popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 5, 2021, 9:09 a.m. Nov. 5, 2021, 9:40 a.m.
Size 450.1KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 d06c38d984a2f6e270ff39ece951c090
SHA256 84eac27f595ef84121e7a9a080b863c3a5c611c909293c0a246b6e2479186f4b
CRC32 890E45AB
ssdeep 6144:Q8LxB5CawGWi1ywz6WXNSv5oVmvh4lMHBlq36V6vyH2ylR2YTRDwJ21HxDpD92vu:5Wi1yCDQhU0SuBJ2y326DwM1H/9Fiu
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
www.rapidfreecredit.com
A 162.241.218.178
CNAME rapidfreecredit.com
162.241.218.178
www.zzsline.com
A 172.67.202.198
A 104.21.77.6
172.67.202.198
www.islandrentals.biz
A 199.34.228.77
199.34.228.77
www.antelbd.com
CNAME antelbd.com
A 103.148.14.203
103.148.14.203
www.graylinkelectric.com
www.oprimanumerodos.com
CNAME oprimanumerodos.com
A 34.102.136.180
34.102.136.180
www.iscinet.com
www.drproteaches.com
CNAME drproteaches.com
A 162.241.253.114
162.241.253.114
www.puss888.com
A 104.21.8.56
A 172.67.188.81
104.21.8.56
www.ss5312.com
CNAME sstz963.ss3178.com
A 67.211.65.43
67.211.65.43
www.bestexpecting.com
CNAME shops.myshopify.com
A 23.227.38.74
23.227.38.74
www.officesetupofficesetup.com
A 23.27.138.15
23.27.138.15
www.mrteez.club
www.serestovfleacollar.com
www.attractivereviews.com
A 156.240.151.190
156.240.151.190
www.bailios.com
A 154.23.202.51
CNAME bailios.com
154.23.202.51
www.discsoverylandco.com
A 166.88.19.180
A 68.68.98.160
A 166.88.19.181
166.88.19.180
IP Address Status Action
104.21.79.9 Active Moloch
172.67.196.11 Active Moloch
172.67.207.136 Active Moloch
103.148.14.203 Active Moloch
104.21.8.56 Active Moloch
154.23.202.51 Active Moloch
156.240.151.190 Active Moloch
162.241.218.178 Active Moloch
162.241.253.114 Active Moloch
164.124.101.2 Active Moloch
166.88.19.180 Active Moloch
172.67.202.198 Active Moloch
199.34.228.77 Active Moloch
23.227.38.74 Active Moloch
23.27.138.15 Active Moloch
34.102.136.180 Active Moloch
67.211.65.43 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49170 -> 104.21.8.56:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 104.21.8.56:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 104.21.8.56:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 162.241.218.178:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 162.241.218.178:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 162.241.218.178:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 162.241.253.114:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 162.241.253.114:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49169 -> 162.241.253.114:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 199.34.228.77:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 199.34.228.77:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 23.227.38.74:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49173 -> 199.34.228.77:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 23.227.38.74:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49177 -> 23.227.38.74:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 154.23.202.51:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 172.67.202.198:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 154.23.202.51:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 172.67.202.198:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49171 -> 154.23.202.51:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49179 -> 172.67.202.198:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
UDP 192.168.56.101:58402 -> 164.124.101.2:53 2027863 ET INFO Observed DNS Query to .biz TLD Potentially Bad Traffic
