Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	March 17, 2023, 5:30 p.m.	March 17, 2023, 5:51 p.m.

Size	460.5KB
Type	PE32+ executable (GUI) x86-64 Mono/.Net assembly, for MS Windows
MD5	`f35d8958edaab270d6c621bb96e395fc`
SHA256	`2898cb7724546579022e85a86b222cc4caf739ea4b325a50f24512e4145f2f92`
CRC32	`C26504B1`
ssdeep	`12288:M9podLzMGtJXh2W0skbWd/2fvfwqk0Z4XE75VmiGU1:CpodLQgXhxYbVfvfwo9d`
PDB Path	C:\Users\Allah\sources\Windows-Vertical-Grid-master\obj\x64\Debug\VertGird.pdb
Yara	Malicious_Library_Zero - Malicious_Library IsPE64 - (no description) PE_Header_Zero - PE File Signature

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
2544
- Setup.exe "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\KOR\Setup.exe"
  2892

Name	Response	Post-Analysis Lookup
www.white-hat.uk	A 94.176.104.86 CNAME white-hat.uk	94.176.104.86
www.thewildphotographer.co.uk	A 96.126.123.244 A 198.58.118.167 A 72.14.178.174 A 45.33.23.183 A 45.79.19.196 A 72.14.185.43 A 45.33.30.197 A 45.33.20.235 A 45.56.79.23 A 45.33.2.79 A 45.33.18.44 A 173.255.194.134	45.33.18.44
www.younrock.com	A 81.17.18.195	63.141.242.45
www.thedivinerudraksha.com	A 85.187.128.34 CNAME thedivinerudraksha.com	85.187.128.34
www.energyservicestation.com	A 213.145.228.111	213.145.228.111
www.bitservicesltd.com	A 161.97.163.8	161.97.163.8
www.shapshit.xyz	A 199.192.30.147	199.192.30.147
www.222ambking.org	A 91.195.240.94	91.195.240.94
www.gritslab.com	A 78.141.192.145 CNAME gritslab.com	78.141.192.145
www.sqlite.org	A 45.33.6.223	45.33.6.223

IP Address	Status	Action
161.97.163.8	Active	Moloch
164.124.101.2	Active	Moloch
199.192.30.147	Active	Moloch
213.145.228.111	Active	Moloch
45.33.6.223	Active	Moloch
45.79.19.196	Active	Moloch
78.141.192.145	Active	Moloch
81.17.18.195	Active	Moloch
85.187.128.34	Active	Moloch
91.195.240.94	Active	Moloch
94.176.104.86	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 192.168.56.101:49182 -> 85.187.128.34:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 85.187.128.34:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 199.192.30.147:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49182 -> 85.187.128.34:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 199.192.30.147:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 199.192.30.147:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 94.176.104.86:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49180 -> 199.192.30.147:80	2031088	ET HUNTING Request to .XYZ Domain with Minimal Headers	Potentially Bad Traffic
TCP 192.168.56.101:49165 -> 94.176.104.86:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49165 -> 94.176.104.86:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 81.17.18.195:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 81.17.18.195:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49176 -> 81.17.18.195:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 78.141.192.145:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 78.141.192.145:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49168 -> 78.141.192.145:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 161.97.163.8:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 161.97.163.8:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49170 -> 161.97.163.8:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 91.195.240.94:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 213.145.228.111:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 91.195.240.94:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 213.145.228.111:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49172 -> 91.195.240.94:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49174 -> 213.145.228.111:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 45.79.19.196:80	2031412	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 45.79.19.196:80	2031449	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected
TCP 192.168.56.101:49178 -> 45.79.19.196:80	2031453	ET MALWARE FormBook CnC Checkin (GET)	Malware Command and Control Activity Detected

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 17, 2023, 5:23 p.m.			0	0
IsDebuggerPresent March 17, 2023, 5:23 p.m.			0	0

Uses Windows APIs to generate a cryptographic key (5 events)

