popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS UPX Malicious Library PE File DLL PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 18, 2021, 6:10 p.m. Oct. 18, 2021, 6:12 p.m.
Size 254.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 d5f480d1d4cf7902094668a09856c79a
SHA256 2bba05f9769bd1ae9620ad64421955575bfbdb145e551bedcf55cad61a0819e5
CRC32 3107D03F
ssdeep 6144:wBlL/cHjOU/I7FKWrwIj06jElBuJRHr7jAF0Z5oBb+Mf9O:CeDOU/IpU6jYBuDXOtzf9O
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49217 -> 172.247.0.172:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 172.247.0.172:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 172.247.0.172:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49217 -> 172.247.0.172:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.101:49219 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49219 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 5.79.70.98:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 5.79.70.98:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 5.79.70.98:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 52.58.78.16:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 52.58.78.16:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49209 -> 52.58.78.16:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 208.113.163.16:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 208.113.163.16:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49221 -> 208.113.163.16:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49213 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 108.186.180.79:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 108.186.180.79:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49211 -> 108.186.180.79:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 158.69.52.184:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 158.69.52.184:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49215 -> 158.69.52.184:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 184.168.131.241:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 184.168.131.241:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49225 -> 184.168.131.241:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 192.185.131.238:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 192.185.131.238:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49223 -> 192.185.131.238:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 1.32.254.106:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 1.32.254.106:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 1.32.254.106:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.877961.com/mxnu/?FF=aHYJt+cF3uKE/jjIR1o9yP3wzE0OqMGB2AjKuxgiPGP7v0vlkCnn7S+a/Vapc30Z99lnekHH&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.insightmyhome.com/mxnu/?FF=/jfKiAqxBAHgqOulmGtRlW5n/Sqdafb78dllJBhjnK66Sxf6eS8KxZUn5zSBqfmdUZv1jy8Z&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.digisor.com/mxnu/?FF=UVMBiiaCgBTVCfU1vNNEq08V9m7XAvZZglUNdI143I2X7Zl4GMtYquItbp7SrE/Ljcqvb/Ed&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.desongli.com/mxnu/?FF=hZ80obWBB1Dtx9mJDJ/B6KhSbXm9N4IXZ9kDZpitpQpTEQWdqR+8a/o3g7qjE+O8VqYt5r7Y&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.closetu.com/mxnu/?FF=rJ249TMVQMCwGwXS7eMNhvOWH4SbGXiKs4Vq1JHmstm/5V4DyV8c/XoA/4BgaERVtEbRuzyC&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.verifiedpaypal.net/mxnu/?FF=9Cb2F83H4cu3Wi3E/V06Uw+puzMd5mOCrt6x5BN8Ai+3jQ1IwCanO4QWCELETp3SVj+UiXzw&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.029atk.xyz/mxnu/?FF=6sRgvWVFBb3Q/xwRSmzppKeefWZYMhtu8mXrbS5z1U4Jv8b+WQjv+VljYqCaCxejjINp6HL4&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.naplesconciergerealty.com/mxnu/?FF=hecv2sMFcvsyFIpzJOhZbtwMh1SG6St5/U1aPglBFWownzq2qPNpvMi/ho6Sg43JWpVw027R&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.safebookkeeping.com/mxnu/?FF=Dinuu19hFboSFju1K0HZ6EbcdDMO+ZnQ9sDSjm9DAS1j/pnpew28zT8+4dAfvZHXXiVk+x1O&llsp=fTRHzt4pzn4XCX
suspicious_features GET method with no useragent header suspicious_request GET http://www.procurovariedades.com/mxnu/?FF=e63Yw596e9MjmhIdNsSN67oqb96/kwQ/AvXQ3UsARMy+g2BaAqseTyVnaYCqY6LOFgU8MBS4&llsp=fTRHzt4pzn4XCX
