popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Emotet Gen1 Formbook NSIS Generic Malware ASPack Malicious Library Antivirus UPX Malicious Packer Admin Tool (Sysinternals etc ...) PWS ScreenShot KeyLogger Anti_VM AntiDebug OS Processor Check PE32 PE File .NET EXE AntiVM
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Nov. 18, 2021, 1:51 p.m. Nov. 18, 2021, 1:58 p.m.
Size 900.0KB
Type PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5 186ee2b0fbae609d44351da0241dd0ec
SHA256 6315729f81fe55e4121e212fe2fb769e9cfbfba2178df45be066d5921817e371
CRC32 99B9D13E
ssdeep 12288:48vQUhCcfZ/2Yp4zwJKagxpNvSTxOuywiQaq6c0dDINS2zG9+aw9cNq0p2W:mk/2Yp4UJKagxLSgjQT6ldDINjZqN
Yara
  • PE_Header_Zero - PE File Signature
  • Generic_Malware_Zero - Generic Malware
  • IsPE32 - (no description)
  • Is_DotNET_EXE - (no description)
  • UPX_Zero - UPX packed file
  • Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
file C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 720896
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x004b0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00520000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73971000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2304
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73972000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 393216
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005c0000
allocation_type: 8192 (MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x005e0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00512000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00595000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0059b000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00597000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057c000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02190000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0051a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0058a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00587000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057a000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00586000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 24576
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02191000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02197000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0057d000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02198000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x02199000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x0219e000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d0000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 20480
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d1000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d6000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d7000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d8000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2304
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 1
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x054d9000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
file C:\Program Files (x86)\Mozilla Thunderbird\pingsender.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\OLicenseHeartbeat.exe
file C:\Program Files (x86)\Hnc\HncUtils\HncUpdate.exe
file C:\Program Files (x86)\Microsoft Office\Office15\ACCICONS.EXE
file C:\Program Files (x86)\Mozilla Thunderbird\plugin-container.exe
file C:\Program Files (x86)\Microsoft Office\Office15\PDFREFLOW.EXE
file C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR Application Installer.exe
file C:\Program Files (x86)\Microsoft Office\Office15\WORDICON.EXE
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\javaw.exe
file C:\Program Files (x86)\Google\Update\1.3.36.101\GoogleUpdate.exe
file C:\Program Files (x86)\Microsoft Office\Office15\GROOVE.EXE
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\ssvagent.exe
file C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
file C:\Program Files (x86)\Google\Update\1.3.36.101\GoogleUpdateBroker.exe
file C:\Windows\svchost.com
file C:\Python27\Scripts\easy_install.exe
file C:\MSOCache\All Users\{91150000-0011-0000-0000-0000000FF1CE}-C\ose.exe
file C:\ProgramData\Oracle\Java\javapath\java.exe
file C:\Program Files (x86)\Google\Update\Download\{430FD4D0-B729-4F61-AA34-91526481799D}\1.3.36.102\GoogleUpdateSetup.exe
file C:\Program Files (x86)\Microsoft Office\Office15\CNFNOT32.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\MSOICONS.EXE
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\Office Setup Controller\ODeploy.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\LICLUA.EXE
file C:\Program Files (x86)\Google\Update\1.3.36.101\GoogleCrashHandler64.exe
file C:\Program Files (x86)\Hnc\Common80\HimTrayIcon.exe
file C:\Program Files (x86)\Java\jre1.8.0_131\bin\unpack200.exe
file C:\Program Files (x86)\Microsoft Office\Office15\POWERPNT.EXE
file C:\Program Files (x86)\Hnc\Hwp80\HwpFinder.exe
file C:\Program Files (x86)\Hnc\HncUtils\HncInfo.exe
file C:\Program Files (x86)\EditPlus\editplus.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\CSISYNCCLIENT.EXE
file C:\Program Files (x86)\Microsoft Office\Office15\DCF\DATABASECOMPARE.EXE
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t64.exe
file C:\MSOCache\All Users\{91150000-0011-0000-0000-0000000FF1CE}-C\setup.exe
file C:\Program Files (x86)\Hnc\Hwp80\HwpPrnMng.exe
file C:\Python27\Lib\site-packages\pip\_vendor\distlib\t32.exe
file C:\Program Files (x86)\Google\Chrome\Application\chrome_proxy.exe
file C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\FLTLDR.EXE
file C:\Program Files (x86)\Common Files\Adobe\__ARM\1.0\AdobeARM.exe
file C:\Program Files (x86)\Mozilla Thunderbird\minidump-analyzer.exe
file C:\Program Files (x86)\Google\Update\Install\{9946EF02-26CF-4F0D-BC28-8677420F30DD}\GoogleUpdateSetup.exe
file C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\110\SQLDumper.exe
file C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.EXE
file C:\Program Files (x86)\Mozilla Thunderbird\crashreporter.exe
file C:\Program Files (x86)\Microsoft Office\Office15\OcPubMgr.exe
file C:\Program Files (x86)\Microsoft Office\Office15\misc.exe
file C:\Program Files (x86)\Common Files\microsoft shared\OFFICE15\Office Setup Controller\Setup.exe
file C:\Program Files (x86)\Microsoft Office\Office15\SETLANG.EXE
file C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\recovery\101.3.34.11\ChromeRecovery.exe
section {u'size_of_data': u'0x000df200', u'virtual_address': u'0x00002000', u'entropy': 7.735227847453371, u'name': u'.text', u'virtual_size': u'0x000df104'} entropy 7.73522784745 description A section with a high entropy has been found
entropy 0.992217898833 description Overall entropy of this PE file is high
Time & API Arguments Status Return Repeated