Time & API	Arguments	Status	Return
CryptExportKey March 17, 2023, 5:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003cbcc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 8	1	1
CryptExportKey March 17, 2023, 5:23 p.m.	buffer: f Ot Ù×ñ¾ a¼±&Ík2_áêÇÉµnPË1Ã?^ crypto_handle: 0x00000000003cbcc0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 8	1	1
CryptExportKey March 17, 2023, 5:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003cbbe0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 17, 2023, 5:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003cc430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey March 17, 2023, 5:23 p.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003cc430 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

C:\Users\Allah\sources\Windows-Vertical-Grid-master\obj\x64\Debug\VertGird.pdb

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 17, 2023, 5:23 p.m.		1	1	0

One or more potentially interesting buffers were extracted, these generally contain injected code, configuration data, etc.

HTTP traffic contains suspicious features which may be indicative of malware related traffic (9 events)

suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.white-hat.uk/u2kb/?zKkmw=PXfMycAZpTAipct8YN0l/5TWhYE4yPgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTCgwye3M0h5ZtqacmtcmNe/sHow=&toZ=xM6qAGrIAGRvmv
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.gritslab.com/u2kb/?zKkmw=ydCzFiH7iMWnz6xHMKiyYVGDKfWH5+fYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNezbHZCh47jo+mhlV2uXG5eH60=&toZ=xM6qAGrIAGRvmv
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.bitservicesltd.com/u2kb/?zKkmw=rr+sOBvEXsBdGevUk44F/k+BAr88zC1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXz4UaWEmNABCelIWOCZ3yhH4Z4=&toZ=xM6qAGrIAGRvmv
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.222ambking.org/u2kb/?zKkmw=IEUpLmGg2fqLmrhwD8IHX/zhiiNjbOQDFcodV2ACJcW4bHSQscR3Nc4uRx31p3m0gGv03uToPch8hDrce1eNAdUBSmpSNalx6DQXGQo=&toZ=xM6qAGrIAGRvmv
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.energyservicestation.com/u2kb/?zKkmw=IK59b/MdFRha+CUVM3V2TqbXgrTjD6F66TLC1fPPNwLnZq29gpb1hRWNlrDr258EhEsSnFmalKQEmudxTrusBmUmj2xyJgahFTdaUmU=&toZ=xM6qAGrIAGRvmv
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.younrock.com/u2kb/?zKkmw=05tPwqSdqXO2xf32BmsnsHpgCfZIa2c80hhB3sQ3FFDNPs5AZDU6TyUQmX911UO6Ssjq2b6k9nBD4uDOZrqd7XHQTF+IIpbM/DoOhU4=&toZ=xM6qAGrIAGRvmv
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.thewildphotographer.co.uk/u2kb/?zKkmw=pn+zaWXo7szcfRSxp4kAcR5iap+7ulP+x3705F5u21IqvN9WG9kcDL2FxdXl2W/5MjovaUotkmG6JgF/Eyaa9PeBR2yUVivPQ+uGbEI=&toZ=xM6qAGrIAGRvmv
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.shapshit.xyz/u2kb/?zKkmw=Yd5Rzn4EVOpL1Cl/eY8jjeGdoEKZlYBpl8BtE0ZhlgLGbR5cH1Fn7sihS3XP3GCDon1xi4vL0lQ4XtydV6BMyXIOMzObAfzgUMU2ykM=&toZ=xM6qAGrIAGRvmv
suspicious_features	GET method with no useragent header	suspicious_request	GET http://www.thedivinerudraksha.com/u2kb/?zKkmw=im5SXjRwbJIZeY2yetpTdO7N29MJtck2UhYi2fNZ2Kf/X7lq2SPRiB6LR8y/FeM3y7tdA/WTtliq4uHTfapDkaA0PJ0fXInXaKlPglI=&toZ=xM6qAGrIAGRvmv