request POST http://www.877961.com/mxnu/
request GET http://www.877961.com/mxnu/?FF=aHYJt+cF3uKE/jjIR1o9yP3wzE0OqMGB2AjKuxgiPGP7v0vlkCnn7S+a/Vapc30Z99lnekHH&llsp=fTRHzt4pzn4XCX
request POST http://www.insightmyhome.com/mxnu/
request GET http://www.insightmyhome.com/mxnu/?FF=/jfKiAqxBAHgqOulmGtRlW5n/Sqdafb78dllJBhjnK66Sxf6eS8KxZUn5zSBqfmdUZv1jy8Z&llsp=fTRHzt4pzn4XCX
request GET http://www.digisor.com/mxnu/?FF=UVMBiiaCgBTVCfU1vNNEq08V9m7XAvZZglUNdI143I2X7Zl4GMtYquItbp7SrE/Ljcqvb/Ed&llsp=fTRHzt4pzn4XCX
request POST http://www.desongli.com/mxnu/
request GET http://www.desongli.com/mxnu/?FF=hZ80obWBB1Dtx9mJDJ/B6KhSbXm9N4IXZ9kDZpitpQpTEQWdqR+8a/o3g7qjE+O8VqYt5r7Y&llsp=fTRHzt4pzn4XCX
request POST http://www.closetu.com/mxnu/
request GET http://www.closetu.com/mxnu/?FF=rJ249TMVQMCwGwXS7eMNhvOWH4SbGXiKs4Vq1JHmstm/5V4DyV8c/XoA/4BgaERVtEbRuzyC&llsp=fTRHzt4pzn4XCX
request POST http://www.verifiedpaypal.net/mxnu/
request GET http://www.verifiedpaypal.net/mxnu/?FF=9Cb2F83H4cu3Wi3E/V06Uw+puzMd5mOCrt6x5BN8Ai+3jQ1IwCanO4QWCELETp3SVj+UiXzw&llsp=fTRHzt4pzn4XCX
request POST http://www.029atk.xyz/mxnu/
request GET http://www.029atk.xyz/mxnu/?FF=6sRgvWVFBb3Q/xwRSmzppKeefWZYMhtu8mXrbS5z1U4Jv8b+WQjv+VljYqCaCxejjINp6HL4&llsp=fTRHzt4pzn4XCX
request POST http://www.naplesconciergerealty.com/mxnu/
request GET http://www.naplesconciergerealty.com/mxnu/?FF=hecv2sMFcvsyFIpzJOhZbtwMh1SG6St5/U1aPglBFWownzq2qPNpvMi/ho6Sg43JWpVw027R&llsp=fTRHzt4pzn4XCX
request POST http://www.safebookkeeping.com/mxnu/
request GET http://www.safebookkeeping.com/mxnu/?FF=Dinuu19hFboSFju1K0HZ6EbcdDMO+ZnQ9sDSjm9DAS1j/pnpew28zT8+4dAfvZHXXiVk+x1O&llsp=fTRHzt4pzn4XCX
request POST http://www.procurovariedades.com/mxnu/
request GET http://www.procurovariedades.com/mxnu/?FF=e63Yw596e9MjmhIdNsSN67oqb96/kwQ/AvXQ3UsARMy+g2BaAqseTyVnaYCqY6LOFgU8MBS4&llsp=fTRHzt4pzn4XCX
request POST http://www.gatescres.com/mxnu/
request POST http://www.877961.com/mxnu/
request POST http://www.insightmyhome.com/mxnu/
request POST http://www.desongli.com/mxnu/
request POST http://www.closetu.com/mxnu/
request POST http://www.verifiedpaypal.net/mxnu/
request POST http://www.029atk.xyz/mxnu/
request POST http://www.naplesconciergerealty.com/mxnu/
request POST http://www.safebookkeeping.com/mxnu/
request POST http://www.procurovariedades.com/mxnu/
request POST http://www.gatescres.com/mxnu/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2088
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x728d2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1756
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00950000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsw6386.tmp\ftzcfimfl.dll
file C:\Users\test22\AppData\Local\Temp\nsw6386.tmp\ftzcfimfl.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 1756
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000224
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.2
FireEye Generic.mg.d5f480d1d4cf7902
McAfee Artemis!D5F480D1D4CF
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
Symantec ML.Attribute.HighConfidence
APEX Malicious
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.NSISX.Spy.Gen.2
Emsisoft Trojan.NSISX.Spy.Gen.2 (B)
McAfee-GW-Edition BehavesLike.Win32.Vopak.dc
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Malicious PE
MAX malware (ai score=85)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Zum.Androm.1
Cynet Malicious (score: 100)
Ikarus Trojan.MSIL.Inject
Process injection Process 2088 called NtSetContextThread to modify thread in remote process 1756
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314272
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 1756
1 0 0
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 1160
thread_handle: 0x00000220
process_identifier: 1756
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000224
1 1 0

NtGetContextThread

 thread_handle: 0x00000220
1 0 0

NtAllocateVirtualMemory

 process_identifier: 1756
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000224
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314272
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 1756
1 0 0