Edit tour

Windows Analysis Report
vbc.exe

Overview

General Information

Sample Name:	vbc.exe
Analysis ID:	562293
MD5:	345ebabc50767d04f3457fa7790a8777
SHA1:	f822fa282003b1a3f9301156aa5639a6928b93fd
SHA256:	2ca98a5a8b6bdd9eac1fdf5c05e42792883dea0ae402a6148bc6f04204cc6b72
Tags:	exe
Infos:

Detection

AgentTesla

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Malicious sample detected (through community Yara rule)

Yara detected AgentTesla

Yara detected AntiVM3

Antivirus detection for URL or domain

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Machine Learning detection for sample

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

.NET source code contains method to dynamically call methods (often used by packers)

.NET source code contains very large array initializations

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Yara detected Credential Stealer

Contains long sleeps (>= 3 min)

Abnormal high CPU Usage

Enables debug privileges

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Sample file is different than original file name gathered from version info

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

vbc.exe (PID: 6908 cmdline: "C:\Users\user\Desktop\vbc.exe" MD5: 345EBABC50767D04F3457FA7790A8777)

vbc.exe (PID: 6736 cmdline: C:\Users\user\Desktop\vbc.exe MD5: 345EBABC50767D04F3457FA7790A8777)

cleanup

Malware Configuration

Threatname: Agenttesla

{"Exfil Mode": "FTP", "FTP Host": "ftp://primesinsured.com/", "Username": "oil1@primesinsured.com", "Password": "R0r?~C#w}a*s"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000B.00000000.329971875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000000.329971875.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0000000B.00000000.329385221.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000000.329385221.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000B.00000002.550450348.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.550450348.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2096:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time 0x267e:$m2: %image/jpg:Zone.Identifier\tmpG.tmp%urlkey%-f \Data\Tor\torrcp=%PostURL%127.0.0.1POST+%2B 0x2bca:$m3: >{CTRL}</font>Windows RDPcredentialpolicyblobrdgchrome{{{0}}}CopyToComputeHashsha512CopySystemDrive\WScript.ShellRegReadg401
0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 6908	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 6908	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: vbc.exe PID: 6736	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
Process Memory Space: vbc.exe PID: 6736	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: vbc.exe PID: 6736	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x4199:$s1: get_kbok 0x62cae:$s1: get_kbok 0x4a19:$s2: get_CHoo 0x6352e:$s2: get_CHoo 0x55b4:$s3: set_passwordIsSet 0x640c9:$s3: set_passwordIsSet 0x4045:$s4: get_enableLog 0x62b5a:$s4: get_enableLog 0x34ad:$g1: get_Clipboard 0x61fc2:$g1: get_Clipboard 0x34bb:$g2: get_Keyboard 0x61fd0:$g2: get_Keyboard 0x34c8:$g3: get_Password 0x61fdd:$g3: get_Password 0x48f3:$g4: get_CtrlKeyDown 0x63408:$g4: get_CtrlKeyDown 0x4903:$g5: get_ShiftKeyDown 0x63418:$g5: get_ShiftKeyDown 0x4914:$g6: get_AltKeyDown 0x63429:$g6: get_AltKeyDown 0x31421:$m1: yyyy-MM-dd hh-mm-ssCookieapplication/zipSCSC_.jpegScreenshotimage/jpeg/log.tmpKLKL_.html<html></html>Logtext/html[]Time
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.vbc.exe.25ad8bc.1.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.vbc.exe.25ad8bc.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x8860:$v1: SbieDll.dll 0x887a:$v2: USER 0x8886:$v3: SANDBOX 0x8898:$v4: VIRUS 0x88e8:$v4: VIRUS 0x88a6:$v5: MALWARE 0x88b8:$v6: SCHMIDTI 0x88cc:$v7: CURRENTUSER
11.0.vbc.exe.400000.12.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.12.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.12.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c4a:$s1: get_kbok 0x3157e:$s2: get_CHoo 0x321d9:$s3: set_passwordIsSet 0x30a4e:$s4: get_enableLog 0x350f3:$s8: torbrowser 0x33acf:$s10: logins 0x33447:$s11: credential 0x2fe39:$g1: get_Clipboard 0x2fe47:$g2: get_Keyboard 0x2fe54:$g3: get_Password 0x3142c:$g4: get_CtrlKeyDown 0x3143c:$g5: get_ShiftKeyDown 0x3144d:$g6: get_AltKeyDown
0.2.vbc.exe.35c3d80.3.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.35c3d80.3.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.35c3d80.3.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2ee4a:$s1: get_kbok 0x2f77e:$s2: get_CHoo 0x303d9:$s3: set_passwordIsSet 0x2ec4e:$s4: get_enableLog 0x332f3:$s8: torbrowser 0x31ccf:$s10: logins 0x31647:$s11: credential 0x2e039:$g1: get_Clipboard 0x2e047:$g2: get_Keyboard 0x2e054:$g3: get_Password 0x2f62c:$g4: get_CtrlKeyDown 0x2f63c:$g5: get_ShiftKeyDown 0x2f64d:$g6: get_AltKeyDown
11.0.vbc.exe.400000.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c4a:$s1: get_kbok 0x3157e:$s2: get_CHoo 0x321d9:$s3: set_passwordIsSet 0x30a4e:$s4: get_enableLog 0x350f3:$s8: torbrowser 0x33acf:$s10: logins 0x33447:$s11: credential 0x2fe39:$g1: get_Clipboard 0x2fe47:$g2: get_Keyboard 0x2fe54:$g3: get_Password 0x3142c:$g4: get_CtrlKeyDown 0x3143c:$g5: get_ShiftKeyDown 0x3144d:$g6: get_AltKeyDown
11.0.vbc.exe.400000.8.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.8.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.8.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c4a:$s1: get_kbok 0x3157e:$s2: get_CHoo 0x321d9:$s3: set_passwordIsSet 0x30a4e:$s4: get_enableLog 0x350f3:$s8: torbrowser 0x33acf:$s10: logins 0x33447:$s11: credential 0x2fe39:$g1: get_Clipboard 0x2fe47:$g2: get_Keyboard 0x2fe54:$g3: get_Password 0x3142c:$g4: get_CtrlKeyDown 0x3143c:$g5: get_ShiftKeyDown 0x3144d:$g6: get_AltKeyDown
11.0.vbc.exe.400000.10.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.10.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.10.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c4a:$s1: get_kbok 0x3157e:$s2: get_CHoo 0x321d9:$s3: set_passwordIsSet 0x30a4e:$s4: get_enableLog 0x350f3:$s8: torbrowser 0x33acf:$s10: logins 0x33447:$s11: credential 0x2fe39:$g1: get_Clipboard 0x2fe47:$g2: get_Keyboard 0x2fe54:$g3: get_Password 0x3142c:$g4: get_CtrlKeyDown 0x3143c:$g5: get_ShiftKeyDown 0x3144d:$g6: get_AltKeyDown
0.2.vbc.exe.35f9da0.4.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.35f9da0.4.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.35f9da0.4.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x2ee4a:$s1: get_kbok 0x2f77e:$s2: get_CHoo 0x303d9:$s3: set_passwordIsSet 0x2ec4e:$s4: get_enableLog 0x332f3:$s8: torbrowser 0x31ccf:$s10: logins 0x31647:$s11: credential 0x2e039:$g1: get_Clipboard 0x2e047:$g2: get_Keyboard 0x2e054:$g3: get_Password 0x2f62c:$g4: get_CtrlKeyDown 0x2f63c:$g5: get_ShiftKeyDown 0x2f64d:$g6: get_AltKeyDown
11.2.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.2.vbc.exe.400000.0.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.2.vbc.exe.400000.0.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c4a:$s1: get_kbok 0x3157e:$s2: get_CHoo 0x321d9:$s3: set_passwordIsSet 0x30a4e:$s4: get_enableLog 0x350f3:$s8: torbrowser 0x33acf:$s10: logins 0x33447:$s11: credential 0x2fe39:$g1: get_Clipboard 0x2fe47:$g2: get_Keyboard 0x2fe54:$g3: get_Password 0x3142c:$g4: get_CtrlKeyDown 0x3143c:$g5: get_ShiftKeyDown 0x3144d:$g6: get_AltKeyDown
11.0.vbc.exe.400000.6.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.6.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
11.0.vbc.exe.400000.6.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c4a:$s1: get_kbok 0x3157e:$s2: get_CHoo 0x321d9:$s3: set_passwordIsSet 0x30a4e:$s4: get_enableLog 0x350f3:$s8: torbrowser 0x33acf:$s10: logins 0x33447:$s11: credential 0x2fe39:$g1: get_Clipboard 0x2fe47:$g2: get_Keyboard 0x2fe54:$g3: get_Password 0x3142c:$g4: get_CtrlKeyDown 0x3143c:$g5: get_ShiftKeyDown 0x3144d:$g6: get_AltKeyDown
0.2.vbc.exe.262cd90.2.raw.unpack	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
0.2.vbc.exe.262cd90.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x222498:$v1: SbieDll.dll 0x2224b2:$v2: USER 0x2224be:$v3: SANDBOX 0x2224d0:$v4: VIRUS 0x222520:$v4: VIRUS 0x2224de:$v5: MALWARE 0x2224f0:$v6: SCHMIDTI 0x222504:$v7: CURRENTUSER
0.2.vbc.exe.35c3d80.3.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.35c3d80.3.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.35c3d80.3.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c4a:$s1: get_kbok 0x66c6a:$s1: get_kbok 0x9ca8a:$s1: get_kbok 0x3157e:$s2: get_CHoo 0x6759e:$s2: get_CHoo 0x9d3be:$s2: get_CHoo 0x321d9:$s3: set_passwordIsSet 0x681f9:$s3: set_passwordIsSet 0x9e019:$s3: set_passwordIsSet 0x30a4e:$s4: get_enableLog 0x66a6e:$s4: get_enableLog 0x9c88e:$s4: get_enableLog 0x350f3:$s8: torbrowser 0x6b113:$s8: torbrowser 0xa0f33:$s8: torbrowser 0x33acf:$s10: logins 0x69aef:$s10: logins 0x9f90f:$s10: logins 0x33447:$s11: credential 0x69467:$s11: credential 0x9f287:$s11: credential
0.2.vbc.exe.35f9da0.4.raw.unpack	JoeSecurity_AgentTesla_1	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.35f9da0.4.raw.unpack	JoeSecurity_AgentTesla_2	Yara detected AgentTesla	Joe Security
0.2.vbc.exe.35f9da0.4.raw.unpack	MALWARE_Win_AgentTeslaV3	AgentTeslaV3 infostealer payload	ditekSHen	0x30c4a:$s1: get_kbok 0x66a6a:$s1: get_kbok 0x3157e:$s2: get_CHoo 0x6739e:$s2: get_CHoo 0x321d9:$s3: set_passwordIsSet 0x67ff9:$s3: set_passwordIsSet 0x30a4e:$s4: get_enableLog 0x6686e:$s4: get_enableLog 0x350f3:$s8: torbrowser 0x6af13:$s8: torbrowser 0x33acf:$s10: logins 0x698ef:$s10: logins 0x33447:$s11: credential 0x69267:$s11: credential 0x2fe39:$g1: get_Clipboard 0x65c59:$g1: get_Clipboard 0x2fe47:$g2: get_Keyboard 0x65c67:$g2: get_Keyboard 0x2fe54:$g3: get_Password 0x65c74:$g3: get_Password 0x3142c:$g4: get_CtrlKeyDown
Click to see the 29 entries

