Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6402	July 4, 2021, 11:01 a.m.	July 4, 2021, 11:05 a.m.

Size	124.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`41b6d9d1610bfd9497db3091dfc84b88`
SHA256	`fa07c8de6db23c1be2ee8da97c5621f7fc006469f84e2835195fc943de43d544`
CRC32	`7D0E1F60`
ssdeep	`3072:WeZmogDk+yTMLObNlEB+VSdQgXHOPz2XPLekO9:WeZkg9ThNlIWzk`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Win32_PWS_Loki_Zero - Win32 PWS Loki

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Main
8024
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,
8708

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
172.217.25.14	Active	Moloch
185.215.113.55	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.215.113.55:80 -> 192.168.56.102:49807	2400025	ET DROP Spamhaus DROP Listed Traffic Inbound group 26	Misc Attack

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (1 event)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 4, 2021, 11:01 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx July 4, 2021, 11:01 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://185.215.113.55//t5BnOoke2/index.php

Performs some HTTP requests (1 event)

request

POST http://185.215.113.55//t5BnOoke2/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://185.215.113.55//t5BnOoke2/index.php

Allocates read-write-execute memory (usually to unpack itself) (14 events)

Time & API	Arguments	Status
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76891000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x765b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e80000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73771000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73861000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x72da4000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73772000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x71f61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66fc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73321000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73e21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory July 4, 2021, 11:01 a.m.	process_identifier: 8024 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x66fb1000 process_handle: 0xffffffff	1

Communicates with host for which no DNS query was performed (2 events)

host	172.217.25.14
host	185.215.113.55

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

File has been identified by 54 AntiVirus engines on VirusTotal as malicious (50 out of 54 events)

Bkav	W32.HearaBenRAP.Trojan
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
ALYac	DeepScan:Generic.Malware.FPf.96FCF748
Malwarebytes	Spyware.PasswordStealer
Sangfor	Trojan.Win32.Decred.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanPSW:Win32/CryptInject.fe313c15
K7GW	Password-Stealer ( 0055f59a1 )
K7AntiVirus	Password-Stealer ( 0055f59a1 )
Arcabit	DeepScan:Generic.Malware.FPf.96FCF748
Cyren	W32/Decred.A.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/PSW.Delf.OTR
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Malware.Zusy-9753108-0
Kaspersky	HEUR:Trojan-PSW.Win32.Decred.a
BitDefender	DeepScan:Generic.Malware.FPf.96FCF748
NANO-Antivirus	Trojan.Win32.Decred.iabzce
MicroWorld-eScan	DeepScan:Generic.Malware.FPf.96FCF748
Avast	Win32:PWSX-gen [Trj]
Rising	Stealer.Agent!1.C48C (CLASSIC)
Ad-Aware	DeepScan:Generic.Malware.FPf.96FCF748
Emsisoft	Trojan-PSW.Delf (A)
F-Secure	Heuristic.HEUR/AGEN.1137247
DrWeb	Trojan.PWS.Stealer.29417
VIPRE	Trojan.Win32.Generic!BT
TrendMicro	TrojanSpy.Win32.AMADEY.SMYAAA-A
McAfee-GW-Edition	GenericRXMS-NG!41B6D9D1610B
FireEye	Generic.mg.41b6d9d1610bfd94
Sophos	Mal/Generic-R + Troj/Delf-HKP
Ikarus	Trojan-PSW.Delf
Jiangmin	Trojan.PSW.Decred.r
Webroot	W32.Infostealer.Gen
Avira	HEUR/AGEN.1137247
Antiy-AVL	Trojan/Generic.ASMalwS.30F40D7
Kingsoft	Win32.PSWTroj.Undef.(kcloud)
Microsoft	Trojan:Win32/CryptInject.SBR!MSR
AegisLab	Trojan.Win32.Decred.i!c
GData	DeepScan:Generic.Malware.FPf.96FCF748
AhnLab-V3	Trojan/Win32.Delf.C4208366
McAfee	GenericRXMS-NG!41B6D9D1610B
MAX	malware (ai score=87)
VBA32	TScope.Trojan.Delf
Cylance	Unsafe
TrendMicro-HouseCall	TrojanSpy.Win32.AMADEY.SMYAAA-A
Tencent	Malware.Win32.Gencirc.10ce3956
SentinelOne	Static AI - Suspicious PE
MaxSecure	Trojan.Malware.74794127.susgen

cred.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All