popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

wlanext.exe

NSIS Malicious Library ASPack UPX PE File OS Processor Check PE32
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6401 Dec. 19, 2023, 7:32 a.m. Dec. 19, 2023, 7:39 a.m.
Size 354.9KB
Type PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
MD5 88aa7a12dbafa9f2d059943a7e112ac3
SHA256 2adb13c507ff82c0c2d9023814380ebd0f6b44aa65421a9e57459a6cd9b9fcb1
CRC32 75BA498C
ssdeep 6144:bhjmbFoOFty6YwJ1mkGQZGYnHkVuRaAkWG4NE/BlzAYnJzpRX3sbbovAvmw20Czu:cFoOFtykvxGYRaN34OLkYnJzpRQFmlpi
Yara
  • Malicious_Library_Zero - Malicious_Library
  • IsPE32 - (no description)
  • PE_Header_Zero - PE File Signature
  • NSIS_Installer - Null Soft Installer
  • UPX_Zero - UPX packed file

Name Response Post-Analysis Lookup
unllin.com
A 91.92.252.51
91.92.252.51
geoplugin.net
A 178.237.33.50
178.237.33.50
IP Address Status Action
164.124.101.2 Active Moloch
178.237.33.50 Active Moloch
91.92.252.51 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 192.168.56.101:49165 -> 91.92.252.51:3211 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected
TCP 192.168.56.101:49166 -> 91.92.252.51:3211 2036594 ET JA3 Hash - Remcos 3.x TLS Connection Malware Command and Control Activity Detected

Suricata TLS

Flow Issuer Subject Fingerprint
TLS 1.3
192.168.56.101:49165
91.92.252.51:3211 		None None None
TLS 1.3
192.168.56.101:49166
91.92.252.51:3211 		None None None

Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section .ndata
suspicious_features GET method with no useragent header suspicious_request GET http://geoplugin.net/json.gp
request GET http://geoplugin.net/json.gp
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 2632
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x73272000
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 8192
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00270000
allocation_type: 4096 (MEM_COMMIT)
process_handle: 0xffffffff
1 0 0

NtAllocateVirtualMemory

 process_identifier: 2732
region_size: 4096
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00280000
allocation_type: 12289 (MEM_COMMIT|MEM_RESERVE)
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2796
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x00400000
process_handle: 0xffffffff
1 0 0
file C:\Users\test22\AppData\Local\Temp\iatzxztd.exe
file C:\Users\test22\AppData\Roaming\dmiir\nnwggcllu.exe
file C:\Users\test22\AppData\Local\Temp\iatzxztd.exe
file C:\Users\test22\AppData\Local\Temp\iatzxztd.exe
reg_key HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\qqavffokktc reg_value C:\Users\test22\AppData\Roaming\dmiir\nnwggcllu.exe "C:\Users\test22\AppData\Local\Temp\iatzxztd.exe"
Process injection Process 2732 called NtSetContextThread to modify thread in remote process 2796
Time & API Arguments Status Return Repeated

NtSetContextThread

 registers.eip: 1995571652
registers.esp: 1440116
registers.edi: 0
registers.eax: 4735984
registers.ebp: 0
registers.edx: 0
registers.ebx: 2130567168
registers.esi: 0
registers.ecx: 0
thread_handle: 0x000000dc
process_identifier: 2796
1 0 0