Sigma Overview

⊘No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 0.2.vbc.exe.35c3d80.3.unpack

Malware Configuration Extractor: Agenttesla {"Exfil Mode": "FTP", "FTP Host": "ftp://primesinsured.com/", "Username": "oil1@primesinsured.com", "Password": "R0r?~C#w}a*s"}

Antivirus detection for URL or domain

Source: ftp://primesinsured.com/oil1	Avira URL Cloud: Label: malware
Source: http://primesinsured.com	Avira URL Cloud: Label: malware

Machine Learning detection for sample

Source: vbc.exe

Joe Sandbox ML: detected

Source: 11.2.vbc.exe.400000.0.unpack	Avira: Label: TR/Spy.Gen8
Source: 11.0.vbc.exe.400000.12.unpack	Avira: Label: TR/Spy.Gen8
Source: 11.0.vbc.exe.400000.4.unpack	Avira: Label: TR/Spy.Gen8
Source: 11.0.vbc.exe.400000.10.unpack	Avira: Label: TR/Spy.Gen8
Source: 11.0.vbc.exe.400000.8.unpack	Avira: Label: TR/Spy.Gen8
Source: 11.0.vbc.exe.400000.6.unpack	Avira: Label: TR/Spy.Gen8

Source: vbc.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: vbc.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: CallConvFastca.pdbx2 source: vbc.exe
Source:	Binary string: CallConvFastca.pdb source: vbc.exe

Networking

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2029927 ET TROJAN AgentTesla Exfil via FTP 192.168.2.3:49812 -> 199.188.206.78:21
Source: Traffic	Snort IDS: 2029928 ET TROJAN AgentTesla HTML System Info Report Exfil via FTP 192.168.2.3:49813 -> 199.188.206.78:12034

Source: vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: ftp://primesinsured.com/oil1
Source: vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://127.0.0.1:HTTP/1.1
Source: vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://DynDns.comDynDNS
Source: vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://FujuYs.com
Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://blog.iandreev.com
Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://blog.iandreev.com/
Source: vbc.exe, 00000000.00000003.288085898.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://en.wl
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://fontfabrik.com
Source: vbc.exe, 0000000B.00000002.552364653.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://go.microsoft.c
Source: vbc.exe, 0000000B.00000002.553724547.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://primesinsured.com
Source: vbc.exe, 0000000B.00000002.553724547.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: vbc.exe, 00000000.00000003.295478848.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.295650010.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: vbc.exe, 00000000.00000003.320318684.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: vbc.exe, 00000000.00000003.305314451.00000000054BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: vbc.exe, 00000000.00000003.320831898.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.320318684.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers;YHB
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: vbc.exe, 00000000.00000003.319218724.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersi
Source: vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comcomp
Source: vbc.exe, 00000000.00000003.305314451.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comd
Source: vbc.exe, 00000000.00000003.319218724.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comgrita
Source: vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comicF
Source: vbc.exe, 00000000.00000003.305314451.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comitu
Source: vbc.exe, 00000000.00000003.321182512.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.319218724.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.335938157.00000000054B0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.321670315.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.320318684.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.321479989.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comm
Source: vbc.exe, 00000000.00000003.321182512.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.320831898.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.321670315.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.320318684.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.321479989.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commFQ
Source: vbc.exe, 00000000.00000003.320831898.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.commi
Source: vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comp
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: vbc.exe, 00000000.00000003.294003102.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.c
Source: vbc.exe, 00000000.00000003.294003102.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.293797382.00000000054B5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.293458280.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: vbc.exe, 00000000.00000003.294003102.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cnl-n%U
Source: vbc.exe, 00000000.00000003.294003102.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cns-cUUfBc
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: vbc.exe, 00000000.00000003.298537749.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296903307.00000000054BB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.298820030.00000000054BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: vbc.exe, 00000000.00000003.296903307.00000000054BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/es-e
Source: vbc.exe, 00000000.00000003.298537749.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.298820030.00000000054BD000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: vbc.exe, 00000000.00000003.296903307.00000000054BB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/s/
Source: vbc.exe, 00000000.00000003.300582206.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.monotype.
Source: vbc.exe, 00000000.00000003.294353802.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292252659.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.289073327.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296400065.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.294783206.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.294577733.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.297070022.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296519635.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.297183571.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288494722.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.295211744.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296861565.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288094358.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290579536.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288206661.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288301726.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292091403.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288611613.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292994787.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290816348.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290719007.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: vbc.exe, 00000000.00000003.294353802.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292252659.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.289073327.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296400065.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.294783206.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.294577733.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.297070022.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296519635.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.297183571.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288494722.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.295211744.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296861565.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288094358.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290579536.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288206661.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288301726.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292091403.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288611613.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292994787.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290816348.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290719007.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.come
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.298484465.00000000054E4000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: vbc.exe, 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vknyDOC1PaH7u.com
Source: vbc.exe, 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://vknyDOC1PaH7u.comD
Source: vbc.exe, 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip
Source: vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha

Source: unknown

DNS traffic detected: queries for: primesinsured.com

System Summary

Malicious sample detected (through community Yara rule)

Source: 0.2.vbc.exe.25ad8bc.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 11.0.vbc.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.vbc.exe.35c3d80.3.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 11.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 11.0.vbc.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 11.0.vbc.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.vbc.exe.35f9da0.4.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 11.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 11.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.vbc.exe.262cd90.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 0.2.vbc.exe.35c3d80.3.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0.2.vbc.exe.35f9da0.4.raw.unpack, type: UNPACKEDPE	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen
Source: Process Memory Space: vbc.exe PID: 6736, type: MEMORYSTR	Matched rule: AgentTeslaV3 infostealer payload Author: ditekSHen

.NET source code contains very large array initializations

Source: 11.2.vbc.exe.400000.0.unpack, u003cPrivateImplementationDetailsu003eu007b1FA04608u002dF754u002d4784u002d9D27u002d53158C5E6177u007d/u003451A691Bu002d4BE7u002d43E4u002dB9BEu002d1BBD2F43E201.cs	Large array initialization: .cctor: array initializer size 11947
Source: 11.0.vbc.exe.400000.12.unpack, u003cPrivateImplementationDetailsu003eu007b1FA04608u002dF754u002d4784u002d9D27u002d53158C5E6177u007d/u003451A691Bu002d4BE7u002d43E4u002dB9BEu002d1BBD2F43E201.cs	Large array initialization: .cctor: array initializer size 11947
Source: 11.0.vbc.exe.400000.4.unpack, u003cPrivateImplementationDetailsu003eu007b1FA04608u002dF754u002d4784u002d9D27u002d53158C5E6177u007d/u003451A691Bu002d4BE7u002d43E4u002dB9BEu002d1BBD2F43E201.cs	Large array initialization: .cctor: array initializer size 11947
Source: 11.0.vbc.exe.400000.10.unpack, u003cPrivateImplementationDetailsu003eu007b1FA04608u002dF754u002d4784u002d9D27u002d53158C5E6177u007d/u003451A691Bu002d4BE7u002d43E4u002dB9BEu002d1BBD2F43E201.cs	Large array initialization: .cctor: array initializer size 11947

