Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 20, 2023, 9:47 a.m.	March 20, 2023, 10:06 a.m.

Size	3.0MB
Type	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
MD5	`ca8572b2750b75f7b137637093922152`
SHA256	`ba484a35c10e0de7b344da174c26560e29bd3fe895216f9d03c0ce1cfc3de706`
CRC32	`C131AC26`
ssdeep	`12288:HimcoNM0Gg0OaJaX6eO5UKhbh3qpoGhiPCyW+SqFpA:aLhraO5UKyquiP8`
Yara	UPX_Zero - UPX packed file Win32_Trojan_PWS_Net_1_Zero - Win32 Trojan PWS .NET Azorult Is_DotNET_EXE - (no description) Win_Backdoor_AsyncRAT_Zero - Win Backdoor AsyncRAT IsPE32 - (no description) Admin_Tool_IN_Zero - Admin Tool Sysinternals PE_Header_Zero - PE File Signature

vbc.exe "C:\Users\test22\AppData\Local\Temp\vbc.exe"
508
- cmd.exe "cmd" /c ping 127.0.0.1 -n 37 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe,"
  2504
  - PING.EXE ping 127.0.0.1 -n 37
    2568
  - reg.exe REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe,"
    2944
- cmd.exe "cmd" /c ping 127.0.0.1 -n 43 > nul && copy "C:\Users\test22\AppData\Local\Temp\vbc.exe" "C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe" && ping 127.0.0.1 -n 43 > nul && "C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe"
  2768
  - PING.EXE ping 127.0.0.1 -n 43
    2832
  - PING.EXE ping 127.0.0.1 -n 43
    2140

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 20, 2023, 9:47 a.m.			0	0
IsDebuggerPresent March 20, 2023, 9:47 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (3 events)

Time & API	Arguments	Status	Return
CryptExportKey March 20, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00598bc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00598cc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1
CryptExportKey March 20, 2023, 9:47 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00598cc8 flags: 0 crypto_export_handle: 0x00000000 blob_type: 6	1	1

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx March 20, 2023, 9:47 a.m.		1	1	0

One or more processes crashed (2 events)

Time & API	Arguments	Status	Return	Repeated
__exception__ March 20, 2023, 9:47 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x740e1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73fb2ba1 mscorlib+0x30136b @ 0x728c136b mscorlib+0x2e86c1 @ 0x728a86c1 mscorlib+0x2e8612 @ 0x728a8612 0x556283a 0x556bb23 0x556a0ff 0x5568af6 0x5567e81 0x5562065 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73fb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73fb1737 mscorlib+0x2d3711 @ 0x72893711 mscorlib+0x308f2d @ 0x728c8f2d mscorlib+0x2cb060 @ 0x7288b060 0x761def 0x760f34 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73ff74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73ff7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74081dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74081e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74081f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7408416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 3071724 registers.edi: 0 registers.eax: 3071724 registers.ebp: 3071804 registers.edx: 0 registers.ebx: 6388152 registers.esi: 5722464 registers.ecx: 3294035852	1	0	0
__exception__ March 20, 2023, 9:47 a.m.	stacktrace: CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x740e1194 LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73fb2ba1 mscorlib+0x301877 @ 0x728c1877 mscorlib+0x2e8625 @ 0x728a8625 0x556283a 0x556bb23 0x556a0ff 0x5568af6 0x5567e81 0x5562065 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73fb1838 LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73fb1737 mscorlib+0x2d3711 @ 0x72893711 mscorlib+0x308f2d @ 0x728c8f2d mscorlib+0x2cb060 @ 0x7288b060 0x761def 0x760f34 DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652 DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95 DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73ff74ec DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73ff7610 CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74081dc4 CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74081e67 CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74081f7a _CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7408416a _CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3 CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16 _CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3 RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5 exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727 exception.instruction: leave exception.module: KERNELBASE.dll exception.exception_code: 0xe0434f4e exception.offset: 46887 exception.address: 0x7559b727 registers.esp: 3071848 registers.edi: 0 registers.eax: 3071848 registers.ebp: 3071928 registers.edx: 0 registers.ebx: 6388152 registers.esi: 5722464 registers.ecx: 3294035956	1	0	0

Time & API

Arguments

Status

Return

Repeated

__exception__

March 20, 2023, 9:47 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x740e1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73fb2ba1
mscorlib+0x30136b @ 0x728c136b
mscorlib+0x2e86c1 @ 0x728a86c1
mscorlib+0x2e8612 @ 0x728a8612
0x556283a
0x556bb23
0x556a0ff
0x5568af6
0x5567e81
0x5562065
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73fb1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73fb1737
mscorlib+0x2d3711 @ 0x72893711
mscorlib+0x308f2d @ 0x728c8f2d
mscorlib+0x2cb060 @ 0x7288b060
0x761def
0x760f34
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73ff74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73ff7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74081dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74081e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74081f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7408416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 3071724
registers.edi: 0
registers.eax: 3071724
registers.ebp: 3071804
registers.edx: 0
registers.ebx: 6388152
registers.esi: 5722464
registers.ecx: 3294035852