TCP 192.168.56.101:49176 -> 156.240.151.190:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 156.240.151.190:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 156.240.151.190:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 103.148.14.203:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 103.148.14.203:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 103.148.14.203:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 166.88.19.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 166.88.19.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 166.88.19.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 23.27.138.15:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 23.27.138.15:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49175 -> 23.27.138.15:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 34.102.136.180:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 67.211.65.43:80 2031412 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 67.211.65.43:80 2031449 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 67.211.65.43:80 2031453 ET MALWARE FormBook CnC Checkin (GET) Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://www.antelbd.com/p0se/?Upth=9erJsbmg89xRlz0M2UbGQGsoL3knU+btxwpJSlEvKwY//6Ro8ymG4cTM8A9G1IzAegjGNHN5&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.rapidfreecredit.com/p0se/?Upth=EgoGtPvOzMQIHn+MI9K9SlgAXJGJBFkzaqro+xII3Owtt3Khuq48OlyGMf8ozr+N8CoP+XHl&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.drproteaches.com/p0se/?Upth=woR5xm3tnDpzscA506QhcYxpqJNYYUoqwaxL1TBnwACXL4ehmoVy8YHXz+Srph4gv85KcD2/&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.puss888.com/p0se/?Upth=kikFeNiO3Wy3pwtISJcM7/vkxkaOrG97TwCy9kP35exs7OvQFm8ZXay1fTQTva1c0oVEPLTK&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.bailios.com/p0se/?Upth=8oLSLrJeYc+K0ytzOJikqVU0igr6L5hpGSYkGAIomLt8RmfP6w1jUuRWukm53rjVgQXpPW5Y&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.ss5312.com/p0se/?Upth=VXm5Q0G4kF4WmG3lTMiXsUIcZR7Z75QHUAb2U0i9WhY0TVcNQnEKdNZZrn4ryxNGGf72+MNM&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.islandrentals.biz/p0se/?Upth=swsh7jkH3Jayx1oBVzw679OGrX1puxEck2MRsug9EfA8sAUa4DViYtQbxqQy6tgBaEK34XmX&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.oprimanumerodos.com/p0se/?Upth=xlYZ5X0oz3/WSnhnuO8VLYURni7dK5M/z3/1M5B1eWdqmk4yw0hlgYU/AWpZpglM84vVPpwr&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.officesetupofficesetup.com/p0se/?Upth=EYinZUgnnSwJyPV9oEessIoGQkE3PhJa69jO6sH1XRv94op+1srhHlr5FDeZOdoaC0vdviNL&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.attractivereviews.com/p0se/?Upth=ovk/jIrnGvNklwPKoDa/FgXcfy4LLp6cpdBpVVYi4PmHjc59s+hx7TQFj4PK4LVd8vVfURbY&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.bestexpecting.com/p0se/?Upth=aASfAAL76qMqqLN3P5FTu5qU9JswWMTr4/m2v90Be8FVcTL4yVaKxlDSmQkhSQbnDGJjdHVZ&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.discsoverylandco.com/p0se/?Upth=BteP4tPaBKGelLixwpfDlG/9A6mmS+0MA34DaBA3zGLeePe9IT5he11Epx4cASOQEPkGi3lZ&S2Jl9T=JR-Ptri8rrtH
suspicious_features GET method with no useragent header suspicious_request GET http://www.zzsline.com/p0se/?Upth=kthmE/oWyD4fjO8tHH8xHUIk2isBffkb9Kt5y5yO+PwFSvLgMBfFKRyBis2HAYR5aHyddc0l&p0D=AfhHLL9
request GET http://www.antelbd.com/p0se/?Upth=9erJsbmg89xRlz0M2UbGQGsoL3knU+btxwpJSlEvKwY//6Ro8ymG4cTM8A9G1IzAegjGNHN5&S2Jl9T=JR-Ptri8rrtH
request GET http://www.rapidfreecredit.com/p0se/?Upth=EgoGtPvOzMQIHn+MI9K9SlgAXJGJBFkzaqro+xII3Owtt3Khuq48OlyGMf8ozr+N8CoP+XHl&S2Jl9T=JR-Ptri8rrtH
request GET http://www.drproteaches.com/p0se/?Upth=woR5xm3tnDpzscA506QhcYxpqJNYYUoqwaxL1TBnwACXL4ehmoVy8YHXz+Srph4gv85KcD2/&S2Jl9T=JR-Ptri8rrtH