LookupPrivilegeValueW

 system_name:
privilege_name: SeDebugPrivilege
1 1 0
url http://www.iec.ch
description Run a KeyLogger rule KeyLogger
description Take ScreenShot rule ScreenShot
description (no description) rule DebuggerCheck__GlobalFlags
description (no description) rule DebuggerCheck__QueryInfo
description (no description) rule DebuggerHiding__Thread
description (no description) rule DebuggerHiding__Active
description (no description) rule ThreadControl__Context
description (no description) rule SEH__vectored
description Checks if being debugged rule anti_dbg
description Bypass DEP rule disable_dep
Time & API Arguments Status Return Repeated

NtAllocateVirtualMemory

 process_identifier: 2592
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000025c
1 0 0
reg_key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\exefile\shell\open\command\(Default) reg_value C:\Windows\svchost.com "%1" %*
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*x@°@Pd€ÌpCODEÀrt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@t@ @„#@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ=@@´F@ÌN@O@ØY@äY@øY@üY@üY@Z@$Z@LZ@PZ@Z@´Z@àZ@ @øà€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿ @ ,Eí͘û¤W€É<AïË½ïW‡Ý{JÖçöJÞ>…@}ü„{댐íêÄþGÌA2ÿœNۂõ¥Ð2ªË+^þÇºãW—Ë µáÙnÊXý±.štÛNóĞt“îâhî„‹À`ˆ²òTø5ýœ‘@@
base_address: 0x00409000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer: XRÜPàS4Q T@QLTPQ€T\QÌTpQ U€QöVôQÄW(R8XLRfR~R–R®RÊRØRèRôRSS&S8SJS\SnS|SŠS–S²S¾SÐSìSþST.T>TZTjTŽTœTªT¸TÚTìTüTU$U.U@UVUfU~UŽUšU²UÂUÖUìUVV&V4VJVZVlVzVŠVœV¨V¶VÆVÔVèVWWW,W:WFWVWbWvWŠW WºWÐWÜWêWøWX XX&XDXTXkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetVersionGetCurrentThreadIdGetThreadLocaleGetStartupInfoAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenkernel32.dllTlsSetValueTlsGetValueLocalAllocGetModuleHandleAadvapi32.dllRegSetValueExARegOpenKeyExARegCloseKeykernel32.dllWriteFileWinExecSetFilePointerSetFileAttributesASetEndOfFileSetCurrentDirectoryAReleaseMutexReadFileGetWindowsDirectoryAGetTempPathAGetShortPathNameAGetModuleFileNameAGetLogicalDriveStringsAGetLocalTimeGetLastErrorGetFileSizeGetFileAttributesAGetDriveTypeAGetCommandLineAFreeLibraryFindNextFileAFindFirstFileAFindCloseDeleteFileACreateMutexACreateFileACreateDirectoryACloseHandlegdi32.dllStretchDIBitsSetDIBitsSelectObjectGetObjectAGetDIBitsDeleteObjectDeleteDCCreateSolidBrushCreateDIBSectionCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSysColorGetIconInfoGetDCFillRectDestroyIconCopyImageCharLowerBuffAshell32.dllShellExecuteAExtractIconA
base_address: 0x00415000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer: `A`A@pA
base_address: 0x00417000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer:  0 000"0*020:0B0J0R0Z0b0j0r0z0‚0Š0’0¾0Æ0Î0Ö0Þ0æ0î0ö0ÿ0 1(11—1ß2V3¥3ë3þ3t4¸4ù4-595T5ç567r77š7¥7­7·7Á7Ë7á7ç7õ7888&8,848F8R8a8m8u8€8†8“8™8³8º8Ä8Î8Ø8ä8ï89999/9:9[9s9’9ª9²9ò9:W:w:•:¿;Ì;ÿ;<<'<0<;<D<K<Z<a<ƒ<Ü<ä<i=‡=Œ=’=þ=>>>b>k>>§>³>»>î>?2?\?e?u?}?ƒ?Œ?“?˜?ž?±?º?Ø?Þ?æ? 00(0@0L0T0k0z0Š0ª0Â0æ0î0ô0ú0,1P1n1~1„1Œ1ñ1ü12 22$2u2|2Œ2–2œ2¤2ª2°2·2Á2h3‘3¯3»3Ã34#4+4O4o4—4°4É4Ú4ï4ü45Ù5…668A8Q8g8…8›8²8Ç899*929H9`9n9¢9¾9Ê9Þ9è9û9+:X:a:“:œ:Ñ:Ø:ú:G;o;·<ß<æ<þ< =T=\=g=“=¨=ó=>>N>R>X>\>a>h>n>v>>>˜>Ä>Ï>ì>ö>?%?/?7?=?K?f?{?…?Š?©?®?³?Õ?é?0 N0W0}0Š0466?6:7C7¡;²;ò;ù; <)<2<><E<Ä< =/=;=B=L=V=m=~=‹=’=–=œ= =¦=­=±=Ë=Ô=Ý=é=ó=>/>@>J>R>Z>b>j>’>¼>Ê>Ï>è>ø> ??&?+?0?7?>?H?_?k?x?Š?—?£?°?Â?È?â?ê?ò?ú?@0 00:0B0J0R0Z0b0j0r0z0‚0Š0’0š0¢0ª0²0º0Â0Ê0Ò0Ú0â0ê0ò0ú01 111"1*121:1B1J1R1Z1b1j1r1z1‚1Š1’1§1³1À1Ò1ß1ë1ø1 22#202B2J2R2_2k2x2Š2—2£2°2Â2Ï2Û2è2ú233 323?3K3X3j3w3ƒ33¢3¯3»3È3Ú3ç3ó3444$4(4,484<4@4L4P4T4`4d4h4t4x4|4ˆ4Œ4•4¡4n5í9Ê:ò:;<Y<‘<Ù<Z=ž=ù=>Ô>ï>?¨?ê?P\ 0b0¸0å0]1¹12I22¸23¸3ü3 4œ4À4é45»5ß5ü5~66_8H9®9,;:;A;H;c;o;Š;˜;Ÿ;¦;Ý;‚<¢<š?¼?Ê?`L0Œ3“3Î4‚5¶6ô:(;=;c;Ø;„<<Â<ç<ó<û<===*=:=c=9>n>‘>Æ>÷>?M?`?›?Ü?p” 0Y0„0¢0Õ0û011&151R1i1™1é12h2}23¯3¾3k4¿4!5/5É5ú56&6r6œ6Ü6ÿ6<7W7¥7Ç7&8Å8â8Z9¯9´9Ç9: :":U:t:‹:©:À:ø:2;H;b;­;Ø;õ;Y<j<,=Å=ý=L>Â>÷>8?R?…?Ÿ?€lZ0…0¢0Ç0Ú0ì0ð0ô0ø0ü0111 11111 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1t11š1¥1¹1Í1á1õ112_2¢20004080è0ì0ð0ô0ø0ü0111111 1$1(122p000 0
base_address: 0x00418000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2592
process_handle: 0x0000025c
1 1 0
Time & API Arguments Status Return Repeated