Source: vbc.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED

Source: 0.2.vbc.exe.25ad8bc.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 11.0.vbc.exe.400000.12.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.vbc.exe.35c3d80.3.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 11.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 11.0.vbc.exe.400000.8.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 11.0.vbc.exe.400000.10.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.vbc.exe.35f9da0.4.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 11.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 11.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.vbc.exe.262cd90.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 0.2.vbc.exe.35c3d80.3.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0.2.vbc.exe.35f9da0.4.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload
Source: Process Memory Space: vbc.exe PID: 6736, type: MEMORYSTR	Matched rule: MALWARE_Win_AgentTeslaV3 author = ditekSHen, description = AgentTeslaV3 infostealer payload

Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_000F82BC	0_2_000F82BC
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_04A875FA	0_2_04A875FA
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_04A87608	0_2_04A87608
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_04A8784A	0_2_04A8784A
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_04A87858	0_2_04A87858
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_077A0040	0_2_077A0040
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_077A001B	0_2_077A001B
Source: C:\Users\user\Desktop\vbc.exe	Code function: 11_2_005982BC	11_2_005982BC
Source: C:\Users\user\Desktop\vbc.exe	Code function: 11_2_010247A0	11_2_010247A0
Source: C:\Users\user\Desktop\vbc.exe	Code function: 11_2_010246B0	11_2_010246B0
Source: C:\Users\user\Desktop\vbc.exe	Code function: 11_2_05D16508	11_2_05D16508
Source: C:\Users\user\Desktop\vbc.exe	Code function: 11_2_05D17120	11_2_05D17120
Source: C:\Users\user\Desktop\vbc.exe	Code function: 11_2_05D190D8	11_2_05D190D8
Source: C:\Users\user\Desktop\vbc.exe	Code function: 11_2_05D16850	11_2_05D16850

Source: C:\Users\user\Desktop\vbc.exe

Process Stats: CPU usage > 98%

Source: vbc.exe, 00000000.00000002.333499841.00000000025BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCallConvFastca.exe4 vs vbc.exe
Source: vbc.exe, 00000000.00000002.333499841.00000000025BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs vbc.exe
Source: vbc.exe, 00000000.00000002.333499841.00000000025BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: i,\\StringFileInfo\\000004B0\\OriginalFilename vs vbc.exe
Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs vbc.exe
Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs vbc.exe
Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqnrBzDfMzbzuUrHfqQEmuMLnIDuCnyDed.exe4 vs vbc.exe
Source: vbc.exe, 00000000.00000002.331822022.00000000001C6000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCallConvFastca.exe4 vs vbc.exe
Source: vbc.exe, 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs vbc.exe
Source: vbc.exe, 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqnrBzDfMzbzuUrHfqQEmuMLnIDuCnyDed.exe4 vs vbc.exe
Source: vbc.exe, 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs vbc.exe
Source: vbc.exe, 00000000.00000002.337462496.0000000007650000.00000004.08000000.00040000.00000000.sdmp	Binary or memory string: OriginalFilenameUI.dllF vs vbc.exe
Source: vbc.exe, 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqnrBzDfMzbzuUrHfqQEmuMLnIDuCnyDed.exe4 vs vbc.exe
Source: vbc.exe, 0000000B.00000000.328508532.0000000000666000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCallConvFastca.exe4 vs vbc.exe
Source: vbc.exe	Binary or memory string: OriginalFilenameCallConvFastca.exe4 vs vbc.exe

Source: C:\Users\user\Desktop\vbc.exe

File read: C:\Users\user\Desktop\vbc.exe:Zone.Identifier

Jump to behavior

Source: vbc.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\vbc.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\vbc.exe "C:\Users\user\Desktop\vbc.exe"
Source: C:\Users\user\Desktop\vbc.exe	Process created: C:\Users\user\Desktop\vbc.exe C:\Users\user\Desktop\vbc.exe
Source: C:\Users\user\Desktop\vbc.exe	Process created: C:\Users\user\Desktop\vbc.exe C:\Users\user\Desktop\vbc.exe	Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{172BDDF8-CEEA-11D1-8B05-00600806D9B6}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\vbc.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.evad.winEXE@3/1@1/0

Source: C:\Users\user\Desktop\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll			Jump to behavior

Source: vbc.exe, Oz/uT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: vbc.exe, Oz/uT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.vbc.exe.f0000.0.unpack, Oz/uT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.0.vbc.exe.f0000.0.unpack, Oz/uT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.vbc.exe.f0000.0.unpack, Oz/uT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 0.2.vbc.exe.f0000.0.unpack, Oz/uT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.0.vbc.exe.590000.0.unpack, Oz/uT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.0.vbc.exe.590000.0.unpack, Oz/uT.cs	Cryptographic APIs: 'CreateDecryptor'
Source: 11.2.vbc.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'
Source: 11.2.vbc.exe.400000.0.unpack, A/b2.cs	Cryptographic APIs: 'TransformFinalBlock', 'CreateDecryptor'

Source: C:\Users\user\Desktop\vbc.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: vbc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: vbc.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: vbc.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: CallConvFastca.pdbx2 source: vbc.exe
Source:	Binary string: CallConvFastca.pdb source: vbc.exe

Data Obfuscation

.NET source code contains potential unpacker

Source: vbc.exe, va/x0.cs	.Net Code: eQb System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.vbc.exe.f0000.0.unpack, va/x0.cs	.Net Code: eQb System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.vbc.exe.f0000.0.unpack, va/x0.cs	.Net Code: eQb System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.vbc.exe.590000.0.unpack, va/x0.cs	.Net Code: eQb System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.vbc.exe.590000.11.unpack, va/x0.cs	.Net Code: eQb System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.vbc.exe.590000.3.unpack, va/x0.cs	.Net Code: eQb System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.vbc.exe.590000.9.unpack, va/x0.cs	.Net Code: eQb System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 11.0.vbc.exe.590000.7.unpack, va/x0.cs	.Net Code: eQb System.Reflection.Assembly System.AppDomain::Load(System.Byte[])

.NET source code contains method to dynamically call methods (often used by packers)

Source: vbc.exe, Oz/uT.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.0.vbc.exe.f0000.0.unpack, Oz/uT.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 0.2.vbc.exe.f0000.0.unpack, Oz/uT.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 11.0.vbc.exe.590000.0.unpack, Oz/uT.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 11.0.vbc.exe.590000.11.unpack, Oz/uT.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 11.0.vbc.exe.590000.3.unpack, Oz/uT.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 11.0.vbc.exe.590000.9.unpack, Oz/uT.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)
Source: 11.0.vbc.exe.590000.7.unpack, Oz/uT.cs	.Net Code: stackVariable1.GetMethod("GetDelegateForFunctionPointer", V_0)

Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_077A3C4F pushfd ; retf	0_2_077A3C50
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_077A3CA3 push edx; retf	0_2_077A3CA6
Source: C:\Users\user\Desktop\vbc.exe	Code function: 0_2_077A4486 push ebx; ret	0_2_077A448D
Source: C:\Users\user\Desktop\vbc.exe	Code function: 11_2_05D17AE8 push 8BF04589h; iretd	11_2_05D17B74

Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0.2.vbc.exe.25ad8bc.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.262cd90.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6908, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL
Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Queries sensitive network adapter information (via WMI, Win32_NetworkAdapter, often done to detect virtual machines)

Source: C:\Users\user\Desktop\vbc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_NetworkAdapterConfiguration

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\vbc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BaseBoard

Source: C:\Users\user\Desktop\vbc.exe TID: 6912	Thread sleep time: -39878s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe TID: 6956	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe TID: 2056	Thread sleep time: -18446744073709540s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe TID: 240	Thread sleep count: 3384 > 30	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe TID: 240	Thread sleep count: 6428 > 30	Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Window / User API: threadDelayed 3384			Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Window / User API: threadDelayed 6428			Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor

Source: C:\Users\user\Desktop\vbc.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 39878	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: vbc.exe, 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameqnrBzDfMzbzuUrHfqQEmuMLnIDuCnyDed.exe4
Source: vbc.exe, 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: qnrBzDfMzbzuUrHfqQEmuMLnIDuCnyDed.exe
Source: vbc.exe, 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vbc.exe, 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: vbc.exe, 0000000B.00000002.554785822.0000000005E70000.00000004.00000010.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dlloo6V
Source: vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: InternalNameqnrBzDfMzbzuUrHfqQEmuMLnIDuCnyDed.exe(
Source: vbc.exe, 0000000B.00000002.552944691.0000000000F30000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: qnrBzDfMzbzuUrHfqQEmuMLnIDuCnyDedt
Source: vbc.exe, 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 0000000B.00000002.552944691.0000000000F30000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000000B.00000002.552364653.0000000000C15000.00000004.00000020.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: qnrBzDfMzbzuUrHfqQEmuMLnIDuCnyDed
Source: vbc.exe, 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Source: C:\Users\user\Desktop\vbc.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\vbc.exe

