popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

vbc.exe

Malicious Library UPX JPEG Format PE32 PE File
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 March 29, 2023, 5:33 p.m. March 29, 2023, 5:41 p.m.
Size 500.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 4da41093eb4cce80c18d1e6a2391ba80
SHA256 f628532a482840b66c9fdf0ed09de86b63418e1f2cc3bbff139f54482f895d43
CRC32 E42BAD34
ssdeep 6144:+Ya6HI+QksRbJpnYqzFNZDPln6PJWJIFwYdga6c4jLvw1SxhDUoj+Xxk1Zci2E6e:+Y1I+QkunY8LzlOWi2HjHw1k15FqvK
Yara
  • UPX_Zero - UPX packed file
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature

Name Response Post-Analysis Lookup
top.not2beabused01.xyz
A 38.117.65.122
38.117.65.122
IP Address Status Action
164.124.101.2 Active Moloch
38.117.65.122 Active Moloch
45.33.6.223 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 38.117.65.122:1558 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49165
38.117.65.122:1558 		None None None

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2564
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x732a2000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00650000
allocation_type: 12288 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2664
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00660000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2708
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73562000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445552\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888884\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111118\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666668\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667772\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777881\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111116\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555556\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122223\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777788888888889999999998\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888888887\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334442\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777778888888888991\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777780\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555554\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 10\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1112\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666669\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666670\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888888888899999996\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556662\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666665\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777788888888889\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777775\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444446\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111120\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444448\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444551\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777788888888889992\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222331\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555560\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 2\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777778888888888999994\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333441\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 7\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333340\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777778882\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666771\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222225\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333335\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444447\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777779\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888888888899999999999\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111111111222222222233333333334444444444555555555566666666667777777777888888888890\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 1111115\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777776\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 111111111122222222223333333333444444444455555555556666666666777777777788883\Network\Cookies
file C:\Users\test22\AppData\Local\Google\Chrome\User Data\Profile 11111111112222222222333333333344444444445555555555666666666677777777778888888888999999997\Network\Cookies
file C:\Users\test22\AppData\Local\Temp\tqchnnl.exe
file C:\Users\test22\AppData\Roaming\ukyerc\irsqhssjjf.exe
file C:\Users\test22\AppData\Roaming\ukyerc\irsqhssjjf.exe
host 45.33.6.223
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\odsnqyon reg_value C:\Users\test22\AppData\Roaming\ukyerc\irsqhssjjf.exe "C:\Users\test22\AppData\Local\Temp\tqchnnl.exe" C:\Users\test22\AppData\Lo
Time & API Arguments Status Return Repeated

SetWindowsHookExA

 thread_identifier: 0
callback_function: 0x004098a7
hook_identifier: 13 (WH_KEYBOARD_LL)
module_address: 0x00400000
1 5767561 0
Process injection Process 2664 called NtSetContextThread to modify thread in remote process 2708
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1638384
registers.edi: 0
registers.eax: 4402970
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000e0
process_identifier: 2708
1 0 0
Lionic Trojan.Win32.Agent.tshg
MicroWorld-eScan Gen:Variant.Babar.172540
McAfee Artemis!4DA41093EB4C
VIPRE Gen:Variant.Babar.172540
Sangfor Trojan.Win32.Agent.Abzr
CrowdStrike win/malicious_confidence_100% (D)
Arcabit Trojan.Babar.D2A1FC
Symantec Packed.NSISPacker!g14
Elastic malicious (high confidence)
ESET-NOD32 a variant of Win32/Injector.ESVD
Cynet Malicious (score: 100)
APEX Malicious
Paloalto generic.ml
Kaspersky UDS:DangerousObject.Multi.Generic
BitDefender Gen:Variant.Babar.172540
Avast Win32:Malware-gen
McAfee-GW-Edition BehavesLike.Win32.VTFlooder.hc
FireEye Generic.mg.4da41093eb4cce80
Emsisoft Gen:Variant.Babar.172540 (B)
SentinelOne Static AI - Suspicious PE
Avira HEUR/AGEN.1337962
MAX malware (ai score=80)
Microsoft Trojan:Win32/Sabsik.FL.B!ml
GData Gen:Variant.Babar.172540
Google Detected
VBA32 BScope.Trojan.Agent
ALYac Gen:Variant.Babar.172540
Rising Trojan.Injector!1.E3C9 (CLASSIC)
Ikarus Trojan.Inject
Fortinet W32/ShellcodeRunner.CA!tr
AVG Win32:Malware-gen