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*x@°@Pd€ÌpCODEÀrt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0
Process injection Process 2304 called NtSetContextThread to modify thread in remote process 2592
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4227448
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000258
process_identifier: 2592
1 0 0
Process injection Process 2304 resumed a thread in remote process 2592
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x00000258
suspend_count: 1
process_identifier: 2592
1 0 0
Time & API Arguments Status Return Repeated

NtResumeThread

 thread_handle: 0x000000dc
suspend_count: 1
process_identifier: 2304
1 0 0

NtResumeThread

 thread_handle: 0x00000150
suspend_count: 1
process_identifier: 2304
1 0 0

NtResumeThread

 thread_handle: 0x0000018c
suspend_count: 1
process_identifier: 2304
1 0 0

NtResumeThread

 thread_handle: 0x00000248
suspend_count: 1
process_identifier: 2304
1 0 0

CreateProcessInternalW

 thread_identifier: 2596
thread_handle: 0x00000258
process_identifier: 2592
current_directory:
filepath: C:\Users\test22\AppData\Local\Temp\vbc.exe
track: 1
command_line:
filepath_r: C:\Users\test22\AppData\Local\Temp\vbc.exe
stack_pivoted: 0
creation_flags: 134217732 (CREATE_NO_WINDOW|CREATE_SUSPENDED)
inherit_handles: 0
process_handle: 0x0000025c
1 1 0

NtGetContextThread

 thread_handle: 0x00000258
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2592
region_size: 110592
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0x0000025c
1 0 0