Memory written: C:\Users\user\Desktop\vbc.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Process created: C:\Users\user\Desktop\vbc.exe C:\Users\user\Desktop\vbc.exe

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Users\user\Desktop\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Users\user\Desktop\vbc.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\vbc.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\Desktop\vbc.exe

Code function: 11_2_05D15594 GetUserNameW,

11_2_05D15594

Stealing of Sensitive Information

Yara detected AgentTesla

Source: Yara match	File source: 11.0.vbc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.35c3d80.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.vbc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.vbc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.35f9da0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.35c3d80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.35f9da0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.329971875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.329385221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.550450348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6736, type: MEMORYSTR

Source: Yara match	File source: 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6736, type: MEMORYSTR

Remote Access Functionality

Yara detected AgentTesla

Source: Yara match	File source: 11.0.vbc.exe.400000.12.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.35c3d80.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.vbc.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.vbc.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.vbc.exe.400000.10.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.35f9da0.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.0.vbc.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.35c3d80.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.vbc.exe.35f9da0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.329971875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.329385221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.550450348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6908, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: vbc.exe PID: 6736, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	211 Windows Management Instrumentation	Path Interception	111 Process Injection	1 Masquerading	OS Credential Dumping	211 Security Software Discovery	Remote Services	11 Archive Collected Data	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	1 Non-Application Layer Protocol	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	131 Virtualization/Sandbox Evasion	Security Account Manager	131 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	1 Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	111 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	1 Obfuscated Files or Information	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	21 Software Packing	DCSync	113 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
vbc.exe	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Download
11.2.vbc.exe.400000.0.unpack	100%	Avira	TR/Spy.Gen8	Download File
11.0.vbc.exe.400000.12.unpack	100%	Avira	TR/Spy.Gen8	Download File
11.0.vbc.exe.400000.4.unpack	100%	Avira	TR/Spy.Gen8	Download File
11.0.vbc.exe.400000.10.unpack	100%	Avira	TR/Spy.Gen8	Download File
11.0.vbc.exe.400000.8.unpack	100%	Avira	TR/Spy.Gen8	Download File
11.0.vbc.exe.400000.6.unpack	100%	Avira	TR/Spy.Gen8	Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.founder.com.cn/cns-cUUfBc	0%	Avira URL Cloud	safe
http://127.0.0.1:HTTP/1.1	0%	Avira URL Cloud	safe
http://blog.iandreev.com/	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.founder.c	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/s/	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
https://vknyDOC1PaH7u.com	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.fontbureau.comgrita	0%	URL Reputation	safe
http://www.fontbureau.commFQ	0%	Avira URL Cloud	safe
http://en.wl	0%	Avira URL Cloud	safe
http://FujuYs.com	0%	Avira URL Cloud	safe
http://www.fontbureau.comicF	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://vknyDOC1PaH7u.comD	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.fontbureau.commi	0%	Avira URL Cloud	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.sajatypeworks.come	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	0%	URL Reputation	safe
http://DynDns.comDynDNS	0%	URL Reputation	safe
http://www.founder.com.cn/cnl-n%U	0%	Avira URL Cloud	safe
ftp://primesinsured.com/oil1	100%	Avira URL Cloud	malware
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	0%	URL Reputation	safe
http://primesinsured.com	100%	Avira URL Cloud	malware
http://blog.iandreev.com	0%	Avira URL Cloud	safe
http://www.fontbureau.comcomp	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.fontbureau.comd	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.fontbureau.comm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.comp	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/es-e	0%	URL Reputation	safe
http://go.microsoft.c	0%	URL Reputation	safe
http://www.fontbureau.comitu	0%	URL Reputation	safe
http://www.fontbureau.comals	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
primesinsured.com	199.188.206.78	true	true		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.founder.com.cn/cns-cUUfBc	vbc.exe, 00000000.00000003.294003102.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1:HTTP/1.1	vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.com/designersG	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://blog.iandreev.com/	vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/?	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.tiro.com	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.c	vbc.exe, 00000000.00000003.294003102.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/s/	vbc.exe, 00000000.00000003.296903307.00000000054BB000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.com	vbc.exe, 00000000.00000003.294353802.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292252659.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.289073327.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296400065.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.294783206.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.294577733.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.297070022.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296519635.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.297183571.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288494722.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.295211744.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296861565.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288094358.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290579536.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288206661.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288301726.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292091403.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288611613.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292994787.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290816348.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290719007.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersi	vbc.exe, 00000000.00000003.319218724.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.typography.netD	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vknyDOC1PaH7u.com	vbc.exe, 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/cThe	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comgrita	vbc.exe, 00000000.00000003.319218724.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.commFQ	vbc.exe, 00000000.00000003.321182512.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.320831898.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.321670315.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.320318684.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.321479989.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://en.wl	vbc.exe, 00000000.00000003.288085898.00000000054B6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://FujuYs.com	vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comicF	vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/DPlease	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://vknyDOC1PaH7u.comD	vbc.exe, 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.commi	vbc.exe, 00000000.00000003.320831898.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	vbc.exe, 0000000B.00000002.553724547.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sajatypeworks.come	vbc.exe, 00000000.00000003.294353802.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292252659.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.289073327.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296400065.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.294783206.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.294577733.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.297070022.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296519635.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.297183571.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288494722.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.295211744.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296861565.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288094358.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290579536.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288206661.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288301726.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292091403.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.288611613.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.292994787.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290816348.00000000054CB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.290719007.00000000054CB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.298484465.00000000054E4000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip	vbc.exe, 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, vbc.exe, 0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	vbc.exe, 00000000.00000003.295478848.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.295650010.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	vbc.exe, 00000000.00000003.320318684.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://DynDns.comDynDNS	vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnl-n%U	vbc.exe, 00000000.00000003.294003102.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
ftp://primesinsured.com/oil1	vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
https://www.theonionrouter.com/dist.torproject.org/torbrowser/9.5.3/tor-win32-0.4.3.6.zip%tordir%%ha	vbc.exe, 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://primesinsured.com	vbc.exe, 0000000B.00000002.553724547.0000000002B3E000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://blog.iandreev.com	vbc.exe, 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers;YHB	vbc.exe, 00000000.00000003.320831898.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.320318684.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.comcomp	vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	vbc.exe, 00000000.00000003.298537749.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.298820030.00000000054BD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comd	vbc.exe, 00000000.00000003.305314451.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	vbc.exe, 00000000.00000003.294003102.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.293797382.00000000054B5000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.293458280.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.html	vbc.exe, 00000000.00000003.305314451.00000000054BD000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.monotype.	vbc.exe, 00000000.00000003.300582206.00000000054E3000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comm	vbc.exe, 00000000.00000003.321182512.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.319218724.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.335938157.00000000054B0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.321670315.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.320318684.00000000054B7000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.321479989.00000000054B7000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	vbc.exe, 00000000.00000003.298537749.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.296903307.00000000054BB000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.298820030.00000000054BD000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comp	vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/es-e	vbc.exe, 00000000.00000003.296903307.00000000054BB000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	vbc.exe, 00000000.00000002.336191347.0000000006742000.00000004.00000800.00020000.00000000.sdmp	false		high
http://go.microsoft.c	vbc.exe, 0000000B.00000002.552364653.0000000000C15000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comitu	vbc.exe, 00000000.00000003.305314451.00000000054BD000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comals	vbc.exe, 00000000.00000003.306388872.00000000054BE000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000000.00000003.306108860.00000000054BC000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown

World Map of Contacted IPs

⊘No contacted IP infos

General Information

Joe Sandbox Version:	34.0.0 Boulder Opal
Analysis ID:	562293
Start date:	28.01.2022
Start time:	18:24:41
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 9m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	vbc.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.evad.winEXE@3/1@1/0
EGA Information:	Successful, ratio: 100%
HDC Information:	Successful, ratio: 0.5% (good quality ratio 0.4%) Quality average: 51.5% Quality standard deviation: 37.4%
HCA Information:	Successful, ratio: 95% Number of executed functions: 38 Number of non-executed functions: 7
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, SgrmBroker.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe
Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtAllocateVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
18:25:53	API Interceptor	601x Sleep call for process: vbc.exe modified

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
primesinsured.com	ORDER_PO EM60921847.xlsx	Get hash	malicious	Browse	199.188.206.78
	Documents874399.xlsx	Get hash	malicious	Browse	199.188.206.78
	F3a5LmrScW.exe	Get hash	malicious	Browse	199.188.206.78
	Invoice.exe	Get hash	malicious	Browse	199.188.206.78

