Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Jan. 7, 2025, 3:42 p.m.	Jan. 7, 2025, 3:46 p.m.

Size	1.1MB
Type	PE32 executable (GUI) Intel 80386, for MS Windows
MD5	`bf9b75adf866583299dbc8a5fad66cfc`
SHA256	`1bec44aa19ea8daa0b7151b312975f3f753e03f0bbce5ebeab8dfda5fb736a91`
CRC32	`CD44EE48`
ssdeep	`24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsPE32 - (no description) mzp_file_format - MZP(Delphi) file format UPX_Zero - UPX packed file

albt.exe "C:\Users\test22\AppData\Local\Temp\albt.exe"
1836

Name	Response	Post-Analysis Lookup
amazonenviro.com		166.62.27.188

IP Address	Status	Action
164.124.101.2	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (9 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 7, 2025, 3:42 p.m.			0	0
IsDebuggerPresent Jan. 7, 2025, 3:43 p.m.			0	0
IsDebuggerPresent Jan. 7, 2025, 3:43 p.m.			0	0
IsDebuggerPresent Jan. 7, 2025, 3:43 p.m.			0	0
IsDebuggerPresent Jan. 7, 2025, 3:43 p.m.			0	0
IsDebuggerPresent Jan. 7, 2025, 3:43 p.m.			0	0
IsDebuggerPresent Jan. 7, 2025, 3:44 p.m.			0	0
IsDebuggerPresent Jan. 7, 2025, 3:44 p.m.			0	0
IsDebuggerPresent Jan. 7, 2025, 3:44 p.m.			0	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

.itext

The executable uses a known packer (1 event)

packer

BobSoft Mini Delphi -> BoB / BobSoft

Allocates read-write-execute memory (usually to unpack itself) (50 out of 1059 events)

Time & API	Arguments	Status	Return
NtAllocateVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00650000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffff	1	0
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 999999 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00474664 process_handle: 0xffffffff		3221225496

Changes read-write memory protection to read-execute (probably to avoid detection when setting all RWX flags at the same time) (1 event)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 7, 2025, 3:42 p.m.	process_identifier: 1836 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 length: 180224 protection: 32 (PAGE_EXECUTE_READ) base_address: 0x02ce1000 process_handle: 0xffffffff	1	0	0

The binary likely contains encrypted or compressed data indicative of a packer (2 events)

section

{u'size_of_data': u'0x000a1c00', u'virtual_address': u'0x00082000', u'entropy': 7.104149858016798, u'name': u'.rsrc', u'virtual_size': u'0x000a1c00'}

entropy

7.10414985802

description

A section with a high entropy has been found

entropy

0.571050308914

description

Overall entropy of this PE file is high

Disables proxy possibly for traffic interception (1 event)

Time & API	Arguments	Status	Return	Repeated
RegSetValueExA Jan. 7, 2025, 3:42 p.m.	key_handle: 0x000002ec regkey_r: ProxyEnable reg_type: 4 (REG_DWORD) value: 0 regkey: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable	1	0	0

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.ModiLoader.m!c
Cynet	Malicious (score: 100)
Cylance	Unsafe
Sangfor	Backdoor.Win32.Modiloader.Vkce
CrowdStrike	win/malicious_confidence_70% (W)
BitDefender	Trojan.GenericKD.75302640
K7GW	Trojan ( 005bf3181 )
K7AntiVirus	Trojan ( 005bf3181 )
Arcabit	Trojan.Generic.D47D06F0
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/GenKryptik.HFGI
APEX	Malicious
Avast	Win32:BackdoorX-gen [Trj]
Kaspersky	HEUR:Backdoor.Win32.Androm.gen
Rising	Downloader.Agent!1.EFE4 (CLASSIC)
Emsisoft	Trojan.GenericKD.75302640 (B)
DrWeb	Trojan.DownLoader48.1783
McAfeeD	ti!1BEC44AA19EA
Trapmine	malicious.moderate.ml.score
CTX	exe.trojan.modiloader
Sophos	Mal/Generic-S
SentinelOne	Static AI - Suspicious PE
FireEye	Trojan.GenericKD.75302640
Webroot	W32.Trojan.Gen
Google	Detected
Avira	TR/AD.Nekark.tuies
Antiy-AVL	Trojan/Win32.Modiloader
Kingsoft	malware.kb.a.984
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/ModiLoader.DFC!MTB
GData	Win32.Trojan.Agent.DRXNE8
Varist	W32/ModiLoader.T.gen!Eldorado
AhnLab-V3	Trojan/Win.ModiLoader.C5714582
McAfee	Artemis!BF9B75ADF866
DeepInstinct	MALICIOUS
Malwarebytes	Generic.Malware/Suspicious
Ikarus	Trojan.Win32.Krypt
Panda	Trj/GdSda.A
huorong	TrojanDownloader/ModiLoader.a
MaxSecure	Trojan.Malware.300983.susgen
Fortinet	W32/ModiLoader.ABE!tr
AVG	Win32:BackdoorX-gen [Trj]
Paloalto	generic.ml
alibabacloud	Trojan:Win/ModiLoader.D#I2XJC

albt.exe

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All