popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Emotet Gen1 NSIS Generic Malware ASPack UPX Malicious Library Malicious Packer Admin Tool (Sysinternals etc ...) PWS Anti_VM OS Processor Check AntiDebug PE File PE32 AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 15, 2021, 9:37 a.m. Oct. 15, 2021, 9:50 a.m.
Size 599.0KB
Type PE32 executable (GUI) Intel 80386, for MS Windows
MD5 da7b4c213039524dd2cd661cb20e62ae
SHA256 7d9a7c06ad6bdf4b58d325900a940f3bf830862d108c8cf58d3d77982b87f8c2
CRC32 F1797E0E
ssdeep 12288:QLWnrFLtuNqdc9aK/EJRyFSBlQpFotwgNvVS:UUNtxdo7GBlLttk
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Suricata Alerts

Flow SID Signature Category
UDP 192.168.56.101:59369 -> 164.124.101.2:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
UDP 192.168.56.101:59369 -> 8.8.8.8:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
TCP 192.168.56.101:49204 -> 23.227.38.74:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 23.227.38.74:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 23.227.38.74:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 52.147.15.202:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 52.147.15.202:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 52.147.15.202:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49329 -> 114.31.52.67:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 121.254.178.253:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49329 -> 114.31.52.67:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 121.254.178.253:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49329 -> 114.31.52.67:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 121.254.178.253:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 66.96.162.137:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 66.96.162.137:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 66.96.162.137:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 198.187.31.100:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 198.187.31.100:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 198.187.31.100:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 88.214.207.96:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 88.214.207.96:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 88.214.207.96:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
suspicious_features GET method with no useragent header suspicious_request GET http://www.willpowerleggings.com/bntn/?jBZ4=O+Z4LQPQMzYbpWLT3n0a9n7LtLYJPcJESV/d+o2qxkdmboFsYtVgbm2hYoZiQsujkqIXV11z&P0D=kFQ0DXAxEZATHl
suspicious_features GET method with no useragent header suspicious_request GET http://www.9veronicaavenue.com/bntn/?jBZ4=kSOzIuOqf33icb7jL3P6+lFIMnyjwDTENnNLAiqlHmACuDUj5PbuHRXtUmX7xoWaH4Ofc9nZ&P0D=kFQ0DXAxEZATHl
suspicious_features GET method with no useragent header suspicious_request GET http://www.paramustowing.com/bntn/?jBZ4=Zmfw4Esej640264nBF8rRgm9yb3Ifbhj/DSE9epy9UGl8RSLepUQfgEIh5a3fktibnFgotl4&P0D=kFQ0DXAxEZATHl
suspicious_features GET method with no useragent header suspicious_request GET http://www.empyrealgrowva.com/bntn/?jBZ4=Au27EvwJrp50AVYHCUDqIIfox0HKUlVAbeEX7KAUxjtVY392IdfHlm/4EUWeS5gsUs7MiyW6&P0D=kFQ0DXAxEZATHl
suspicious_features GET method with no useragent header suspicious_request GET http://www.xn--299akkrtr22f.com/bntn/?jBZ4=kgkGF9Ysfd8zYCE+QJErmgVuQlgymn5hReCN8pGF7TzUt2dFl2/L26qKOsVtiPdmfnb0j80y&P0D=kFQ0DXAxEZATHl
suspicious_features GET method with no useragent header suspicious_request GET http://www.frayahanson.com/bntn/?jBZ4=oFO9RmlSl++/v1YDeSY3mProiyQgi2+hlMkg7b4/PLGp1WpF3yb5DGOQUG8BL3f9IcGrhQt0&P0D=kFQ0DXAxEZATHl
suspicious_features GET method with no useragent header suspicious_request GET http://www.tongtongticket.com/bntn/?jBZ4=ne/6WiBYUUUYQtT3BG3QSc8o6g/z53bI83kA9iocdDFA9OjsJRvH1C2xfRGKXih8pzuXfb+c&P0D=kFQ0DXAxEZATHl
request POST http://www.willpowerleggings.com/bntn/
request GET http://www.willpowerleggings.com/bntn/?jBZ4=O+Z4LQPQMzYbpWLT3n0a9n7LtLYJPcJESV/d+o2qxkdmboFsYtVgbm2hYoZiQsujkqIXV11z&P0D=kFQ0DXAxEZATHl
request POST http://www.9veronicaavenue.com/bntn/
request GET http://www.9veronicaavenue.com/bntn/?jBZ4=kSOzIuOqf33icb7jL3P6+lFIMnyjwDTENnNLAiqlHmACuDUj5PbuHRXtUmX7xoWaH4Ofc9nZ&P0D=kFQ0DXAxEZATHl
request POST http://www.paramustowing.com/bntn/
request GET http://www.paramustowing.com/bntn/?jBZ4=Zmfw4Esej640264nBF8rRgm9yb3Ifbhj/DSE9epy9UGl8RSLepUQfgEIh5a3fktibnFgotl4&P0D=kFQ0DXAxEZATHl
request POST http://www.empyrealgrowva.com/bntn/
request GET http://www.empyrealgrowva.com/bntn/?jBZ4=Au27EvwJrp50AVYHCUDqIIfox0HKUlVAbeEX7KAUxjtVY392IdfHlm/4EUWeS5gsUs7MiyW6&P0D=kFQ0DXAxEZATHl
request POST http://www.xn--299akkrtr22f.com/bntn/
request GET http://www.xn--299akkrtr22f.com/bntn/?jBZ4=kgkGF9Ysfd8zYCE+QJErmgVuQlgymn5hReCN8pGF7TzUt2dFl2/L26qKOsVtiPdmfnb0j80y&P0D=kFQ0DXAxEZATHl
request POST http://www.frayahanson.com/bntn/
request GET http://www.frayahanson.com/bntn/?jBZ4=oFO9RmlSl++/v1YDeSY3mProiyQgi2+hlMkg7b4/PLGp1WpF3yb5DGOQUG8BL3f9IcGrhQt0&P0D=kFQ0DXAxEZATHl
request POST http://www.tongtongticket.com/bntn/
request GET http://www.tongtongticket.com/bntn/?jBZ4=ne/6WiBYUUUYQtT3BG3QSc8o6g/z53bI83kA9iocdDFA9OjsJRvH1C2xfRGKXih8pzuXfb+c&P0D=kFQ0DXAxEZATHl
request POST http://www.willpowerleggings.com/bntn/
request POST http://www.9veronicaavenue.com/bntn/
request POST http://www.paramustowing.com/bntn/
request POST http://www.empyrealgrowva.com/bntn/
request POST http://www.xn--299akkrtr22f.com/bntn/
request POST http://www.frayahanson.com/bntn/
request POST http://www.tongtongticket.com/bntn/
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 458752