Process:	C:\Users\user\Desktop\vbc.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.572883902569515
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.83% Win32 Executable (generic) a (10002005/4) 49.78% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Win16/32 Executable Delphi generic (2074/23) 0.01% Generic Win/DOS Executable (2004/3) 0.01%
File name:	vbc.exe
File size:	860672
MD5:	345ebabc50767d04f3457fa7790a8777
SHA1:	f822fa282003b1a3f9301156aa5639a6928b93fd
SHA256:	2ca98a5a8b6bdd9eac1fdf5c05e42792883dea0ae402a6148bc6f04204cc6b72
SHA512:	8894559509ebd53a56a4649c25cb2380da6717c9171f7cb86b2df138463a4cf6979f27a81dfba6114621f169dbca17ee6e4ff44b6c4c4bafe2a74bad4e402b31
SSDEEP:	12288:v56/UhZo9xs63fvQAfo8y5gypOqw//wEkbpyXrf5r+2SF:v56/U/oF3RjSRQspy7fdgF
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.............................2... ...@....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General

Entrypoint:	0x4d329e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x61F3F50C [Fri Jan 28 13:52:12 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xd3250	0x4b	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xd6000	0x5c0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xd8000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0xd31fb	0x1c	.text
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0xd12a4	0xd1400	False	0.51688041368	data	6.57823573107	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.sdata	0xd4000	0x1e8	0x200	False	0.861328125	data	6.64649889161	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_WRITE, IMAGE_SCN_MEM_READ
.rsrc	0xd6000	0x5c0	0x600	False	0.42578125	data	4.09889762567	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0xd8000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0xd60a0	0x334	data
RT_MANIFEST	0xd63d4	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2016
Assembly Version	1.0.0.0
InternalName	CallConvFastca.exe
FileVersion	1.0.0.0
CompanyName
LegalTrademarks
Comments
ProductName	OthelloCS
ProductVersion	1.0.0.0
FileDescription	OthelloCS
OriginalFilename	CallConvFastca.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
01/28/22-18:27:40.739079	TCP	2029927	ET TROJAN AgentTesla Exfil via FTP	49812	21	192.168.2.3	199.188.206.78
01/28/22-18:27:40.904440	TCP	2029928	ET TROJAN AgentTesla HTML System Info Report Exfil via FTP	49813	12034	192.168.2.3	199.188.206.78

Network Port Distribution

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 28, 2022 18:27:39.212869883 CET	55102	53	192.168.2.3	8.8.8.8
Jan 28, 2022 18:27:39.232491016 CET	53	55102	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 28, 2022 18:27:39.212869883 CET	192.168.2.3	8.8.8.8	0x12a6	Standard query (0)	primesinsured.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 28, 2022 18:27:39.232491016 CET	8.8.8.8	192.168.2.3	0x12a6	No error (0)	primesinsured.com		199.188.206.78	A (IP address)	IN (0x0001)

Target ID:	0
Start time:	18:25:33
Start date:	28/01/2022
Path:	C:\Users\user\Desktop\vbc.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\vbc.exe"
Imagebase:	0xf0000
File size:	860672 bytes
MD5 hash:	345EBABC50767D04F3457FA7790A8777
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.333271160.0000000002561000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.333599110.0000000002618000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 00000000.00000002.334205520.0000000003569000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Target ID:	11
Start time:	18:25:55
Start date:	28/01/2022
Path:	C:\Users\user\Desktop\vbc.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\vbc.exe
Imagebase:	0x590000
File size:	860672 bytes
MD5 hash:	345EBABC50767D04F3457FA7790A8777
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000000.328761278.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000000.329971875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000000.329971875.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000000.329385221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000000.329385221.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.550450348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000002.550450348.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.553640678.0000000002AB6000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: MALWARE_Win_AgentTeslaV3, Description: AgentTeslaV3 infostealer payload, Source: 0000000B.00000002.553475685.0000000002A01000.00000004.00000800.00020000.00000000.sdmp, Author: ditekSHen Rule: JoeSecurity_AgentTesla_1, Description: Yara detected AgentTesla, Source: 0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_AgentTesla_2, Description: Yara detected AgentTesla, Source: 0000000B.00000000.328353324.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low

Show Windows behavior

Execution Graph

Execution Coverage:	8.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	39
Total number of Limit Nodes:	2

Executed Functions

Function 077A77DC Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 077A7A1E

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: d1370b18d0bb9a23ec000b8446e6f9ce979a2616e090e4fb47f93097f0efef59
Instruction ID: 537b6e9a49948e47eb758b45e6fc9e09a6f380db4550d600441450aefbcdc63f
Opcode Fuzzy Hash: d1370b18d0bb9a23ec000b8446e6f9ce979a2616e090e4fb47f93097f0efef59
Instruction Fuzzy Hash: BEA14FB1D00219DFEF14CFA8C881BEEBBB2BF84354F148669D859A7240D7749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 077A77E8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(?,?,?,?,?,?,?,?,?,?), ref: 077A7A1E

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: CreateProcess
String ID:
API String ID: 963392458-0
Opcode ID: 747802675578e865678e9571ac92034256d9fbf66281303a87b74b6c0991079a
Instruction ID: 7dd51ae568cee9fce2b2ead8cd108e6fb7da6f7d3af98efc9359c9486ad43d76
Opcode Fuzzy Hash: 747802675578e865678e9571ac92034256d9fbf66281303a87b74b6c0991079a
Instruction Fuzzy Hash: C99150B1D00219EFEF14CFA8C841BEEBBB6BF84354F148669D819A7240DB749985CF91

Uniqueness

Uniqueness Score: -1.00%

Function 04A853EC Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04A854A9

Memory Dump Source

Source File: 00000000.00000002.334732288.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_vbc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 20311e5bd6cb25994a28a78ec648d4d26b6f645fb7c026da0f8abd448d5d5c58
Instruction ID: 083ed13b96554ec158a5311198b95ef36cb543f905dd9ec75e1f4c233e7d4283
Opcode Fuzzy Hash: 20311e5bd6cb25994a28a78ec648d4d26b6f645fb7c026da0f8abd448d5d5c58
Instruction Fuzzy Hash: 3941F2B1C00619CFDB24DFA9C8847CEBBB6FF88308F60846AD409AB251DB756949CF50

Uniqueness

Uniqueness Score: -1.00%

Function 04A83E5C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateActCtxA.KERNEL32(?), ref: 04A854A9

Memory Dump Source

Source File: 00000000.00000002.334732288.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_vbc.jbxd

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: de321b22fd32bfb3e09b1a0a14572be48e052c267b69fc063c026e769793f2ca
Instruction ID: 3c83a849f10d7a908227256f1b20b61adbe25613bac527fef5c5bfc40952d22f
Opcode Fuzzy Hash: de321b22fd32bfb3e09b1a0a14572be48e052c267b69fc063c026e769793f2ca
Instruction Fuzzy Hash: 7241D271C00619DBDB24DF99C8457CEBBB5FF48304F508469D409AB251DB756949CF90

Uniqueness

Uniqueness Score: -1.00%

Function 077A7558 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 077A75F0

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: 60697ed5fc9e979d14b8cfaa1bc8445e64bd79a18287d83a2478f354666ee398
Instruction ID: fe1ca24010633dd7f71168db9ab609ea1b579802e5e4925612ce59619a86c2db
Opcode Fuzzy Hash: 60697ed5fc9e979d14b8cfaa1bc8445e64bd79a18287d83a2478f354666ee398
Instruction Fuzzy Hash: BF2144B59002099FDB04CFA9C9807EEBBF1BB48314F00882AEA59A7240C7789940CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 077A7560 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 077A75F0

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: MemoryProcessWrite
String ID:
API String ID: 3559483778-0
Opcode ID: cff04ce91346024d6a60bb850b7a172bd9bd9dbde6fd73511dd0c4e9e18e8509
Instruction ID: 443d254d77877d727f567119242b1b0d18f101f0ef9180d187c6f487796da47b
Opcode Fuzzy Hash: cff04ce91346024d6a60bb850b7a172bd9bd9dbde6fd73511dd0c4e9e18e8509
Instruction Fuzzy Hash: 932117B59002599FCF14CFA9C9847DEBBF5BF88354F148829E919A7240D7749944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 077A73C1 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 077A7446

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 7e2a106a4d419fcf621dada0861814952581e6e87518a48d75f4f1334da3ea5d
Instruction ID: 345fa4f903410a9c14a0220a807200bc8e355b175d441bb433cfed15f95d6b46
Opcode Fuzzy Hash: 7e2a106a4d419fcf621dada0861814952581e6e87518a48d75f4f1334da3ea5d
Instruction Fuzzy Hash: FD2168B1D00209CFDB14DFAAC4857EEBBF5AF88364F14882AD559A7240CB789945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077A73C8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetThreadContext.KERNELBASE(?,00000000), ref: 077A7446

