Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 24, 2024, 10:19 a.m.	Oct. 24, 2024, 10:21 a.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`a4d92d023f0158e3c7107def757641ae`
SHA256	`eb7e203a572088217f7e24002c468a57f356e80f1c003e9c14f81eeb5f24139b`
CRC32	`951E355F`
ssdeep	`24576:uCtVqnbUQ25Qm2XzQiYcx3RqrPBzKRfuHpEqiyu5T5:ukabmAYc3qrWyuv`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) UPX_Zero - UPX packed file mzp_file_format - MZP(Delphi) file format

wlanext.exe "C:\Users\test22\AppData\Local\Temp\wlanext.exe"
1000

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
103.161.133.169	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (6 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 24, 2024, 10:19 a.m.			0	0
IsDebuggerPresent Oct. 24, 2024, 10:19 a.m.			0	0
IsDebuggerPresent Oct. 24, 2024, 10:20 a.m.			0	0
IsDebuggerPresent Oct. 24, 2024, 10:20 a.m.			0	0
IsDebuggerPresent Oct. 24, 2024, 10:20 a.m.			0	0
IsDebuggerPresent Oct. 24, 2024, 10:21 a.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1036 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00540000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 399996 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00503640 process_handle: 0xffffffff		3221225496

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 24, 2024, 10:19 a.m.	process_identifier: 1000 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 180224 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02ff1000 process_handle: 0xffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

103.161.133.169

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Oct. 24, 2024, 10:19 a.m.	key_handle: 0x000002d4 regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

Connects to an IP address that is no longer responding to requests (legitimate services will remain up-and-running usually) (1 event)

dead_host

103.161.133.169:80

File has been identified by 45 AntiVirus engines on VirusTotal as malicious (45 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ModiLoader.4!c
Cynet	Malicious (score: 99)
Cylance	Unsafe
Sangfor	Downloader.Win32.Modiloader.Vkid
CrowdStrike	win/malicious_confidence_90% (D)
BitDefender	Gen:Variant.Midie.155494
Arcabit	Trojan.Jaik.D3BC2A
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win32/TrojanDownloader.ModiLoader.AFL
APEX	Malicious
Avast	Win32:Evo-gen [Trj]
Kaspersky	HEUR:Trojan.Win32.DelfInject.gen
Alibaba	TrojanDownloader:Win32/ModiLoader.16369f1b
MicroWorld-eScan	Gen:Variant.Midie.155494
Rising	Downloader.Agent!1.EFE4 (CLASSIC)
Emsisoft	Gen:Variant.Midie.155494 (B)
F-Secure	Trojan.TR/AVI.Agent.uisrh
DrWeb	Trojan.ModiLoader.29
TrendMicro	Backdoor.Win32.REMCOS.YXEJVZ
McAfeeD	ti!EB7E203A5720
CTX	exe.downloader.modiloader
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Generic.mg.a4d92d023f0158e3
Webroot	W32.Malware.Gen
Google	Detected
Avira	TR/AVI.Agent.uisrh
Antiy-AVL	Trojan/Win32.DelfInject
Kingsoft	Win32.Trojan.DelfInject.gen
Microsoft	Trojan:Win32/Remcos.VBI!MTB
GData	Gen:Variant.Midie.155494
Varist	W32/ABDownloader.NKKL-1447
McAfee	Artemis!A4D92D023F01
DeepInstinct	MALICIOUS
VBA32	BScope.Backdoor.RmRAT
Malwarebytes	Malware.AI.4074489075
Ikarus	Trojan-Downloader.Win32.Modiloader
Panda	Trj/GdSda.A
TrendMicro-HouseCall	Backdoor.Win32.REMCOS.YXEJVZ
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/ModiLoader.ABE!tr
AVG	Win32:Evo-gen [Trj]
Paloalto	generic.ml

wlanext.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All