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00360000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00390000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72421000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72422000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 1179648
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x008a0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003d2000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00405000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0040b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00407000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ec000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00570000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003da000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003fa000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ea000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 16384
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00571000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2208
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x6e4a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00575000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003ed000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00576000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00577000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057f000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x003f6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1512
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b00000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Program Files (x86)\Microsoft Office\Office12\DSSM.EXE
file C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateCore.exe
file C:\Program Files (x86)\Microsoft Office\Office12\REGFORM.EXE
file C:\Python27\Lib\site-packages\setuptools\cli-32.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ODSERV.EXE
file C:\Python27\Scripts\easy_install.exe
file C:\Program Files (x86)\Microsoft Office\Office12\WINWORD.EXE
file C:\MSOCache\All Users\{90120000-0030-0000-0000-0000000FF1CE}-C\ose.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\w32.exe
file C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file C:\Program Files (x86)\Microsoft Office\Office12\SELFCERT.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\PPTVIEW.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\MSPUB.EXE
file C:\Program Files (x86)\EditPlus\editplus.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\IME14\SHARED\IMEKLMG.EXE
file C:\MSOCache\All Users\{90120000-006E-0412-0000-0000000FF1CE}-C\DW20.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateComRegisterShell64.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateBroker.exe
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleCrashHandler64.exe
file C:\util\TCPView\Tcpvcon.exe
file C:\Program Files (x86)\Google\Chrome\Application\65.0.3325.181\Installer\chrmstp.exe
file C:\Program Files (x86)\Hnc\Common80\HncReporter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\1042\ONELEV.EXE
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
file C:\Program Files (x86)\Hnc\Hwp80\HncPUAConverter.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORE.EXE
file C:\Program Files (x86)\Hnc\HncDic80\HncDic.exe
file C:\Program Files (x86)\Microsoft Office\Office12\MSTORDB.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE12\ACECNFLT.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdate.exe
file C:\Program Files (x86)\Hnc\Hwp80\Hwp.exe
file C:\Program Files (x86)\Hnc\HncUtils\KeyLayout\KeyLayout.exe
file C:\util\dotnet4.5.exe
file C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
file C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\OSE.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\INFOPATH.EXE
file C:\Program Files (x86)\Microsoft Office\Office12\GrooveMigrator.exe
file C:\Program Files (x86)\Hnc\PDF80\x64\HNCE2PPRCONV80.exe
file C:\Program Files (x86)\Hnc\Common80\him\HJIMESV.EXE
file C:\Program Files (x86)\Google\Update\1.3.33.7\GoogleUpdateOnDemand.exe
file C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\OINFOP12.EXE
file C:\Program Files (x86)\Hnc\Common80\OdfConverter.exe
file C:\Program Files (x86)\Common Files\microsoft shared\IME12\SHARED\IMEPADSV.EXE
file C:\Users\test22\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYECVYBT\winamp58_3660_beta_full_en-us[1].exe
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1512
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000248
1 0 0
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) reg_value C:\Windows\svchost.com "%1" %*
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL¸Çß9à  |Ô@@.text¬{| `
base_address: 0x00400000
process_identifier: 1512
process_handle: 0x00000248
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1512
process_handle: 0x00000248
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL¸Çß9à  |Ô@@.text¬{| `
base_address: 0x00400000
process_identifier: 1512
process_handle: 0x00000248
1 1 0
Process injection Process 2208 called NtSetContextThread to modify thread in remote process 1512
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4314256
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000023c
process_identifier: 1512
1 0 0
Process injection Process 2208 resumed a thread in remote process 1512
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x0000023c
suspend_count: 1
process_identifier: 1512
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2384
thread_handle: 0x00000270
process_identifier: 2208
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000278
1 1 0