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: ContextThread
String ID:
API String ID: 1591575202-0
Opcode ID: 94ec22aa29f7457a214e4dd82b600222d74d9db652c23d7437416f732e5f4cde
Instruction ID: 140d5711843bbed6a42226864d042808c62105520a26e7240f9dbdbda4571b2c
Opcode Fuzzy Hash: 94ec22aa29f7457a214e4dd82b600222d74d9db652c23d7437416f732e5f4cde
Instruction Fuzzy Hash: 46214CB1D003099FDB14DFAAC5857EEBBF4EF88364F548829D519A7240CB789944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077A7650 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 077A76D0

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 2b8cca694723af09adf252439e638d719b24d6478685f0ad2a694fbe5a8e7b14
Instruction ID: f44bc335aafda423ebc1531ce543c64e3d43cb0f5556b5acf243c1b03f2be491
Opcode Fuzzy Hash: 2b8cca694723af09adf252439e638d719b24d6478685f0ad2a694fbe5a8e7b14
Instruction Fuzzy Hash: 2A2116B1800209DFCB10CFAAC984BDEBBF5FF48324F50882AE519A7250C7749954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 077A7649 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 077A76D0

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: MemoryProcessRead
String ID:
API String ID: 1726664587-0
Opcode ID: 38fb933b879bdc5f03a76b88a37343b798e9f731d98415232ac65e15ae990100
Instruction ID: 71b1124ea7a7543dd7e26f9288dae0ad16c2450e3ac53776932b71d865ff0a05
Opcode Fuzzy Hash: 38fb933b879bdc5f03a76b88a37343b798e9f731d98415232ac65e15ae990100
Instruction Fuzzy Hash: 2B2134B5C00219DFCB04CFA9C9807EEBBF5BF48364F10882AD659A7250CB389951CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077A7498 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 077A750E

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 8cb8fc77030ddd5185fd29335da4028baea08792ee8ebe0da074c5d294498889
Instruction ID: f7d58cf4209b9abfda2aee2304265641cc38366fee1d4bd289aa1faed69161b4
Opcode Fuzzy Hash: 8cb8fc77030ddd5185fd29335da4028baea08792ee8ebe0da074c5d294498889
Instruction Fuzzy Hash: 011197B5900208CFCF04DFE9C8447DEBBF6AF88324F148829D669A7250CB749A00CF90

Uniqueness

Uniqueness Score: -1.00%

Function 077A7311 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 077A737A

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: 580ccb5c060b23e9b487c420cfe98758f1809e1b18f56834cfc93cd581ec9b26
Instruction ID: 63feb05654d0f921886046318b9db6557bdc053db0f842841f07c7f7fc7292f1
Opcode Fuzzy Hash: 580ccb5c060b23e9b487c420cfe98758f1809e1b18f56834cfc93cd581ec9b26
Instruction Fuzzy Hash: 0F1158B1D002488FDB14DFEAC4457DFFBF8AB88324F148829C519A7240C7749945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 077A74A0 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 077A750E

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: f6e9704b74ea941d73e600239e746ea3b7a024f37024c6adc26b09ff7a6ab1bf
Instruction ID: eb33cad14591f0599b45d8a058dca501ab0c61273f63f0c2f24e93bedcf38519
Opcode Fuzzy Hash: f6e9704b74ea941d73e600239e746ea3b7a024f37024c6adc26b09ff7a6ab1bf
Instruction Fuzzy Hash: 231114B59002099FCF14DFAAC9446DFBBF9AB88324F148819D519A7250C7759944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077A7318 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ResumeThread.KERNELBASE ref: 077A737A

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: ResumeThread
String ID:
API String ID: 947044025-0
Opcode ID: cd672594fc1a4de59c76dcb23f3cad92f942d70b7f6c5e836a00987d4c76f42d
Instruction ID: 15c12b5ef4b8d19b6d42512857de21e6fec3e04822486b684023d0cf6cea4085
Opcode Fuzzy Hash: cd672594fc1a4de59c76dcb23f3cad92f942d70b7f6c5e836a00987d4c76f42d
Instruction Fuzzy Hash: A31125B5D002498FDB14DFEAC9447DFFBF9AB88224F14882AD519A7250CB74A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 077A9E80 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostMessageW.USER32(?,?,?,?), ref: 077A9EDD

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID: MessagePost
String ID:
API String ID: 410705778-0
Opcode ID: 3a71844b71b8ea3178feed56f529be3a014aa9f63ab5dd0f1c4c9e7ed9b525cc
Instruction ID: ddc208e1724b55a504c104267a67bf7a89cdb5dee919f3a05fd855242963f08a
Opcode Fuzzy Hash: 3a71844b71b8ea3178feed56f529be3a014aa9f63ab5dd0f1c4c9e7ed9b525cc
Instruction Fuzzy Hash: A81103B58002099FDB10CF9AD985BDEBBF8EB48324F14881AD514A3600C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD41C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332815124.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1d8fb015ab989b024d42430055fc818f0a809eae51d5c58bb676f6717c3c2d8
Instruction ID: 825ed8e2d24f799fa17eacfd7aff816e4310857fe53cf1f35a0d45b1462b7c52
Opcode Fuzzy Hash: c1d8fb015ab989b024d42430055fc818f0a809eae51d5c58bb676f6717c3c2d8
Instruction Fuzzy Hash: DF212179200200DFCB08DF14C9C0F26BBA5FB84324F2489BCEA090B346C336E846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332869062.0000000000BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bdd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1edb0867303665e8cc3a576b84a8510ca971703f756376321819307aa656d8a0
Instruction ID: 6451bc2f9767dad1a147e552291538b52b2498ba25aa63fff442a06dfb129cd8
Opcode Fuzzy Hash: 1edb0867303665e8cc3a576b84a8510ca971703f756376321819307aa656d8a0
Instruction Fuzzy Hash: 06210071504200DFCB10CF24D9D4B16FBA5EBC8324F24C9AAD8894B386D736D846CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BDD005 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332869062.0000000000BDD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BDD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bdd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 853b25be2065e13ef64a7b7fb5ced55e709264075ce549856a0cb91753f6209c
Instruction ID: c6b4ad3314e0937523556a47d2dd3920dc07000ae39ce7620a58c46aa43bce39
Opcode Fuzzy Hash: 853b25be2065e13ef64a7b7fb5ced55e709264075ce549856a0cb91753f6209c
Instruction Fuzzy Hash: 1D2153755093809FCB12CF24D5A4715BF71EB45314F28C5DBD8898B657C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD417 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332815124.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26050ac9a710059c9b477200a138371d2ae940eb4f2ea16139302a11668e0a51
Instruction ID: 8afdf8563272f62aebd3dde351b3f1f31cd7257436b80527a5c24f427c4e8e51
Opcode Fuzzy Hash: 26050ac9a710059c9b477200a138371d2ae940eb4f2ea16139302a11668e0a51
Instruction Fuzzy Hash: 6211DF76404280CFCB15CF04D5C0B16BFB2FB84320F24C6ADD9480B616C336E85ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD7ED Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332815124.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b274d3ff180fa94b662a9b27e2f5e1353b04f20dc2b7afe2bb2ec0d8cca4d7ce
Instruction ID: 723a7919bb93a87b07198aca915bb69e5439a5f85e16ed830294a43a491c850f
Opcode Fuzzy Hash: b274d3ff180fa94b662a9b27e2f5e1353b04f20dc2b7afe2bb2ec0d8cca4d7ce
Instruction Fuzzy Hash: E701A2754043449AE7204A66D9C4BA7FBDCEF81774F18C8AEED185A282D7789C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Function 00BCD7EC Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.332815124.0000000000BCD000.00000040.00000800.00020000.00000000.sdmp, Offset: 00BCD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_bcd000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5541bb61e53e671213a8ef3fc3c2d8b3dd8f0c3ac0dcac7cdd261a1961782553
Instruction ID: e2ca417a51d02fc9557254cf5580826e205c2c7feea7a3bc98c932204b50ce25
Opcode Fuzzy Hash: 5541bb61e53e671213a8ef3fc3c2d8b3dd8f0c3ac0dcac7cdd261a1961782553
Instruction Fuzzy Hash: C0F062714042849EE7108E16CDC4BA3FBD8EB81774F18C46EED185B286D3789C44CAB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 000F82BC Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.331329264.00000000000F2000.00000002.00000001.01000000.00000003.sdmp, Offset: 000F0000, based on PE: true

Associated: 00000000.00000002.331317211.00000000000F0000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.331536663.0000000000165000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.331822022.00000000001C6000.00000002.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_f0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07c83445b40bdf9dc5a2a05227763b4f46e9fb21b632c999337e112d62e321f8
Instruction ID: 75a29a1dd724246994c0d782d0e97bab06eedd7ced7d9ba03f573fc1ece61f3b
Opcode Fuzzy Hash: 07c83445b40bdf9dc5a2a05227763b4f46e9fb21b632c999337e112d62e321f8
Instruction Fuzzy Hash: F1F1AC6245E3C19FE3139B745DBAA807FB29F13214B1E4ACFC4C08F4A3D15A5A69D322

