popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

NSIS Malicious Library UPX PE File DLL OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Nov. 7, 2021, 10:14 a.m. Nov. 7, 2021, 10:18 a.m.
Size 344.7KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 43a557dd112a633e87b6536d70154951
SHA256 fb75dd15765be010f34703f7c1da7762a790c69fe7f50017f698381dc21d75ac
CRC32 45444244
ssdeep 6144:wBlL/cd4Y4GBbMssBcrChxmzNp3NnClrAvAQXWWvkSco7XKgLiy:CemnGOsdLNp4nAkScAXKgh
Yara
  • PE_Header_Zero - PE File Signature
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file
  • NSIS_Installer - Null Soft Installer

Name Response Post-Analysis Lookup
ControllerFinallineballinglove33.webredirect.org
A 136.144.41.203
136.144.41.203
IP Address Status Action
136.144.41.203 Active Moloch
164.124.101.2 Active Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x739e2000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2776
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 8192
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74306000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\nsdE35C.tmp\jewt.dll
file C:\Users\test22\AppData\Local\Temp\nsdE35C.tmp\jewt.dll
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2884
region_size: 307200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000214
1 0 0
Process injection Process 2776 manipulating memory of non-child process 2884
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2884
region_size: 307200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000214
1 0 0
Process injection Process 2776 called NtSetContextThread to modify thread in remote process 2884
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4200587
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f4
process_identifier: 2884
1 0 0
dead_host 136.144.41.203:7179
Time & API Arguments Status Return Repeated

CreateProcessInternalW

 thread_identifier: 2888
thread_handle: 0x000001f4
process_identifier: 2884
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line: "C:\Users\test22\AppData\Local\Temp\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x00000214
1 1 0

NtGetContextThread

 thread_handle: 0x000001f4
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2884
region_size: 307200
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x00000214
1 0 0

NtSetContextThread

 registers.eip: 2003108292
registers.esp: 1638384
registers.edi: 0
registers.eax: 4200587
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000001f4
process_identifier: 2884
1 0 0
Lionic Trojan.Win32.Crysan.m!c
Elastic malicious (high confidence)
DrWeb Trojan.Siggen9.56514
MicroWorld-eScan Trojan.GenericKD.47307967
FireEye Generic.mg.43a557dd112a633e
McAfee RDN/Generic BackDoor
Malwarebytes Trojan.Injector
K7AntiVirus Trojan ( 00589c881 )
Alibaba Backdoor:Win32/Lokibot.5cd3edce
K7GW Trojan ( 00589c881 )
CrowdStrike win/malicious_confidence_100% (W)
Arcabit Trojan.Generic.D2D1DCBF
Cyren W32/Injector.AMK.gen!Eldorado
ESET-NOD32 a variant of Win32/Injector.EQKW
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan.Win32.Zapchast.gen
BitDefender Trojan.GenericKD.47307967
Avast Win32:InjectorX-gen [Trj]
Ad-Aware Trojan.GenericKD.47307967
TrendMicro TROJ_GEN.R03FC0DK421
McAfee-GW-Edition BehavesLike.Win32.Vopak.fc
Emsisoft Trojan.GenericKD.47307967 (B)
SentinelOne Static AI - Malicious PE
Webroot W32.Trojan.NSISX.Spy.Gen
Avira TR/Injector.jumws
MAX malware (ai score=82)
Kingsoft Win32.Hack.Undef.(kcloud)
Gridinsoft Ransom.Win32.Sabsik.sa
Microsoft Trojan:Win32/Lokibot.SIS!MTB
GData MSIL.Backdoor.ASyncRAT.2X61S0
Cynet Malicious (score: 100)
VBA32 Trojan.Sabsik.FL
ALYac Trojan.GenericKD.47307967
Cylance Unsafe
Ikarus Trojan.Win32.Injector
Fortinet W32/Injector.EOLV!tr
AVG Win32:InjectorX-gen [Trj]
Cybereason malicious.d112a6
Panda Trj/CI.A