popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Oct. 14, 2021, 9:31 a.m. Oct. 14, 2021, 9:34 a.m.
Size 283.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 0031a23b4bb6abcdccc5f8122de5fcb5
SHA256 2ffbb436257f6f348fade42e94df5737ab8b9d9848a220206992c52d917a7b5e
CRC32 CA64E91B
ssdeep 6144:wBlL/c7HU+ICkZsFE03JDT37iHxU1D/RmNOZeXBiFkJTstHJXd0mU:Ce7HUDCysO0dLiWDc8ZHKmHImU
Yara
  • PE_Header_Zero - PE File Signature
  • UPX_Zero - UPX packed file
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • NSIS_Installer - Null Soft Installer

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49171 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 172.67.173.247:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 172.67.173.247:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 172.67.173.247:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49178 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 202.165.66.108:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 202.165.66.108:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 202.165.66.108:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 158.69.52.184:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 158.69.52.184:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 158.69.52.184:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 172.247.0.173:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 172.247.0.173:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 172.247.0.173:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49179 -> 172.247.0.173:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.102:49177 -> 65.21.250.85:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 65.21.250.85:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 65.21.250.85:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 160.119.66.161:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 160.119.66.161:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 160.119.66.161:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 1.32.254.106:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 1.32.254.106:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 1.32.254.106:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.verifiedpaypal.net/mxnu/?xryHsPn0=9Cb2F83H4cu3Wi3E/V06Uw+puzMd5mOCrt6x5BN8Ai+3jQ1IwCanO4QWCELETp3SVj+UiXzw&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.877961.com/mxnu/?xryHsPn0=aHYJt+cF3uKE/jjIR1o9yP3wzE0OqMGB2AjKuxgiPGP7v0vlkCnn7S+a/Vapc30Z99lnekHH&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.brandonhistoryandinfo.com/mxnu/?xryHsPn0=TBa+b5mpCdI4y/h180Pl2gJXBklETz7DPBwfCQzHJDv5/wBYQn0JU1W1LmmZ4xHxKrhvcr9L&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.naplesconciergerealty.com/mxnu/?xryHsPn0=hecv2sMFcvsyFIpzJOhZbtwMh1SG6St5/U1aPglBFWownzq2qPNpvMi/ho6Sg43JWpVw027R&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.jellyice-tr.com/mxnu/?xryHsPn0=2jYCrBsbpe7TX9aPhZM9pCxr75im0gQU84tPJTFdoXWJ8jmtmSvNbVsQgFqr9XIl+R+lpCoE&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.gold2guide.art/mxnu/?xryHsPn0=nooUTxpgyHI8Tmjtx/bEFedfCsCgFivtiLIHJ+Ou+u0gXSqijcRRlL1sEAr9C8C8DV1gd2HK&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.crystaltopagent.net/mxnu/?xryHsPn0=3yd5RwoD26MqTRMAl0ytU+h0AIpWjTpihncvDxCNudFFpkke93ChM56zl8nuLHoRn3erkMWM&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.caoliudh.club/mxnu/?xryHsPn0=Qkn7/cEbGgqrWPKwMfaMuPWUM1V2bBIelD8P7tH5TlwxzYQ2YswrHAKx2cx97b08CLc1Tgr+&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.influxair.com/mxnu/?xryHsPn0=TsJoTwgkypMLnzNnd4lSdIwskag8Ao4FDEHlqFMN0Q3o8pEdXPLUbYsOOSivgNo+I+lTFgxg&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.gatescres.com/mxnu/?xryHsPn0=/h7P8W3KCMqF8sHgbHgxGw3KDEtccpvlr5o0RXreZvWALZ7/fG1Fr8cUEgi4cFDVX1k6R9aW&ElP=dfchOFjpqTo