WriteProcessMemory

 buffer: MZPÿÿ¸@º´ Í!¸LÍ!This program must be run under Win32 $7PEL^B*àŽ t*x@°@Pd€ÌpCODEÀrt `DATAx@ÀBSS™¨ |À.idatadP |@À.tls`†À.rdatap†@P.relocÌ€ˆ@P.rsrcŽ@P°¢@P
base_address: 0x00400000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00401000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer: @2‹À@@@t@ @„#@ËÌÈÉ×ÏÈÍÎÛØÚÙÊÜÝÞßàáãäå@Error‹ÀRuntime error at 00000000‹À0123456789ABCDEFÿÿÿÿ=@@´F@ÌN@O@ØY@äY@øY@üY@üY@Z@$Z@LZ@PZ@Z@´Z@àZ@ @øà€€€€€€€€€€€€ÀÀÀÿÿÿÿÿÿÿÿÿ @ ,Eí͘û¤W€É<AïË½ïW‡Ý{JÖçöJÞ>…@}ü„{댐íêÄþGÌA2ÿœNۂõ¥Ð2ªË+^þÇºãW—Ë µáÙnÊXý±.štÛNóĞt“îâhî„‹À`ˆ²òTø5ýœ‘@@
base_address: 0x00409000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer: XRÜPàS4Q T@QLTPQ€T\QÌTpQ U€QöVôQÄW(R8XLRfR~R–R®RÊRØRèRôRSS&S8SJS\SnS|SŠS–S²S¾SÐSìSþST.T>TZTjTŽTœTªT¸TÚTìTüTU$U.U@UVUfU~UŽUšU²UÂUÖUìUVV&V4VJVZVlVzVŠVœV¨V¶VÆVÔVèVWWW,W:WFWVWbWvWŠW WºWÐWÜWêWøWX XX&XDXTXkernel32.dllDeleteCriticalSectionLeaveCriticalSectionEnterCriticalSectionInitializeCriticalSectionVirtualFreeVirtualAllocLocalFreeLocalAllocGetVersionGetCurrentThreadIdGetThreadLocaleGetStartupInfoAGetLocaleInfoAGetCommandLineAFreeLibraryExitProcessWriteFileUnhandledExceptionFilterRtlUnwindRaiseExceptionGetStdHandleuser32.dllGetKeyboardTypeMessageBoxAadvapi32.dllRegQueryValueExARegOpenKeyExARegCloseKeyoleaut32.dllSysFreeStringSysReAllocStringLenkernel32.dllTlsSetValueTlsGetValueLocalAllocGetModuleHandleAadvapi32.dllRegSetValueExARegOpenKeyExARegCloseKeykernel32.dllWriteFileWinExecSetFilePointerSetFileAttributesASetEndOfFileSetCurrentDirectoryAReleaseMutexReadFileGetWindowsDirectoryAGetTempPathAGetShortPathNameAGetModuleFileNameAGetLogicalDriveStringsAGetLocalTimeGetLastErrorGetFileSizeGetFileAttributesAGetDriveTypeAGetCommandLineAFreeLibraryFindNextFileAFindFirstFileAFindCloseDeleteFileACreateMutexACreateFileACreateDirectoryACloseHandlegdi32.dllStretchDIBitsSetDIBitsSelectObjectGetObjectAGetDIBitsDeleteObjectDeleteDCCreateSolidBrushCreateDIBSectionCreateCompatibleDCCreateCompatibleBitmapBitBltuser32.dllReleaseDCGetSysColorGetIconInfoGetDCFillRectDestroyIconCopyImageCharLowerBuffAshell32.dllShellExecuteAExtractIconA