Performs some HTTP requests (18 events)

request	GET http://www.white-hat.uk/u2kb/?zKkmw=PXfMycAZpTAipct8YN0l/5TWhYE4yPgF2k7967nf/qU1A0mUqq9Jlnm9rK8XSf3D04yKTuePtKPnTCgwye3M0h5ZtqacmtcmNe/sHow=&toZ=xM6qAGrIAGRvmv
request	GET http://www.sqlite.org/2020/sqlite-dll-win32-x86-3330000.zip
request	POST http://www.gritslab.com/u2kb/
request	GET http://www.gritslab.com/u2kb/?zKkmw=ydCzFiH7iMWnz6xHMKiyYVGDKfWH5+fYQUsmgPEoYCSsyD6HgT3yOGCjssC2N8mKn+GjINYvhr7iKNezbHZCh47jo+mhlV2uXG5eH60=&toZ=xM6qAGrIAGRvmv
request	POST http://www.bitservicesltd.com/u2kb/
request	GET http://www.bitservicesltd.com/u2kb/?zKkmw=rr+sOBvEXsBdGevUk44F/k+BAr88zC1YNHmXivr92FQhRIIYsedR2a+6GoV1WAKeGdj+MTdX512lJXz4UaWEmNABCelIWOCZ3yhH4Z4=&toZ=xM6qAGrIAGRvmv
request	POST http://www.222ambking.org/u2kb/
request	GET http://www.222ambking.org/u2kb/?zKkmw=IEUpLmGg2fqLmrhwD8IHX/zhiiNjbOQDFcodV2ACJcW4bHSQscR3Nc4uRx31p3m0gGv03uToPch8hDrce1eNAdUBSmpSNalx6DQXGQo=&toZ=xM6qAGrIAGRvmv
request	POST http://www.energyservicestation.com/u2kb/
request	GET http://www.energyservicestation.com/u2kb/?zKkmw=IK59b/MdFRha+CUVM3V2TqbXgrTjD6F66TLC1fPPNwLnZq29gpb1hRWNlrDr258EhEsSnFmalKQEmudxTrusBmUmj2xyJgahFTdaUmU=&toZ=xM6qAGrIAGRvmv
request	POST http://www.younrock.com/u2kb/
request	GET http://www.younrock.com/u2kb/?zKkmw=05tPwqSdqXO2xf32BmsnsHpgCfZIa2c80hhB3sQ3FFDNPs5AZDU6TyUQmX911UO6Ssjq2b6k9nBD4uDOZrqd7XHQTF+IIpbM/DoOhU4=&toZ=xM6qAGrIAGRvmv
request	POST http://www.thewildphotographer.co.uk/u2kb/
request	GET http://www.thewildphotographer.co.uk/u2kb/?zKkmw=pn+zaWXo7szcfRSxp4kAcR5iap+7ulP+x3705F5u21IqvN9WG9kcDL2FxdXl2W/5MjovaUotkmG6JgF/Eyaa9PeBR2yUVivPQ+uGbEI=&toZ=xM6qAGrIAGRvmv
request	POST http://www.shapshit.xyz/u2kb/
request	GET http://www.shapshit.xyz/u2kb/?zKkmw=Yd5Rzn4EVOpL1Cl/eY8jjeGdoEKZlYBpl8BtE0ZhlgLGbR5cH1Fn7sihS3XP3GCDon1xi4vL0lQ4XtydV6BMyXIOMzObAfzgUMU2ykM=&toZ=xM6qAGrIAGRvmv
request	POST http://www.thedivinerudraksha.com/u2kb/
request	GET http://www.thedivinerudraksha.com/u2kb/?zKkmw=im5SXjRwbJIZeY2yetpTdO7N29MJtck2UhYi2fNZ2Kf/X7lq2SPRiB6LR8y/FeM3y7tdA/WTtliq4uHTfapDkaA0PJ0fXInXaKlPglI=&toZ=xM6qAGrIAGRvmv

Sends data using the HTTP POST Method (8 events)

request	POST http://www.gritslab.com/u2kb/
request	POST http://www.bitservicesltd.com/u2kb/
request	POST http://www.222ambking.org/u2kb/
request	POST http://www.energyservicestation.com/u2kb/
request	POST http://www.younrock.com/u2kb/
request	POST http://www.thewildphotographer.co.uk/u2kb/
request	POST http://www.shapshit.xyz/u2kb/
request	POST http://www.thedivinerudraksha.com/u2kb/

