popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS Malicious Library PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 12, 2021, 9:53 a.m. Oct. 12, 2021, 9:55 a.m.
Size 256.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 41bc8c583d9904897e2b504f127ced23
SHA256 26a7d60148b01f0b2c57abaac977514cbc0d31606ae151f200f0b9c04fdf0ad3
CRC32 03EC1299
ssdeep 6144:F8LxBs0RFwY3VUy7Wvb6XsodOcAjtagLcZChOZYVkKcD:/iFjuEa75LcsOYV0
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49212 -> 208.91.197.91:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 185.53.179.94:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 185.53.179.94:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 208.91.197.91:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 185.53.179.94:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 208.91.197.91:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49222 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 23.227.38.74:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 23.227.38.74:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 23.227.38.74:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 164.138.19.157:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 164.138.19.157:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 164.138.19.157:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 156.234.82.226:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 156.234.82.226:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 118.27.122.218:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 156.234.82.226:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 118.27.122.218:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 118.27.122.218:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 103.148.14.203:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 103.148.14.203:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 103.148.14.203:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 103.148.14.203:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.101:49214 -> 37.123.118.150:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 37.123.118.150:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 37.123.118.150:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 192.64.119.106:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 192.64.119.106:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 192.64.119.106:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 192.64.119.106:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.suvsangebotguenstigdeorg.com/hr8n/?t8o8szU=0uz0Q17Sfx93I9QMDgfv2FcHKGK5h9rfNO4V9s+zrmjnR/7GYJXF1g44bJEkuz64Y6KiX6Qm&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.pochi-owarai.com/hr8n/?t8o8szU=wgLDzEI7JM5HW3UGruAf3rNm8/j8NE+Zr86Wwng2vxqt30foW8WvIulUjY9BDwGT0AcSiOsT&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.sairafashions.xyz/hr8n/?t8o8szU=eY7bowusc/bCtxQMT3E4oiaJBtnJA6QvJzKziTbvMWKe2c93ynfcfmr+9Oy8QuoOqX4wikEz&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.nobadfeelings.com/hr8n/?t8o8szU=Rhzf+PqKp8guEEqt715vcp9c9vM34Bw1qpRpHPEEdxbfYcnS1c6wHcUbaKP1jV8TpqBjAgVO&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.apnagas.com/hr8n/?t8o8szU=pMGdtUWSDrqidj5eJ3dEayK/o6OFfDVrqiV5PnaA2tMYsbhRHtR8TpoDkey3LlwoIKw9ab9x&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.saamcoheir.quest/hr8n/?t8o8szU=R26DTpfzA2VD9hRPflCugFiWJmz76mGRu2xdmjzokLxTboOOz3ynAcRQqISanFjV6lYEFOfd&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.silviomicalikush.xyz/hr8n/?t8o8szU=bYIimKNFWGQLcke9rRfmGD5wqMA0TBEwAa1PZc0t0V99lHADDQgalPgGlfThnmlwNoY2xrcM&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.sadeghzeyni.com/hr8n/?t8o8szU=XNF4wODNdZd564DUbqL8Atnmgl2vzSdsp2HsDocaw8/zJtVtceT5jQqs4TffeumyLKa8kRTb&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.libbybruce.space/hr8n/?t8o8szU=tvOOJymLPTo+u55ddd5JgP/eYwawdK1IFhff86iTT/s0UFVHuQ3vbuf5ifvAKeBftP33/qgK&kPj0Q=K4kP
suspicious_features GET method with no useragent header suspicious_request GET http://www.taschenhimmel.guru/hr8n/?t8o8szU=yJ4GO29XYUJ6kbG1GRGXThACvN8qU+BD3SVuKAwHCyV4JpEO0MjgfQHHB8RtU9GLUJB1g/bU&kPj0Q=K4kP
request POST http://www.suvsangebotguenstigdeorg.com/hr8n/
request GET http://www.suvsangebotguenstigdeorg.com/hr8n/?t8o8szU=0uz0Q17Sfx93I9QMDgfv2FcHKGK5h9rfNO4V9s+zrmjnR/7GYJXF1g44bJEkuz64Y6KiX6Qm&kPj0Q=K4kP