base_address: 0x00415000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer: `A`A@pA
base_address: 0x00417000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer:  0 000"0*020:0B0J0R0Z0b0j0r0z0‚0Š0’0¾0Æ0Î0Ö0Þ0æ0î0ö0ÿ0 1(11—1ß2V3¥3ë3þ3t4¸4ù4-595T5ç567r77š7¥7­7·7Á7Ë7á7ç7õ7888&8,848F8R8a8m8u8€8†8“8™8³8º8Ä8Î8Ø8ä8ï89999/9:9[9s9’9ª9²9ò9:W:w:•:¿;Ì;ÿ;<<'<0<;<D<K<Z<a<ƒ<Ü<ä<i=‡=Œ=’=þ=>>>b>k>>§>³>»>î>?2?\?e?u?}?ƒ?Œ?“?˜?ž?±?º?Ø?Þ?æ? 00(0@0L0T0k0z0Š0ª0Â0æ0î0ô0ú0,1P1n1~1„1Œ1ñ1ü12 22$2u2|2Œ2–2œ2¤2ª2°2·2Á2h3‘3¯3»3Ã34#4+4O4o4—4°4É4Ú4ï4ü45Ù5…668A8Q8g8…8›8²8Ç899*929H9`9n9¢9¾9Ê9Þ9è9û9+:X:a:“:œ:Ñ:Ø:ú:G;o;·<ß<æ<þ< =T=\=g=“=¨=ó=>>N>R>X>\>a>h>n>v>>>˜>Ä>Ï>ì>ö>?%?/?7?=?K?f?{?…?Š?©?®?³?Õ?é?0 N0W0}0Š0466?6:7C7¡;²;ò;ù; <)<2<><E<Ä< =/=;=B=L=V=m=~=‹=’=–=œ= =¦=­=±=Ë=Ô=Ý=é=ó=>/>@>J>R>Z>b>j>’>¼>Ê>Ï>è>ø> ??&?+?0?7?>?H?_?k?x?Š?—?£?°?Â?È?â?ê?ò?ú?@0 00:0B0J0R0Z0b0j0r0z0‚0Š0’0š0¢0ª0²0º0Â0Ê0Ò0Ú0â0ê0ò0ú01 111"1*121:1B1J1R1Z1b1j1r1z1‚1Š1’1§1³1À1Ò1ß1ë1ø1 22#202B2J2R2_2k2x2Š2—2£2°2Â2Ï2Û2è2ú233 323?3K3X3j3w3ƒ33¢3¯3»3È3Ú3ç3ó3444$4(4,484<4@4L4P4T4`4d4h4t4x4|4ˆ4Œ4•4¡4n5í9Ê:ò:;<Y<‘<Ù<Z=ž=ù=>Ô>ï>?¨?ê?P\ 0b0¸0å0]1¹12I22¸23¸3ü3 4œ4À4é45»5ß5ü5~66_8H9®9,;:;A;H;c;o;Š;˜;Ÿ;¦;Ý;‚<¢<š?¼?Ê?`L0Œ3“3Î4‚5¶6ô:(;=;c;Ø;„<<Â<ç<ó<û<===*=:=c=9>n>‘>Æ>÷>?M?`?›?Ü?p” 0Y0„0¢0Õ0û011&151R1i1™1é12h2}23¯3¾3k4¿4!5/5É5ú56&6r6œ6Ü6ÿ6<7W7¥7Ç7&8Å8â8Z9¯9´9Ç9: :":U:t:‹:©:À:ø:2;H;b;­;Ø;õ;Y<j<,=Å=ý=L>Â>÷>8?R?…?Ÿ?€lZ0…0¢0Ç0Ú0ì0ð0ô0ø0ü0111 11111 1$1(1,1014181<1@1D1H1L1P1T1X1\1`1d1h1l1t11š1¥1¹1Í1á1õ112_2¢20004080è0ì0ð0ô0ø0ü0111111 1$1(122p000 0
base_address: 0x00418000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer:
base_address: 0x00419000
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