Allocates read-write-execute memory (usually to unpack itself) (50 out of 79 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 786432 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000560000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000005a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a31000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef40cb000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 1048576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000020b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002130000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a32000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a34000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a34000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a34000 process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3a34000 process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9428a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9433c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94366000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94340000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9429c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943b0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943b1000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 6 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000000000 process_handle: 0xffffffffffffffff		-1073741800
NtProtectVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 2 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000000000007b process_handle: 0xffffffffffffffff		-1073741800
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ab000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe942ad000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9428b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943b2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94282000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9429a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9428c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9440f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe94400000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe9429d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943b3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943b4000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2544 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fe943b5000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x00072a00', u'virtual_address': u'0x00002000', u'entropy': 7.992853597538524, u'name': u'.text', u'virtual_size': u'0x00072864'}

entropy

7.99285359754

description

A section with a high entropy has been found

entropy

0.996739130435

description

Overall entropy of this PE file is high

Checks for the Locally Unique Identifier on the system for a suspicious privilege (2 events)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 17, 2023, 5:23 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0
LookupPrivilegeValueW March 17, 2023, 5:30 p.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Yara rule detected in process memory (8 events)

description	(no description)	rule	DebuggerCheck__GlobalFlags
description	(no description)	rule	DebuggerCheck__QueryInfo
description	(no description)	rule	DebuggerHiding__Thread
description	(no description)	rule	DebuggerHiding__Active
description	(no description)	rule	ThreadControl__Context
description	(no description)	rule	SEH__vectored
description	Checks if being debugged	rule	anti_dbg
description	Bypass DEP	rule	disable_dep

Terminates another process (8 events)

Time & API	Arguments	Status
NtTerminateProcess March 17, 2023, 5:23 p.m.	status_code: 0xffffffff process_identifier: 2748 process_handle: 0x0000000000000274
NtTerminateProcess March 17, 2023, 5:23 p.m.	status_code: 0xffffffff process_identifier: 2748 process_handle: 0x0000000000000274	1
NtTerminateProcess March 17, 2023, 5:23 p.m.	status_code: 0xffffffff process_identifier: 2784 process_handle: 0x000000000000027c
NtTerminateProcess March 17, 2023, 5:23 p.m.	status_code: 0xffffffff process_identifier: 2784 process_handle: 0x000000000000027c	1
NtTerminateProcess March 17, 2023, 5:23 p.m.	status_code: 0xffffffff process_identifier: 2820 process_handle: 0x0000000000000284
NtTerminateProcess March 17, 2023, 5:23 p.m.	status_code: 0xffffffff process_identifier: 2820 process_handle: 0x0000000000000284	1
NtTerminateProcess March 17, 2023, 5:23 p.m.	status_code: 0xffffffff process_identifier: 2856 process_handle: 0x000000000000028c
NtTerminateProcess March 17, 2023, 5:23 p.m.	status_code: 0xffffffff process_identifier: 2856 process_handle: 0x000000000000028c	1

One or more of the buffers contains an embedded PE file (2 events)

buffer	Buffer with sha1: c9d2633d333af7c04e7c0df2d42e304ed92cf086
buffer	Buffer with sha1: 937442d3297518692432f004be2c37b4632c3b75

Allocates execute permission to another process indicative of possible code injection (1 event)

Time & API	Arguments	Status	Return	Repeated
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2892 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000288	1	0	0

Resumed a suspended thread in a remote process potentially indicative of process injection (2 events)

Time & API	Arguments	Status	Return	Repeated
Process injection	Process 2544 resumed a thread in remote process 2892
NtResumeThread March 17, 2023, 5:23 p.m.	thread_handle: 0x000000000000028c suspend_count: 1 process_identifier: 2892	1	0	0