suspicious_features GET method with no useragent header suspicious_request GET http://www.029atk.xyz/mxnu/?xryHsPn0=6sRgvWVFBb3Q/xwRSmzppKeefWZYMhtu8mXrbS5z1U4Jv8b+WQjv+VljYqCaCxejjINp6HL4&ElP=dfchOFjpqTo
request GET http://www.verifiedpaypal.net/mxnu/?xryHsPn0=9Cb2F83H4cu3Wi3E/V06Uw+puzMd5mOCrt6x5BN8Ai+3jQ1IwCanO4QWCELETp3SVj+UiXzw&ElP=dfchOFjpqTo
request GET http://www.877961.com/mxnu/?xryHsPn0=aHYJt+cF3uKE/jjIR1o9yP3wzE0OqMGB2AjKuxgiPGP7v0vlkCnn7S+a/Vapc30Z99lnekHH&ElP=dfchOFjpqTo
request GET http://www.brandonhistoryandinfo.com/mxnu/?xryHsPn0=TBa+b5mpCdI4y/h180Pl2gJXBklETz7DPBwfCQzHJDv5/wBYQn0JU1W1LmmZ4xHxKrhvcr9L&ElP=dfchOFjpqTo
request GET http://www.naplesconciergerealty.com/mxnu/?xryHsPn0=hecv2sMFcvsyFIpzJOhZbtwMh1SG6St5/U1aPglBFWownzq2qPNpvMi/ho6Sg43JWpVw027R&ElP=dfchOFjpqTo
request GET http://www.jellyice-tr.com/mxnu/?xryHsPn0=2jYCrBsbpe7TX9aPhZM9pCxr75im0gQU84tPJTFdoXWJ8jmtmSvNbVsQgFqr9XIl+R+lpCoE&ElP=dfchOFjpqTo
request GET http://www.gold2guide.art/mxnu/?xryHsPn0=nooUTxpgyHI8Tmjtx/bEFedfCsCgFivtiLIHJ+Ou+u0gXSqijcRRlL1sEAr9C8C8DV1gd2HK&ElP=dfchOFjpqTo
request GET http://www.crystaltopagent.net/mxnu/?xryHsPn0=3yd5RwoD26MqTRMAl0ytU+h0AIpWjTpihncvDxCNudFFpkke93ChM56zl8nuLHoRn3erkMWM&ElP=dfchOFjpqTo
request GET http://www.caoliudh.club/mxnu/?xryHsPn0=Qkn7/cEbGgqrWPKwMfaMuPWUM1V2bBIelD8P7tH5TlwxzYQ2YswrHAKx2cx97b08CLc1Tgr+&ElP=dfchOFjpqTo
request GET http://www.influxair.com/mxnu/?xryHsPn0=TsJoTwgkypMLnzNnd4lSdIwskag8Ao4FDEHlqFMN0Q3o8pEdXPLUbYsOOSivgNo+I+lTFgxg&ElP=dfchOFjpqTo
request GET http://www.gatescres.com/mxnu/?xryHsPn0=/h7P8W3KCMqF8sHgbHgxGw3KDEtccpvlr5o0RXreZvWALZ7/fG1Fr8cUEgi4cFDVX1k6R9aW&ElP=dfchOFjpqTo
request GET http://www.029atk.xyz/mxnu/?xryHsPn0=6sRgvWVFBb3Q/xwRSmzppKeefWZYMhtu8mXrbS5z1U4Jv8b+WQjv+VljYqCaCxejjINp6HL4&ElP=dfchOFjpqTo
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1328
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73542000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2248
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00830000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsp7D86.tmp\dulsmde.dll
file C:\Users\test22\AppData\Local\Temp\nsp7D86.tmp\dulsmde.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2248
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000224
1 0 0
Process injection Process 1328 called NtSetContextThread to modify thread in remote process 2248
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2007957956
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314272
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2248
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.2
FireEye Generic.mg.0031a23b4bb6abcd
McAfee Artemis!0031A23B4BB6
Cylance Unsafe
K7GW Riskware ( 0040eff71 )
ESET-NOD32 a variant of Win32/Injector.EQHM
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Trojan.NSISX.Spy.Gen.2
Emsisoft Trojan.NSISX.Spy.Gen.2 (B)
McAfee-GW-Edition BehavesLike.Win32.ICLoader.dc
Sophos Mal/Generic-R
Ikarus Trojan.NSIS.Agent
Webroot W32.Trojan.Nsisx.Spy
Kingsoft Win32.Troj.Generic_a.a.(kcloud)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Win32.Trojan-Stealer.FormBook.89Y50F
Cynet Malicious (score: 100)
MAX malware (ai score=85)
SentinelOne Static AI - Malicious PE
dead_host 143.244.184.235:80
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 932
thread_handle: 0x00000220
process_identifier: 2248
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000224
1 1 0

NtGetContextThread

 thread_handle: 0x00000220
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2248
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000224
1 0 0

NtSetContextThread

 registers.eip: 2007957956
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314272
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2248
1 0 0