request GET http://www.puss888.com/p0se/?Upth=kikFeNiO3Wy3pwtISJcM7/vkxkaOrG97TwCy9kP35exs7OvQFm8ZXay1fTQTva1c0oVEPLTK&S2Jl9T=JR-Ptri8rrtH
request GET http://www.bailios.com/p0se/?Upth=8oLSLrJeYc+K0ytzOJikqVU0igr6L5hpGSYkGAIomLt8RmfP6w1jUuRWukm53rjVgQXpPW5Y&S2Jl9T=JR-Ptri8rrtH
request GET http://www.ss5312.com/p0se/?Upth=VXm5Q0G4kF4WmG3lTMiXsUIcZR7Z75QHUAb2U0i9WhY0TVcNQnEKdNZZrn4ryxNGGf72+MNM&S2Jl9T=JR-Ptri8rrtH
request GET http://www.islandrentals.biz/p0se/?Upth=swsh7jkH3Jayx1oBVzw679OGrX1puxEck2MRsug9EfA8sAUa4DViYtQbxqQy6tgBaEK34XmX&S2Jl9T=JR-Ptri8rrtH
request GET http://www.oprimanumerodos.com/p0se/?Upth=xlYZ5X0oz3/WSnhnuO8VLYURni7dK5M/z3/1M5B1eWdqmk4yw0hlgYU/AWpZpglM84vVPpwr&S2Jl9T=JR-Ptri8rrtH
request GET http://www.officesetupofficesetup.com/p0se/?Upth=EYinZUgnnSwJyPV9oEessIoGQkE3PhJa69jO6sH1XRv94op+1srhHlr5FDeZOdoaC0vdviNL&S2Jl9T=JR-Ptri8rrtH
request GET http://www.attractivereviews.com/p0se/?Upth=ovk/jIrnGvNklwPKoDa/FgXcfy4LLp6cpdBpVVYi4PmHjc59s+hx7TQFj4PK4LVd8vVfURbY&S2Jl9T=JR-Ptri8rrtH
request GET http://www.bestexpecting.com/p0se/?Upth=aASfAAL76qMqqLN3P5FTu5qU9JswWMTr4/m2v90Be8FVcTL4yVaKxlDSmQkhSQbnDGJjdHVZ&S2Jl9T=JR-Ptri8rrtH
request GET http://www.discsoverylandco.com/p0se/?Upth=BteP4tPaBKGelLixwpfDlG/9A6mmS+0MA34DaBA3zGLeePe9IT5he11Epx4cASOQEPkGi3lZ&S2Jl9T=JR-Ptri8rrtH
request GET http://www.zzsline.com/p0se/?Upth=kthmE/oWyD4fjO8tHH8xHUIk2isBffkb9Kt5y5yO+PwFSvLgMBfFKRyBis2HAYR5aHyddc0l&p0D=AfhHLL9
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2808
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x10015000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2916
region_size: 3158016
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00820000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nszDF74.tmp\airxybggzuu.dll
file C:\Users\test22\AppData\Local\Temp\nszDF74.tmp\airxybggzuu.dll
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
host 104.21.79.9
host 172.67.196.11
host 172.67.207.136
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2916
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000210
1 0 0
Process injection Process 2808 called NtSetContextThread to modify thread in remote process 2916
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000020c
process_identifier: 2916
1 0 0
Bkav W32.AIDetect.malware2
Elastic malicious (high confidence)
MicroWorld-eScan Gen:Variant.Fragtor.37895
FireEye Generic.mg.d06c38d984a2f6e2
Cybereason malicious.984a2f
BitDefenderTheta Gen:NN.ZedlaF.34266.fq4@aKffsYoi
Cyren W32/Injector.AOR.gen!Eldorado
ESET-NOD32 a variant of Win32/Injector.EQLU
APEX Malicious
Kaspersky HEUR:Trojan.Win32.Zapchast.gen
BitDefender Gen:Variant.Fragtor.37895
McAfee-GW-Edition BehavesLike.Win32.Generic.gc
Emsisoft Gen:Variant.Fragtor.37895 (B)
Ikarus Trojan.NSIS.Agent
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Zum.Androm.1
Cynet Malicious (score: 100)
MAX malware (ai score=89)
SentinelOne Static AI - Suspicious PE
Fortinet W32/Injector.EQKA!tr
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2920
thread_handle: 0x0000020c
process_identifier: 2916
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000210
1 1 0

NtGetContextThread

 thread_handle: 0x0000020c
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2916
region_size: 167936
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000210
1 0 0

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4314112
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x0000020c
process_identifier: 2916
1 0 0
dead_host 172.67.207.136:443
dead_host 104.21.79.9:443