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2208
1 0 0

NtResumeThread

 thread_handle: 0x00000154
suspend_count: 1
process_identifier: 2208
1 0 0

NtResumeThread

 thread_handle: 0x00000190
suspend_count: 1
process_identifier: 2208
1 0 0

CreateProcessInternalW

 thread_identifier: 1460
thread_handle: 0x0000023c
process_identifier: 1512
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000248
1 1 0

NtGetContextThread

 thread_handle: 0x0000023c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1512
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000248
1 0 0

WriteProcessMemory

 buffer: MZERèXƒè ‹ÈƒÀ<‹ÁƒÀ(ÿᐸº´ Í!¸LÍ!This program cannot be run in DOS mode. $}f?9QH9QH9QH"šúHuQH"šÏH:QH"šÌH8QHRich9QHPEL¸Çß9à  |Ô@@.text¬{| `
base_address: 0x00400000
process_identifier: 1512
process_handle: 0x00000248
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 1512
process_handle: 0x00000248
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 1512
process_handle: 0x00000248
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4314256
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000023c
process_identifier: 1512
1 0 0

NtResumeThread

 thread_handle: 0x0000023c
suspend_count: 1
process_identifier: 1512
1 0 0
Bkav W32.NeshtaB.PE
Lionic Virus.Win32.Neshta.tn9H
Elastic malicious (high confidence)
MicroWorld-eScan Win32.Neshta.A
CAT-QuickHeal W32.Neshta.C8
McAfee W32/HLLP.41472.e
Cylance Unsafe
VIPRE Virus.Win32.Neshta.a (v)
Sangfor Virus.Win32.Neshta.a
K7AntiVirus Virus ( 00556e571 )
K7GW Virus ( 00556e571 )
CrowdStrike win/malicious_confidence_100% (W)
Baidu Win32.Virus.Neshta.a
Cyren W32/Neshta.OBIX-2981
Symantec W32.Neshuta
ESET-NOD32 Win32/Neshta.A
APEX Malicious
Avast Win32:Apanas [Trj]
ClamAV Win.Trojan.Neshuta-1
Kaspersky Virus.Win32.Neshta.a
BitDefender Win32.Neshta.A
NANO-Antivirus Trojan.Win32.Winlock.fmobyw
Rising Win32.Neshta.a (CLASSIC)
Ad-Aware Win32.Neshta.A
Sophos Mal/Generic-R + W32/Neshta-D
Comodo Win32.Neshta.A@3ypg
DrWeb Win32.HLLP.Neshta
TrendMicro PE_NESHTA.A
McAfee-GW-Edition BehavesLike.Win32.HLLP.hc
FireEye Generic.mg.da7b4c213039524d
Emsisoft Win32.Neshta.A (B)
SentinelOne Static AI - Malicious PE
Jiangmin Virus.Neshta.a
eGambit Unsafe.AI_Score_99%
Avira W32/Neshta.A
MAX malware (ai score=85)
Antiy-AVL Trojan/Generic.ASVirus.20D
Kingsoft Win32.Infected.neshta.nl.(kcloud)
Microsoft Virus:Win32/Neshta.A
Gridinsoft Virus.Neshta.A.sd!yf
Arcabit Win32.Neshta.A
ViRobot Win32.Neshta.Gen.A
ZoneAlarm Virus.Win32.Neshta.a
GData Win32.Virus.Neshta.D
Cynet Malicious (score: 100)
AhnLab-V3 Win32/Neshta
Acronis suspicious
BitDefenderTheta AI:FileInfector.D5C3B0640E
ALYac Win32.Neshta.A
TACHYON Virus/W32.Neshta