ê9Þ9è9û9+:X:a:“:œ:Ñ:Ø:ú:G;o;·<ß<æ<þ< =T=\=g=“=¨=ó=>>N>R>X>\>a>h>n>v>>>˜>Ä>Ï>ì>ö>?%?/?7?=?K?f?{?…?Š?©?®?³?Õ?é?0 N0W0}0Š0466?6:7C7¡;²;ò;ù; <)<2<><E<Ä< =/=;=B=L=V=m=~=‹=’=–=œ= =¦=­=±=Ë=Ô=Ý=é=ó=>/>@>J>R>Z>b>j>’>¼>Ê>Ï>è>ø> ??&?+?0?7?>?H?_?k?x?Š?—?£?°?Â?È?â?ê?ò?ú?@0 00:0B0J0R0Z0b0j0r0z0‚0Š0’0š0¢0ª0²0º0Â0Ê0Ò0Ú0â0ê0ò0ú01 111"1*121:1B1J1R1Z1b1j1r1z1‚1Š1’1§1³1À1Ò1ß1ë1ø1 22#202B2J2R2_2k2x2Š2—2£2°2Â2Ï2Û2è2ú233 323?3K3X3j3w3ƒ33¢3¯3»3È3Ú3ç3ó3444$4(4,484<4@4L4P4T4`4d4h4t4x4|4ˆ4Œ4•4¡4n5í9Ê:ò:;<Y<‘<Ù<Z=ž=ù=>Ô>ï>?¨?ê?P\ 0b0¸0å0]1¹12I22¸23¸3ü3 4œ4À4é45»5ß5ü5~66_8H9®9,;:;A;H;c;o;Š;˜;Ÿ;¦;Ý;‚<¢<š?¼?Ê?`L0Œ3“3Î4‚5¶6ô:(;=;c;Ø;„<<Â<ç<ó<û<===*=:=Z=ì=>A>v>§>Ã>ý>?K?Œ?º?p˜ 040R0…0«0·0Ä0Ö0å011I1™1²12-2É2_3n34o4Ñ4ß4y5ª5Â5Ö5 6J6Œ6¯6ì67U7w7Ö7u8’8 9_9d9w9°9»9Ò9:.:E:c:z:²:ê:;;e;;­;<<¤<==u=¸=.>c>¤>¾>ñ> ?Æ?ñ?€h030F0X0\0`0d0h0l0p0t0x0|0€0„0ˆ0Œ00”0˜0œ0 0¤0¨0¬0°0´0¸0¼0À0Ä0È0Ì0Ð0Ô0Ø0à0ù011%191M1a11Ë120004080è0ì0ð0ô0ø0ü0111111 1$1(122p000 0
base_address: 0x00418000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2256
process_handle: 0x00000328
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2256
process_handle: 0x00000328
1 1 0
Elastic malicious (high confidence)
DrWeb Trojan.PackedNET.964
Cybereason malicious.3906cf
Cyren W32/MSIL_Troj.BOI.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/Kryptik.ADBG
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
McAfee-GW-Edition BehavesLike.Win32.Fareit.fm
Kingsoft Win32.PSWTroj.Undef.(kcloud)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
ZoneAlarm HEUR:Trojan-PSW.MSIL.Agensla.gen
GData Win32.Trojan-Stealer.FormBook.HSNWEH
Cylance Unsafe
Yandex Trojan.AvsArher.bTJEKx
Fortinet MSIL/GenKryptik.FLPG!tr
Process injection Process 2100 called NtSetContextThread to modify thread in remote process 2256
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4227300
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000340
process_identifier: 2256
1 0 0
Process injection Process 2100 resumed a thread in remote process 2256
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000340
suspend_count: 1
process_identifier: 2256
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2100
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2100
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 2100
1 0 0

CreateProcessInternalW

 thread_identifier: 2312
thread_handle: 0x00000340
process_identifier: 2256
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000328
1 1 0

NtGetContextThread

 thread_handle: 0x00000340
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2256
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000328
1 0 0