Uniqueness

Uniqueness Score: -1.00%

Function 04A875FA Relevance: .1, Instructions: 147COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.334732288.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5144791744b64382d105651962f4a0e820a0b584aa63fa8b4a7caadd91835c3e
Instruction ID: f7c76cbb53d47ea8e3812a404c49484efb47caef0277e20d95af8674b9537e63
Opcode Fuzzy Hash: 5144791744b64382d105651962f4a0e820a0b584aa63fa8b4a7caadd91835c3e
Instruction Fuzzy Hash: DC516174D012088FDB44DFB9E860ACEBBF6AB85308F04C86AD015AB374EF7459069F91

Uniqueness

Uniqueness Score: -1.00%

Function 04A87608 Relevance: .1, Instructions: 141COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.334732288.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c1de4b7eb2401ac2ca6fc8e4e5e97c6ebe1d8e00f21a5a3982ca89362195ba81
Instruction ID: 7bc49dbcb39f6f02141b04a3b6377b4f841cacd32eb701dab293c3a5f77aa067
Opcode Fuzzy Hash: c1de4b7eb2401ac2ca6fc8e4e5e97c6ebe1d8e00f21a5a3982ca89362195ba81
Instruction Fuzzy Hash: E0513070D012088FDB44DFB9E860A9EBBF6EB85308F04C86AD115AB374EF7459069F91

Uniqueness

Uniqueness Score: -1.00%

Function 04A8784A Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.334732288.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cf8df3038661731503c16643c7f898c4e353a4a974d46b1aff4a49ecaf08eb7a
Instruction ID: e0223c4c8d386ee53180c61d7de970a53a10ff27bc4c9f8bce29722217b5e69c
Opcode Fuzzy Hash: cf8df3038661731503c16643c7f898c4e353a4a974d46b1aff4a49ecaf08eb7a
Instruction Fuzzy Hash: 28418F71E016188BEB1CDF6B9C4469DFBF7AFC5304F14C5BA841CAA265EB3015468F50

Uniqueness

Uniqueness Score: -1.00%

Function 077A001B Relevance: .1, Instructions: 109COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e41200a068589282c7b7bf11590b9bc3023f3a91b369a2315c3e5c02b99079b
Instruction ID: 6de45d197f415c3a9c07f374b99b5901e0b7265b57f99c04333de45f28b97db8
Opcode Fuzzy Hash: 6e41200a068589282c7b7bf11590b9bc3023f3a91b369a2315c3e5c02b99079b
Instruction Fuzzy Hash: 684171B1E056549BEB1DCF6B8C4128AFBF3AFC9200F14C5BAC90CAA225EB340546CF05

Uniqueness

Uniqueness Score: -1.00%

Function 077A0040 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.337769950.00000000077A0000.00000040.00000800.00020000.00000000.sdmp, Offset: 077A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_77a0000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c32120afd74a44b28850a889361263ff57fddbaa0c03772808b6de59f1dca7a
Instruction ID: 55c30d3949719d34c691c729c6183a5be0baa0a5a3f0f3b47aad4ad33fedabb9
Opcode Fuzzy Hash: 6c32120afd74a44b28850a889361263ff57fddbaa0c03772808b6de59f1dca7a
Instruction Fuzzy Hash: 214160B1E016189BEB6CCF6B8D4079EFAF7AFC8200F14C5BA850CA6215EB304985CF15

Uniqueness

Uniqueness Score: -1.00%

Function 04A87858 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.334732288.0000000004A80000.00000040.00000800.00020000.00000000.sdmp, Offset: 04A80000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4a80000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e257e3e065bc072618a2e34a84ca785347e710dbf2d594c90512d7eb00afc138
Instruction ID: 97632ec111fa346de86517dd8f76e0a6045bad1aac2a0f6b1ee3ee1467bf5d8a
Opcode Fuzzy Hash: e257e3e065bc072618a2e34a84ca785347e710dbf2d594c90512d7eb00afc138
Instruction Fuzzy Hash: A8411471E016198BEB1CDF6B8D4469EFAF7BFC9304F14C5BA881CAA225EB7005468E51

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: vbc.exePID: 6736, Parent PID: 6908COMMON

Execution Graph

Execution Coverage:	10.3%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	89
Total number of Limit Nodes:	5

Executed Functions

Function 05D15594 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05D1B213

Memory Dump Source

Source File: 0000000B.00000002.554665220.0000000005D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5d10000_vbc.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 06f5476ff2718c7dcadf66dc646931c706f3067b0f60cf7ed4e557d5d725aeb3
Instruction ID: b99815f05b0504c09f4e6ef91535565c460ac033348177dd5b0c563c65674044
Opcode Fuzzy Hash: 06f5476ff2718c7dcadf66dc646931c706f3067b0f60cf7ed4e557d5d725aeb3
Instruction Fuzzy Hash: 2151F374E002189FEB18CFA9D894B9DBBF1FF48314F15852AE816BB350DB749844CB99

Uniqueness

Uniqueness Score: -1.00%

Function 01026B50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01026BB0
GetCurrentThread.KERNEL32 ref: 01026BED
GetCurrentProcess.KERNEL32 ref: 01026C2A
GetCurrentThreadId.KERNEL32 ref: 01026C83

Memory Dump Source

Source File: 0000000B.00000002.553320458.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1020000_vbc.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: a2f25c25ff331f884a6b9151adb9348c76d406d88de9734c9d3e98b33d7eb6d6
Instruction ID: 871bed0076202d71628b6f8b41f7858a161a5f42cc364328f78b4bc7a81b3ff1
Opcode Fuzzy Hash: a2f25c25ff331f884a6b9151adb9348c76d406d88de9734c9d3e98b33d7eb6d6
Instruction Fuzzy Hash: E55135B0D006488FDB14CFA9D648BEEBBF4EF88314F208499E559A7350D7756884CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0102BDE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0102BE72

Strings

W, xrefs: 0102BDF5

Memory Dump Source

Source File: 0000000B.00000002.553320458.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1020000_vbc.jbxd

Similarity

API ID: EncodePointer
String ID: W
API String ID: 2118026453-655174618
Opcode ID: c49ec5822c7b9b5657643ee4161c520b6ff4d4a313d4a8f703cea6da51c6d151
Instruction ID: 3a0dd9d1b66504a790c58a494ad35f6be175200e88ebf6dc133c9280352aef22
Opcode Fuzzy Hash: c49ec5822c7b9b5657643ee4161c520b6ff4d4a313d4a8f703cea6da51c6d151
Instruction Fuzzy Hash: 862186B69057468FDF60DFA9C54839EBFF0EB09314F24886AC485E3642C7386588CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05D1B0CC Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05D1B213

Memory Dump Source

Source File: 0000000B.00000002.554665220.0000000005D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5d10000_vbc.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 74a1eb0f8ea0ab70373528a610e417b09c0da9393d651e4af2453dfb2c55eb10
Instruction ID: b727a278672b6203ad8776cec4a1de85e939e0d87bf7c0a80c3611f28a0c8524
Opcode Fuzzy Hash: 74a1eb0f8ea0ab70373528a610e417b09c0da9393d651e4af2453dfb2c55eb10
Instruction Fuzzy Hash: 9D511374E002189FEB18CFA9D888BDDBBF1BF48314F15852AE815BB350D774A844CB99

Uniqueness

Uniqueness Score: -1.00%

Function 05D18E0C Relevance: 1.6, APIs: 1, Instructions: 134
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,00000000), ref: 05D1B213

Memory Dump Source

Source File: 0000000B.00000002.554665220.0000000005D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5d10000_vbc.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: 8f9863cbe72c248564e41bb28365cb9933f40e196b110269507980cdfb07aba3
Instruction ID: 673e58dd7d2eb78a35ada0c055a50ae1044ea361cb998710b6e3a5187d0cf00c
Opcode Fuzzy Hash: 8f9863cbe72c248564e41bb28365cb9933f40e196b110269507980cdfb07aba3
Instruction Fuzzy Hash: CB51F374E002189FEB18CFA9D884B9DBBF1FF48314F55852AE816BB390D7749844CB99

Uniqueness

Uniqueness Score: -1.00%

Function 01025184 Relevance: 1.6, APIs: 1, Instructions: 115
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 010252A2

Memory Dump Source

Source File: 0000000B.00000002.553320458.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1020000_vbc.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: a4bc71af9028c9efacccb207755c9c726ab3e5a0864aa08290700ed1b6d61ae3
Instruction ID: 62efeb49bc15767b41c097c0ad4596f85b36634d6db8e6b42abc4201fbc20baf
Opcode Fuzzy Hash: a4bc71af9028c9efacccb207755c9c726ab3e5a0864aa08290700ed1b6d61ae3
Instruction Fuzzy Hash: 9851EEB1D003189FDF14CFAAC884ADEBBF5BF49314F24852AE819AB250D774A845CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01025190 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 010252A2