WriteProcessMemory

 buffer: @
base_address: 0x7efde008
process_identifier: 2592
process_handle: 0x0000025c
1 1 0

NtSetContextThread

 registers.eip: 0
registers.esp: 0
registers.edi: 0
registers.eax: 4227448
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x00000258
process_identifier: 2592
1 0 0

NtResumeThread

 thread_handle: 0x00000258
suspend_count: 1
process_identifier: 2592
1 0 0

NtResumeThread

 thread_handle: 0x00000270
suspend_count: 1
process_identifier: 2304
1 0 0

CreateProcessInternalW

 thread_identifier: 0
thread_handle: 0x00000000
process_identifier: 0
current_directory: C:\Users\test22\AppData\Local\Temp
filepath: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
track: 0
command_line: "C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe"
filepath_r: C:\Users\test22\AppData\Local\Temp\3582-490\vbc.exe
stack_pivoted: 0
creation_flags: 67634192 (CREATE_DEFAULT_ERROR_MODE|CREATE_NEW_CONSOLE|CREATE_UNICODE_ENVIRONMENT|EXTENDED_STARTUPINFO_PRESENT)
inherit_handles: 0
process_handle: 0x00000000
0 0
Lionic Trojan.MSIL.NanoBot.m!c
Elastic malicious (high confidence)
MicroWorld-eScan IL:Trojan.MSILZilla.10569
FireEye IL:Trojan.MSILZilla.10569
Cylance Unsafe
Sangfor Trojan.MSIL.Kryptik.ADLZ
CrowdStrike win/malicious_confidence_80% (W)
Cyren W32/MSIL_Kryptik.GCQ.gen!Eldorado
Symantec Scr.Malcode!gdn30
ESET-NOD32 a variant of MSIL/Kryptik.ADLZ
APEX Malicious
Paloalto generic.ml
Kaspersky HEUR:Trojan-PSW.MSIL.Agensla.gen
BitDefender IL:Trojan.MSILZilla.10569
Avast FileRepMalware
DrWeb Trojan.Inject4.19817
McAfee-GW-Edition BehavesLike.Win32.Generic.dc
Sophos Mal/Generic-R
Ikarus Trojan.MSIL.Agent
MAX malware (ai score=83)
Kingsoft Win32.PSWTroj.Undef.(kcloud)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData IL:Trojan.MSILZilla.10569
Cynet Malicious (score: 100)
AhnLab-V3 Malware/Win.Generic.C4774757
McAfee Artemis!186EE2B0FBAE
Malwarebytes Malware.AI.35377182
TrendMicro-HouseCall TROJ_GEN.R002H0CKH21
SentinelOne Static AI - Suspicious PE
Fortinet MSIL/Injector.VTU!tr
AVG FileRepMalware
Cybereason malicious.0fbae6
Panda Trj/GdSda.A
MaxSecure Trojan.Malware.300983.susgen