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*䀐@°@Pd€ÌpCODE,rt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@t@ @„#@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ=@@´F@ÌN@O@ØY@äY@øY@üY@üY@Z@$Z@LZ@PZ@Z@´Z@àZ@ @øà€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿ @ ,Eí͘û¤W€É<AïË½ïW‡Ý{JÖçöJÞ>…@}ü„{댐íêÄþGÌA2ÿœNۂõ¥Ð2ªË+^þÇºãW—Ë µáÙnÊXý±.štÛNóĞt“îâhî„‹À`ˆ²òTø5ýœ‘@@
base_address: 0x00409000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer: XRÜPàS4Q T@QLTPQ€T\QÌTpQ U€QöVôQÄW(R8XLRfR~R–R®RÊRØRèRôRSS&S8SJS\SnS|SŠS–S²S¾SÐSìSþST.T>TZTjTŽTœTªT¸TÚTìTüTU$U.U@UVUfU~UŽUšU²UÂUÖUìUVV&V4VJVZVlVzVŠVœV¨V¶VÆVÔVèVWWW,W:WFWVWbWvWŠW WºWÐWÜWêWøWX XX&XDXTXkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetVersionGetCurrentThreadIdGetThreadLocaleGetStartupInfoAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenkernel32.dllTlsSetValueTlsGetValueLocalAllocGetModuleHandleAadvapi32.dllRegSetValueExARegOpenKeyExARegCloseKeykernel32.dllWriteFileWinExecSetFilePointerSetFileAttributesASetEndOfFileSetCurrentDirectoryAReleaseMutexReadFileGetWindowsDirectoryAGetTempPathAGetShortPathNameAGetModuleFileNameAGetLogicalDriveStringsAGetLocalTimeGetLastErrorGetFileSizeGetFileAttributesAGetDriveTypeAGetCommandLineAFreeLibraryFindNextFileAFindFirstFileAFindCloseDeleteFileACreateMutexACreateFileACreateDirectoryACloseHandlegdi32.dllStretchDIBitsSetDIBitsSelectObjectGetObjectAGetDIBitsDeleteObjectDeleteDCCreateSolidBrushCreateDIBSectionCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSysColorGetIconInfoGetDCFillRectDestroyIconCopyImageCharLowerBuffAshell32.dllShellExecuteAExtractIconA
base_address: 0x00415000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer: `A`A@pA
base_address: 0x00417000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer:  0 000"0*020:0B0J0R0Z0b0j0r0z0‚0Š0’0¾0Æ0Î0Ö0Þ0æ0î0ö0ÿ0 1(11—1ß2V3¥3ë3þ3t4¸4ù4-595T5ç567r77š7¥7­7·7Á7Ë7á7ç7õ7888&8,848F8R8a8m8u8€8†8“8™8³8º8Ä8Î8Ø8ä8ï89999/9:9[9s9’9ª9²9ò9:W:w:•:¿;Ì;ÿ;<<'<0<;<D<K<Z<a<ƒ<Ü<ä<i=‡=Œ=’=þ=>>>b>k>>§>³>»>î>?2?\?e?u?}?ƒ?Œ?“?˜?ž?±?º?Ø?Þ?æ? 00(0@0L0T0k0z0Š0ª0Â0æ0î0ô0ú0,1P1n1~1„1Œ1ñ1ü12 22$2u2|2Œ2–2œ2¤2ª2°2·2Á2h3‘3¯3»3Ã34#4+4O4o4—4°4É4Ú4ï4ü45Ù5…668A8Q8g8…8›8²8Ç899*929H9`9n9¢9¾9Ê9Þ9è9û9+:X:a:“:œ:Ñ:Ø:ú:G;o;·<ß<æ<þ< =T=\=g=“=¨=ó=>>N>R>X>\>a>h>n>v>>>˜>Ä>Ï>ì>ö>?%?/?7?=?K?f?{?…?Š?©?®?³?Õ?é?0 N0W0}0Š0466?6:7C7¡;²;ò;ù; <)<2<><E<Ä< =/=;=B=L=V=m=~=‹=’=–=œ= =¦=­=±=Ë=Ô=Ý=é=ó=>/>@>J>R>Z>b>j>’>¼>Ê>Ï>è>ø> ??&?+?0?7?>?H?_?k?x?Š?—?£?°?Â?È?â?ê?ò?ú?@0 00:0B0J0R0Z0b0j0r0z0‚0Š0’0š0¢0ª0²0º0Â0Ê0Ò0Ú0â0ê0ò0ú01 111"1*121:1B1J1R1Z1b1j1r1z1‚1Š1’1§1³1À1Ò1ß1ë1ø1 22#202B2J2R2_2k2x2Š2—2£2°2Â2Ï2Û2è2ú233 323?3K3X3j3w3ƒ33¢3¯3»3È3Ú3ç3ó3444$4(4,484<4@4L4P4T4`4d4h4t4x4|4ˆ4Œ4•4¡4n5í9Ê:ò:;<Y<‘<Ù<Z=ž=ù=>Ô>ï>?¨?ê?P\ 0b0¸0å0]1¹12I22¸23¸3ü3 4œ4À4é45»5ß5ü5~66_8H9®9,;:;A;H;c;o;Š;˜;Ÿ;¦;Ý;‚<¢<š?¼?Ê?`L0Œ3“3Î4‚5¶6ô:(;=;c;Ø;„<<Â<ç<ó<û<===*=:=Z=ì=>A>v>§>Ã>ý>?K?Œ?º?p˜ 040R0…0«0·0Ä0Ö0å011I1™1²12-2É2_3n34o4Ñ4ß4y5ª5Â5Ö5 6J6Œ6¯6ì67U7w7Ö7u8’8 9_9d9w9°9»9Ò9:.:E:c:z:²:ê:;;e;;­;<<¤<==u=¸=.>c>¤>¾>ñ> ?Æ?ñ?€h030F0X0\0`0d0h0l0p0t0x0|0€0„0ˆ0Œ00”0˜0œ0 0¤0¨0¬0°0´0¸0¼0À0Ä0È0Ì0Ð0Ô0Ø0à0ù011%191M1a11Ë120004080è0ì0ð0ô0ø0ü0111111 1$1(122p000 0
base_address: 0x00418000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00419000
process_identifier: 2256
process_handle: 0x00000328
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2256
process_handle: 0x00000328
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4227300
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000340
process_identifier: 2256
1 0 0

NtResumeThread

 thread_handle: 0x00000340
suspend_count: 1
process_identifier: 2256
1 0 0

CreateProcessInternalW

 thread_identifier: 0
thread_handle: 0x00000000
process_identifier: 0
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
track: 0
command_line: "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000
0 0