__exception__

March 20, 2023, 9:47 a.m.

stacktrace:

CopyPDBs+0x1b552 DllCanUnloadNowInternal-0x25a85 clr+0x1b1194 @ 0x740e1194
LogHelp_TerminateOnAssert+0x14061 GetPrivateContextsPerfCounters-0x53e1 clr+0x82ba1 @ 0x73fb2ba1
mscorlib+0x301877 @ 0x728c1877
mscorlib+0x2e8625 @ 0x728a8625
0x556283a
0x556bb23
0x556a0ff
0x5568af6
0x5567e81
0x5562065
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
LogHelp_TerminateOnAssert+0x12cf8 GetPrivateContextsPerfCounters-0x674a clr+0x81838 @ 0x73fb1838
LogHelp_TerminateOnAssert+0x12bf7 GetPrivateContextsPerfCounters-0x684b clr+0x81737 @ 0x73fb1737
mscorlib+0x2d3711 @ 0x72893711
mscorlib+0x308f2d @ 0x728c8f2d
mscorlib+0x2cb060 @ 0x7288b060
0x761def
0x760f34
DllUnregisterServerInternal-0x7aa2 clr+0x2652 @ 0x73f32652
DllRegisterServerInternal+0x243 CoUninitializeEE-0xd1f5 clr+0x1264f @ 0x73f4264f
DllRegisterServerInternal+0xa89 CoUninitializeEE-0xc9af clr+0x12e95 @ 0x73f42e95
DllGetClassObjectInternal+0x2473 CorDllMainForThunk-0x8a088 clr+0xc74ec @ 0x73ff74ec
DllGetClassObjectInternal+0x2597 CorDllMainForThunk-0x89f64 clr+0xc7610 @ 0x73ff7610
CorDllMainForThunk+0x850 _CorExeMain-0x238a clr+0x151dc4 @ 0x74081dc4
CorDllMainForThunk+0x8f3 _CorExeMain-0x22e7 clr+0x151e67 @ 0x74081e67
CorDllMainForThunk+0xa06 _CorExeMain-0x21d4 clr+0x151f7a @ 0x74081f7a
_CorExeMain+0x1c ClrCreateManagedInstance-0x35cd clr+0x15416a @ 0x7408416a
_CorExeMain+0x71 GetFileVersion-0x293a mscoreei+0xf5a3 @ 0x745df5a3
CreateConfigStream+0x13f GetProcessExecutableHeap-0xad6 mscoree+0x7f16 @ 0x74867f16
_CorExeMain+0x8 CreateConfigStream-0x2ff4 mscoree+0x4de3 @ 0x74864de3
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: c9 c2 10 00 cc cc cc cc cc 8b ff 55 8b ec 56 8b
exception.symbol: RaiseException+0x58 CloseHandle-0x9 kernelbase+0xb727
exception.instruction: leave
exception.module: KERNELBASE.dll
exception.exception_code: 0xe0434f4e
exception.offset: 46887
exception.address: 0x7559b727
registers.esp: 3071848
registers.edi: 0
registers.eax: 3071848
registers.ebp: 3071928
registers.edx: 0
registers.ebx: 6388152
registers.esi: 5722464
registers.ecx: 3294035956

Allocates read-write-execute memory (usually to unpack itself) (50 out of 55 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 2097152 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x007b0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00970000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtProtectVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f31000 process_handle: 0xffffffff	1
NtProtectVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f32000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 655360 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00490000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x004f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003a2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00465000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0046b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00467000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00760000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003aa000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ca000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c7000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ba000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003c6000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00761000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003ac000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00762000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x003bd000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00763000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00767000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00768000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00769000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0076a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0076b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05560000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05561000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00971000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 69632 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00975000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05563000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05569000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0556a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0556b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0556c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00986000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0556d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0556e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 24576 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a11000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a17000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a18000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a19000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a1a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a1b000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a1c000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a1d000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a1e000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1
NtAllocateVirtualMemory March 20, 2023, 9:47 a.m.	process_identifier: 508 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x05a1f000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1

A process created a hidden window (2 events)

Time & API	Arguments	Status	Return	Repeated
CreateProcessInternalW March 20, 2023, 9:47 a.m.	thread_identifier: 2508 thread_handle: 0x000003d8 process_identifier: 2504 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c ping 127.0.0.1 -n 37 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe," filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x000003e4	1	1	0
CreateProcessInternalW March 20, 2023, 9:48 a.m.	thread_identifier: 2772 thread_handle: 0x00000440 process_identifier: 2768 current_directory: C:\Users\test22\AppData\Local\Temp filepath: track: 1 command_line: "cmd" /c ping 127.0.0.1 -n 43 > nul && copy "C:\Users\test22\AppData\Local\Temp\vbc.exe" "C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe" && ping 127.0.0.1 -n 43 > nul && "C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe" filepath_r: stack_pivoted: 0 creation_flags: 134217728 (CREATE_NO_WINDOW) inherit_handles: 1 process_handle: 0x00000448	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW March 20, 2023, 9:47 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (5 events)

cmdline	ping 127.0.0.1 -n 43
cmdline	"cmd" /c ping 127.0.0.1 -n 37 > nul && REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe,"
cmdline	"cmd" /c ping 127.0.0.1 -n 43 > nul && copy "C:\Users\test22\AppData\Local\Temp\vbc.exe" "C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe" && ping 127.0.0.1 -n 43 > nul && "C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe"
cmdline	REG ADD "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Winlogon" /f /v "Shell" /t REG_SZ /d "explorer.exe,C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe,"
cmdline	ping 127.0.0.1 -n 37