request POST http://www.pochi-owarai.com/hr8n/
request GET http://www.pochi-owarai.com/hr8n/?t8o8szU=wgLDzEI7JM5HW3UGruAf3rNm8/j8NE+Zr86Wwng2vxqt30foW8WvIulUjY9BDwGT0AcSiOsT&kPj0Q=K4kP
request POST http://www.sairafashions.xyz/hr8n/
request GET http://www.sairafashions.xyz/hr8n/?t8o8szU=eY7bowusc/bCtxQMT3E4oiaJBtnJA6QvJzKziTbvMWKe2c93ynfcfmr+9Oy8QuoOqX4wikEz&kPj0Q=K4kP
request POST http://www.nobadfeelings.com/hr8n/
request GET http://www.nobadfeelings.com/hr8n/?t8o8szU=Rhzf+PqKp8guEEqt715vcp9c9vM34Bw1qpRpHPEEdxbfYcnS1c6wHcUbaKP1jV8TpqBjAgVO&kPj0Q=K4kP
request POST http://www.apnagas.com/hr8n/
request GET http://www.apnagas.com/hr8n/?t8o8szU=pMGdtUWSDrqidj5eJ3dEayK/o6OFfDVrqiV5PnaA2tMYsbhRHtR8TpoDkey3LlwoIKw9ab9x&kPj0Q=K4kP
request POST http://www.saamcoheir.quest/hr8n/
request GET http://www.saamcoheir.quest/hr8n/?t8o8szU=R26DTpfzA2VD9hRPflCugFiWJmz76mGRu2xdmjzokLxTboOOz3ynAcRQqISanFjV6lYEFOfd&kPj0Q=K4kP
request POST http://www.silviomicalikush.xyz/hr8n/
request GET http://www.silviomicalikush.xyz/hr8n/?t8o8szU=bYIimKNFWGQLcke9rRfmGD5wqMA0TBEwAa1PZc0t0V99lHADDQgalPgGlfThnmlwNoY2xrcM&kPj0Q=K4kP
request POST http://www.sadeghzeyni.com/hr8n/
request GET http://www.sadeghzeyni.com/hr8n/?t8o8szU=XNF4wODNdZd564DUbqL8Atnmgl2vzSdsp2HsDocaw8/zJtVtceT5jQqs4TffeumyLKa8kRTb&kPj0Q=K4kP
request POST http://www.libbybruce.space/hr8n/
request GET http://www.libbybruce.space/hr8n/?t8o8szU=tvOOJymLPTo+u55ddd5JgP/eYwawdK1IFhff86iTT/s0UFVHuQ3vbuf5ifvAKeBftP33/qgK&kPj0Q=K4kP
request POST http://www.taschenhimmel.guru/hr8n/
request GET http://www.taschenhimmel.guru/hr8n/?t8o8szU=yJ4GO29XYUJ6kbG1GRGXThACvN8qU+BD3SVuKAwHCyV4JpEO0MjgfQHHB8RtU9GLUJB1g/bU&kPj0Q=K4kP
request POST http://www.suvsangebotguenstigdeorg.com/hr8n/
request POST http://www.pochi-owarai.com/hr8n/
request POST http://www.sairafashions.xyz/hr8n/
request POST http://www.nobadfeelings.com/hr8n/
request POST http://www.apnagas.com/hr8n/
request POST http://www.saamcoheir.quest/hr8n/
request POST http://www.silviomicalikush.xyz/hr8n/
request POST http://www.sadeghzeyni.com/hr8n/
request POST http://www.libbybruce.space/hr8n/
request POST http://www.taschenhimmel.guru/hr8n/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1080
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x728d2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsj62DA.tmp\pclcfdo.dll
file C:\Users\test22\AppData\Local\Temp\nsj62DA.tmp\pclcfdo.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000224
1 0 0
Process injection Process 1080 called NtSetContextThread to modify thread in remote process 2208
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314240
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2208
1 0 0
dead_host 192.168.56.101:49203
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2384
thread_handle: 0x00000220
process_identifier: 2208
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000224
1 1 0

NtGetContextThread

 thread_handle: 0x00000220
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000224
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314240
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2208
1 0 0
Bkav W32.AIDetect.malware2
Lionic Trojan.Win32.Generic.4!c
Elastic malicious (high confidence)
DrWeb Trojan.Packed2.43488
MicroWorld-eScan Trojan.NSISX.Spy.Gen.2
FireEye Generic.mg.41bc8c583d990489
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
Alibaba Trojan:Win32/runner.ali1000123
K7GW Riskware ( 0040eff71 )
Arcabit Trojan.NSISX.Spy.Gen.2
BitDefenderTheta Gen:NN.ZedlaF.34170.bu4@aGSIOCki
Cyren W32/Injector.AMS.gen!Eldorado
Symantec ML.Attribute.HighConfidence
ESET-NOD32 a variant of Win32/Injector.EQGP
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.NSISX.Spy.Gen.2
Avast FileRepMalware
Sophos Mal/Generic-R
McAfee-GW-Edition BehavesLike.Win32.AdwareDotDo.dc
Emsisoft Trojan.NSISX.Spy.Gen.2 (B)
Ikarus Win32.Outbreak
Webroot W32.Trojan.Gen
Avira TR/AD.Swotter.ewerw
Kingsoft Win32.Troj.Undef.(kcloud)
Gridinsoft Trojan.Win32.Downloader.sa
Microsoft Trojan:Script/Phonzy.B!ml
ZoneAlarm HEUR:Trojan-Spy.Win32.Noon.gen
GData Trojan.GenericKD.47157295
Cynet Malicious (score: 100)
McAfee RDN/Generic.dx
MAX malware (ai score=81)
Malwarebytes Trojan.Injector
SentinelOne Static AI - Malicious PE
Fortinet W32/Injector.EQFJ!tr
AVG FileRepMalware
Cybereason malicious.83d990