File has been identified by 25 AntiVirus engines on VirusTotal as malicious (25 events)

Lionic	Trojan.Win32.Injuke.16!c
Elastic	malicious (high confidence)
McAfee	Artemis!F35D8958EDAA
Sangfor	Trojan.Msil.Agent.Vdkb
CrowdStrike	win/malicious_confidence_100% (W)
Cyren	W64/MSIL_Agent.EYB.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of MSIL/GenKryptik.GHSR
Cynet	Malicious (score: 100)
APEX	Malicious
Paloalto	generic.ml
Kaspersky	UDS:Trojan-Spy.MSIL.Noon.gen
Avast	Win64:PWSX-gen [Trj]
McAfee-GW-Edition	BehavesLike.Win64.Trojan.gc
Trapmine	suspicious.low.ml.score
Webroot	W32.Trojan.Gen
Microsoft	Trojan:Win32/Formbook.RG!MTB
GData	Win64.Trojan.Cerbu.4X1101
Google	Detected
Acronis	suspicious
Rising	Malware.Obfus/MSIL@AI.91 (RDM.MSIL2:m9ktFAiAuYtjEWlEvfwPrA)
SentinelOne	Static AI - Malicious PE
MaxSecure	Trojan.Malware.121218.susgen
Fortinet	W32/Malicious_Behavior.SBX
AVG	Win64:PWSX-gen [Trj]

Executed a process and injected code into it, probably while unpacking (14 events)

Time & API	Arguments	Status	Return
NtResumeThread March 17, 2023, 5:23 p.m.	thread_handle: 0x00000000000000c4 suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread March 17, 2023, 5:23 p.m.	thread_handle: 0x0000000000000134 suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread March 17, 2023, 5:23 p.m.	thread_handle: 0x0000000000000178 suspend_count: 1 process_identifier: 2544	1	0
NtResumeThread March 17, 2023, 5:23 p.m.	thread_handle: 0x0000000000000264 suspend_count: 1 process_identifier: 2544	1	0
NtGetContextThread March 17, 2023, 5:23 p.m.	thread_handle: 0x00000000000000c8	1	0
NtGetContextThread March 17, 2023, 5:23 p.m.	thread_handle: 0x00000000000000c8	1	0
NtResumeThread March 17, 2023, 5:23 p.m.	thread_handle: 0x00000000000000c8 suspend_count: 1 process_identifier: 2544	1	0
CreateProcessInternalW March 17, 2023, 5:23 p.m.	thread_identifier: 2752 thread_handle: 0x0000000000000268 process_identifier: 2748 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x000000000000026c	1	1
CreateProcessInternalW March 17, 2023, 5:23 p.m.	thread_identifier: 2788 thread_handle: 0x0000000000000274 process_identifier: 2784 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000270	1	1
CreateProcessInternalW March 17, 2023, 5:23 p.m.	thread_identifier: 2824 thread_handle: 0x000000000000027c process_identifier: 2820 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000278	1	1
CreateProcessInternalW March 17, 2023, 5:23 p.m.	thread_identifier: 2860 thread_handle: 0x0000000000000284 process_identifier: 2856 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000280	1	1
CreateProcessInternalW March 17, 2023, 5:23 p.m.	thread_identifier: 2896 thread_handle: 0x000000000000028c process_identifier: 2892 current_directory: filepath: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\KOR\Setup.exe track: 1 command_line: filepath_r: C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SetupCache\KOR\Setup.exe stack_pivoted: 0 creation_flags: 4 (CREATE_SUSPENDED) inherit_handles: 0 process_handle: 0x0000000000000288	1	1
NtAllocateVirtualMemory March 17, 2023, 5:23 p.m.	process_identifier: 2892 region_size: 192512 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000000400000 allocation_type: 12288 (MEM_COMMIT\|MEM_RESERVE) process_handle: 0x0000000000000288	1	0
NtResumeThread March 17, 2023, 5:23 p.m.	thread_handle: 0x000000000000028c suspend_count: 1 process_identifier: 2892	1	0

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All