A process attempted to delay the analysis task. (1 event)

description

vbc.exe tried to sleep 2728238 seconds, actually delayed analysis time by 2728238 seconds

Installs itself for autorun at Windows startup (1 event)

reg_key

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell

reg_value

explorer.exe,C:\Users\test22\AppData\Roaming\fdjmcgn\shdjchvh.exe,

Attempts to remove evidence of file being downloaded from the Internet (1 event)

file	C:\Users\test22\AppData\Local\Temp\vbc.exe\:Zone.Identifier

Executed a process and injected code into it, probably while unpacking (50 out of 67 events)

Time & API	Arguments	Status
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000dc suspend_count: 1 process_identifier: 508	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x0000014c suspend_count: 1 process_identifier: 508	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x00000188 suspend_count: 1 process_identifier: 508	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x00000398 suspend_count: 1 process_identifier: 508	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000003b4 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtSetContextThread March 20, 2023, 9:47 a.m.	registers.eip: 1945840516 registers.esp: 3071932 registers.edi: 0 registers.eax: 1 registers.ebp: 3072012 registers.edx: 0 registers.ebx: 40355604 registers.esi: 49 registers.ecx: 3072040 thread_handle: 0x000000e0 process_identifier: 508	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtSetContextThread March 20, 2023, 9:47 a.m.	registers.eip: 1945840516 registers.esp: 3072056 registers.edi: -1 registers.eax: 49 registers.ebp: 3072068 registers.edx: 3072228 registers.ebx: 3072090 registers.esi: 1 registers.ecx: 3072232 thread_handle: 0x000000e0 process_identifier: 508	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtResumeThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0 suspend_count: 1 process_identifier: 508	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1
NtGetContextThread March 20, 2023, 9:47 a.m.	thread_handle: 0x000000e0	1

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Bkav	W32.AIDetectNet.01
Lionic	Trojan.Win32.Generic.loK7
tehtris	Generic.Malware
MicroWorld-eScan	Gen:Variant.MSILHeracles.72212
CAT-QuickHeal	Trojan.Multi
McAfee	GenericRXSM-NK!CA8572B2750B
Malwarebytes	Trojan.Downloader.MSIL
VIPRE	Gen:Variant.MSILHeracles.72212
Sangfor	Trojan.Msil.Kryptik.V606
K7AntiVirus	Trojan ( 005a0e401 )
Alibaba	Ransom:MSIL/Blocker.4628b02b
K7GW	Trojan ( 005a0e401 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.MSILHeracles.D11A14
VirIT	Trojan.Win32.MSIL_Heur.A
Cyren	W32/MSIL_Kryptik.DSM.gen!Eldorado
Symantec	Trojan Horse
Elastic	malicious (high confidence)
ESET-NOD32	a variant of MSIL/GenKryptik.GHRZ
Cynet	Malicious (score: 99)
Paloalto	generic.ml
Kaspersky	HEUR:Trojan-Ransom.MSIL.Blocker.gen
BitDefender	Gen:Variant.MSILHeracles.72212
Avast	Win32:PWSX-gen [Trj]
Tencent	Msil.Trojan-Ransom.Blocker.Nsmw
Sophos	ML/PE-A
DrWeb	Trojan.MulDrop21.50578
TrendMicro	TROJ_GEN.R002C0PCH23
McAfee-GW-Edition	GenericRXSM-NK!CA8572B2750B
FireEye	Generic.mg.ca8572b2750b75f7
Emsisoft	Gen:Variant.MSILHeracles.72212 (B)
Ikarus	Trojan-Spy.Keylogger.Snake
Webroot	W32.Trojan.Gen
Avira	TR/Kryptik.iqcvi
Antiy-AVL	Trojan/MSIL.GenKryptik
Gridinsoft	Ransom.Win32.Wacatac.sa
Xcitium	Malware@#2e8slrh0lvtpu
Microsoft	Trojan:Win32/Casdet!rfn
ViRobot	Trojan.Win.Z.Genkryptik.3107840
GData	Gen:Variant.MSILHeracles.72212
Google	Detected
AhnLab-V3	Trojan/Win.NK.C5396686
BitDefenderTheta	Gen:NN.ZemsilF.36344.9o0@aK3Cmsp
ALYac	Gen:Variant.MSILHeracles.72212
MAX	malware (ai score=83)
Cylance	unsafe
TrendMicro-HouseCall	TROJ_GEN.R002C0PCH23
Rising	Malware.Obfus/MSIL@AI.100 (RDM.MSIL2:n/AK9OuZ6KmCYj7w3Q6RFA)
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	MSIL/GenKryptik.GHRZ!tr

vbc.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All