Memory Dump Source

Source File: 0000000B.00000002.553320458.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1020000_vbc.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9bb08cbeb73e3dc60fb5b30898ddd3df46404355ae3bf81043e209205b1ef1be
Instruction ID: 352143b16bbdb717ebd2f7a778f70ffa94b5b984e6f44195cff3f0457ad977df
Opcode Fuzzy Hash: 9bb08cbeb73e3dc60fb5b30898ddd3df46404355ae3bf81043e209205b1ef1be
Instruction Fuzzy Hash: 2841DEB1D003189FDF14CFA9C884ADEBBF5BF89314F24852AE819AB250D774A845CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01026964 Relevance: 1.6, APIs: 1, Instructions: 97
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CallWindowProcW.USER32(?,?,?,?,?), ref: 01027CF9

Memory Dump Source

Source File: 0000000B.00000002.553320458.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1020000_vbc.jbxd

Similarity

API ID: CallProcWindow
String ID:
API String ID: 2714655100-0
Opcode ID: 75787c1a641c7001df2f8ac0bb2749cc5cf45fe776fedf479851087112fe0f0a
Instruction ID: a8ee6b97bc7ef37ae81492585af5f383592afa4a966644ebf30e6a37794f1b25
Opcode Fuzzy Hash: 75787c1a641c7001df2f8ac0bb2749cc5cf45fe776fedf479851087112fe0f0a
Instruction Fuzzy Hash: FE413AB5A00359CFDB14CF99C488AAABBF5FF98314F248499D559AB321C734A841CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 05D13D76 Relevance: 1.6, APIs: 1, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 05D13E4A

Memory Dump Source

Source File: 0000000B.00000002.554665220.0000000005D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5d10000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 46c631e52daabd2a73ee69679aa416314a5b7deeba1408e61f69340896f6846a
Instruction ID: 6fceede552f9a9992f44dc7c0e412aefe0fbcc90389ac9befd555034ac413dd3
Opcode Fuzzy Hash: 46c631e52daabd2a73ee69679aa416314a5b7deeba1408e61f69340896f6846a
Instruction Fuzzy Hash: 653104B0D04349AFDB14CFA9D98579EBBF1BB08314F148A2AE815A7380D7749885CF99

Uniqueness

Uniqueness Score: -1.00%

Function 05D13D80 Relevance: 1.6, APIs: 1, Instructions: 86
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 05D13E4A

Memory Dump Source

Source File: 0000000B.00000002.554665220.0000000005D10000.00000040.00000800.00020000.00000000.sdmp, Offset: 05D10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_5d10000_vbc.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e56ef7a37948691302b32bd57a1e30152c6199004b028e701110bb92511beecb
Instruction ID: cc65ac0d5cd6379aeac712d1e964f4e8266b148db6c141a8b0c734a030fd9929
Opcode Fuzzy Hash: e56ef7a37948691302b32bd57a1e30152c6199004b028e701110bb92511beecb
Instruction Fuzzy Hash: BC31F6B0D04349AFDB14CFA9D88579EBBF1BB08314F148A2AE815A7380D7749845CF99

Uniqueness

Uniqueness Score: -1.00%

Function 01026D72 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01026DFF

Memory Dump Source

Source File: 0000000B.00000002.553320458.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1020000_vbc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 1aaf37843a05cc53bff5f8ca9d734b3ddafbe7eb741b88733a4aa9d1e7bfa3bf
Instruction ID: 31ac3bd98be17c34d2ce231a394f6b550cd6de8686f95cae4ff12a1eea40bebf
Opcode Fuzzy Hash: 1aaf37843a05cc53bff5f8ca9d734b3ddafbe7eb741b88733a4aa9d1e7bfa3bf
Instruction Fuzzy Hash: 7021E2B59002489FDF10CFA9D984AEEBFF4EB48324F14845AE958A7310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01026D78 Relevance: 1.6, APIs: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01026DFF

Memory Dump Source

Source File: 0000000B.00000002.553320458.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1020000_vbc.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8fadbbeb63be739a4584b2f86f62d71f2303f4abb3431f8482e0401f19c842cd
Instruction ID: 7fe13e47e5405c8006ba37f3b991437f68ab4cc990ecdf88cd132e458839fa84
Opcode Fuzzy Hash: 8fadbbeb63be739a4584b2f86f62d71f2303f4abb3431f8482e0401f19c842cd
Instruction Fuzzy Hash: 7021E4B59002089FDB10CFA9D984ADEBBF8EB48324F14841AE954A3310D374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0102BDF8 Relevance: 1.6, APIs: 1, Instructions: 54
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlEncodePointer.NTDLL(00000000), ref: 0102BE72

Memory Dump Source

Source File: 0000000B.00000002.553320458.0000000001020000.00000040.00000800.00020000.00000000.sdmp, Offset: 01020000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_1020000_vbc.jbxd

Similarity

API ID: EncodePointer
String ID:
API String ID: 2118026453-0
Opcode ID: 8f615b7e5e8d07701715a960442004ab86bc427f61110900aa87f690ea504209
Instruction ID: f50633a3dedf22c0044b285e3810b4ed1072d051566d93e7727effd2dac362ce
Opcode Fuzzy Hash: 8f615b7e5e8d07701715a960442004ab86bc427f61110900aa87f690ea504209
Instruction Fuzzy Hash: 271197719013098FDF60DFAAC50879EBBF4FB48324F20882AD545E3600C738A488CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D53C Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.552901658.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f2d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13f20dfbfb0bac9d2d6790a28ed6c3c131cb1f6a3ca525622c9aaeb9490e6889
Instruction ID: fa716e912824cf87edd764be6569c24a8a4a0a3b44a4fe668b3c65f6610e0a72
Opcode Fuzzy Hash: 13f20dfbfb0bac9d2d6790a28ed6c3c131cb1f6a3ca525622c9aaeb9490e6889
Instruction Fuzzy Hash: 9F214972504244DFCF01DF14E9C0F27BFA5FB94328F2889A9E8094B246C776D856EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.552970366.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f3d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 04283c7048ad4c516322a50a2253726bdfe6f9d903f4f1e7bb783bc9e69c9200
Instruction ID: d6ca70836f0592061ee733fd428d6f937d0235524073fc33f427bf813c1b01ca
Opcode Fuzzy Hash: 04283c7048ad4c516322a50a2253726bdfe6f9d903f4f1e7bb783bc9e69c9200
Instruction Fuzzy Hash: E52107B1504244DFCB18CF64E9C4B16BBA5FB84734F24C9A9D8494B34AC736D847DB61

Uniqueness

Uniqueness Score: -1.00%

Function 00F3D005 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.552970366.0000000000F3D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F3D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f3d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6c07693bb0384222efe7db76b1d0fb8d604d0851e331b7ac81d1c451b6c76174
Instruction ID: 7b1222294ab00cb09b4976110bd4b47a9bae6924b8c3051889dbe40cc855810f
Opcode Fuzzy Hash: 6c07693bb0384222efe7db76b1d0fb8d604d0851e331b7ac81d1c451b6c76174
Instruction Fuzzy Hash: 452183755093C08FCB16CF24D590715BF71EB46324F28C5DAD8498F697C33A980ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 00F2D537 Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.552901658.0000000000F2D000.00000040.00000800.00020000.00000000.sdmp, Offset: 00F2D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_f2d000_vbc.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 26050ac9a710059c9b477200a138371d2ae940eb4f2ea16139302a11668e0a51
Instruction ID: 205ac9a419ac6d58fe5a76698daa979a8bdee74dc392ca19c7058850ae33185f
Opcode Fuzzy Hash: 26050ac9a710059c9b477200a138371d2ae940eb4f2ea16139302a11668e0a51
Instruction Fuzzy Hash: 1C11E676804280CFCF12CF10D6C4B16BF72FB94324F28C6A9D8094B656C33AD85ADBA1

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report vbc.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Agenttesla

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

UDP Packets

DNS Queries

DNS Answers

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

Windows Analysis Report
vbc.exe

Function 077A77DC Relevance: 1.8, APIs: 1, Instructions: 250
processCOMMON

Function 077A77E8 Relevance: 1.7, APIs: 1, Instructions: 243
processCOMMON

Function 04A853EC Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 04A83E5C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Function 077A7558 Relevance: 1.6, APIs: 1, Instructions: 70
injectionCOMMON

Function 077A7560 Relevance: 1.6, APIs: 1, Instructions: 69
injectionCOMMON

Function 077A73C1 Relevance: 1.6, APIs: 1, Instructions: 66
threadCOMMON

Function 077A73C8 Relevance: 1.6, APIs: 1, Instructions: 63
threadCOMMON

Function 077A7650 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 077A7649 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Function 077A7498 Relevance: 1.6, APIs: 1, Instructions: 54
memoryCOMMON

Function 077A7311 Relevance: 1.6, APIs: 1, Instructions: 53
threadCOMMON

Function 077A74A0 Relevance: 1.6, APIs: 1, Instructions: 53
memoryCOMMON

Function 077A7318 Relevance: 1.5, APIs: 1, Instructions: 49
threadCOMMON

Function 077A9E80 Relevance: 1.5, APIs: 1, Instructions: 44
windowCOMMON

Function 05D15594 Relevance: 1.6, APIs: 1, Instructions: 135
COMMON

Function 01026B50 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Function 0102BDE8 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58
COMMON

Function 05D1B0CC Relevance: 1.6, APIs: 1, Instructions: 135
COMMON