popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Malicious Library UPX PE File OS Processor Check PE32 JPEG Format
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Jan. 26, 2023, 10:44 a.m. Jan. 26, 2023, 10:47 a.m.
Size 636.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 78e04840b1afd0c966a7ddaee7b67b5e
SHA256 30b342058dd80eae36044b9f6733b06a08ea4309b64b18186c86d7bd9af10d89
CRC32 6ED1E8A0
ssdeep 12288:jY6PwojPPTJQfEVIeTkWc3r7UCWUnkBhjJbITxFb7H/3+zPl+J:jY6PwO9TVhk33r7FaBctFfHvg9S
Yara
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • Malicious_Library_Zero - Malicious_Library
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
geoplugin.net
A 178.237.33.50
178.237.33.50
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
79.134.225.97 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 79.134.225.97:1558 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49167 -> 79.134.225.97:1558 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 79.134.225.97:1558 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 79.134.225.97:1558 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49167
79.134.225.97:1558 		None None None
TLS 1.3
192.168.56.101:49165
79.134.225.97:1558 		None None None
TLS 1.3
192.168.56.101:49168
79.134.225.97:1558 		None None None
TLS 1.3
192.168.56.101:49166
79.134.225.97:1558 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2548
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2632
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007e0000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2632
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x007f0000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2708
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73bc2000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445552\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888884\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111118\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666668\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667772\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777881\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111116\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555556\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122223\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777788888888889999999998\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888888887\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334442\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777778888888888991\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777780\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555554\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 10\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1112\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666669\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666670\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888888888899999996\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556662\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666665\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777788888888889\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777775\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444446\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111120\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444448\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444551\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777788888888889992\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222331\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555560\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777778888888888999994\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333441\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333340\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777778882\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666771\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222225\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333335\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444447\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777779\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888888888899999999999\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888888888890\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111115\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777776\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777788883\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777778888888888999999997\Network\Cookies
file C:\Users\test22\AppData\Local\Temp\loignftpo.exe
file C:\Users\test22\AppData\Roaming\uvqyuesa\swciccqjxeucnn.exe
file C:\Users\test22\AppData\Roaming\uvqyuesa\swciccqjxeucnn.exe
host 79.134.225.97
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\lmadenfkx reg_value C:\Users\test22\AppData\Roaming\uvqyuesa\swciccqjxeucnn.exe "C:\Users\test22\AppData\Local\Temp\loignftpo.exe" C:\Users\test22\Ap
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x0040949d
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 1311193 0
Process injection Process 2632 called NtSetContextThread to modify thread in remote process 2708
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4402214
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000c0
process_identifier: 2708
1 0 0
Lionic Trojan.Win32.Generic.4!c
FireEye Generic.mg.78e04840b1afd0c9
Cylance Unsafe
Cybereason malicious.af2246
Cyren W32/Injector.BJL.gen!Eldorado
Symantec Packed.NSISPacker!g14
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.ESPG
Cynet Malicious (score: 100)
APEX Malicious
Kaspersky UDS:DangerousObject.Multi.Generic
Avast Win32:InjectorX-gen [Trj]
Sophos Generic ML PUA (PUA)
DrWeb Trojan.Loader.1275
McAfee-GW-Edition BehavesLike.Win32.AdwareDotDo.jc
Microsoft Trojan:Win32/Remcos!MTB
Google Detected
Acronis suspicious
McAfee Artemis!78E04840B1AF
SentinelOne Static AI - Suspicious PE
Fortinet W32/Injector.NSAY!tr
AVG Win32:InjectorX-gen [Trj]