Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Dec. 12, 2022, 11:29 a.m.	Dec. 12, 2022, 11:31 a.m.

Size	126.0KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`3966ebb55d701a2b42f9a755aa925010`
SHA256	`c3b8925370a662af01f3040d1a417a227eca5e1d7bdfaac3716b3a5e384dc698`
CRC32	`3DE0FA4D`
ssdeep	`3072:Ix7pOYzBeku2i4uLzw2Y6ScG13uHh6c+LjzbL1Xpy9:Ix7ZNhu2WLzuah6c6p`
Yara	IsPE32 - (no description) Malicious_Library_Zero - Malicious_Library IsDLL - (no description) PE_Header_Zero - PE File Signature Win32_PWS_Loki_Zero - Win32 PWS Loki

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
2640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
2556
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,
2732

Name	Response	Post-Analysis Lookup
PMVqdJfUf3WlX9kI.xyz
SmgqNt3EIxXkSAsU.xyz	A 45.89.255.254	45.89.255.254
AQWe9sfiWSwPyVMJ.xyz

IP Address	Status	Action
164.124.101.2	Active	Moloch
45.89.255.254	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Dec. 12, 2022, 11:29 a.m.			0	0
IsDebuggerPresent Dec. 12, 2022, 11:29 a.m.			0	0

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Dec. 12, 2022, 11:29 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (3 events)

section	CODE
section	DATA
section	BSS

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Dec. 12, 2022, 11:29 a.m.	stacktrace: Save+0x3a cred64+0x1a96a @ 0x39a96a rundll32+0x137d @ 0xa5137d rundll32+0x1326 @ 0xa51326 rundll32+0x1901 @ 0xa51901 BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x755c33ca RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x76f49ed2 RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x76f49ea5 exception.instruction_r: 8a 54 02 ff 8d 45 f0 e8 d5 9f fe ff 8b 45 f0 8b exception.instruction: mov dl, byte ptr [edx + eax + 0xffffffff] exception.exception_code: 0xc0000005 exception.symbol: Main+0x38f Save-0x12d cred64+0x1a803 exception.address: 0x39a803 registers.esp: 588328 registers.edi: 0 registers.eax: 0 registers.ebp: 588376 registers.edx: 0 registers.ebx: 0 registers.esi: 588408 registers.ecx: 0	1	0	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header

suspicious_request

POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php

Performs some HTTP requests (1 event)

request

POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://SmgqNt3EIxXkSAsU.xyz/jg94cVd30f/index.php

Allocates read-write-execute memory (usually to unpack itself) (28 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2556 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73551000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73514000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735e2000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73be1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x730d1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73921000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Dec. 12, 2022, 11:29 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bb1000 process_handle: 0xffffffff	1

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (1 event)

file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (1 event)

registry

HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook

File has been identified by 46 AntiVirus engines on VirusTotal as malicious (46 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	DeepScan:Generic.Malware.FPf.4CF24725
FireEye	Generic.mg.3966ebb55d701a2b
CAT-QuickHeal	Trojan.Amaday.S28469649
McAfee	PWS-FDNA!3966EBB55D70
Cylance	Unsafe
VIPRE	DeepScan:Generic.Malware.FPf.4CF24725
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_90% (D)
K7GW	Trojan ( 7000000f1 )
K7AntiVirus	Trojan ( 7000000f1 )
Arcabit	DeepScan:Generic.Malware.FPf.4CF24725
VirIT	Trojan.Win32.Genus.LVY
Cyren	W32/Delf.RN.gen!Eldorado
Symantec	Trojan.Amadey!g1
ESET-NOD32	a variant of Win32/PSW.Delf.OTR
Cynet	Malicious (score: 100)
APEX	Malicious
ClamAV	Win.Malware.Zusy-9753108-0
Kaspersky	HEUR:Trojan-PSW.Win32.Decred.a
BitDefender	DeepScan:Generic.Malware.FPf.4CF24725
Avast	Win32:BotX-gen [Trj]
Ad-Aware	DeepScan:Generic.Malware.FPf.4CF24725
Sophos	Troj/Amadey-J
F-Secure	Heuristic.HEUR/AGEN.1233121
DrWeb	Trojan.SpyBot.1164
TrendMicro	TrojanSpy.Win32.AMADEY.SM
McAfee-GW-Edition	PWS-FDNA!3966EBB55D70
Emsisoft	Trojan-PSW.Delf (A)
Avira	HEUR/AGEN.1233121
Antiy-AVL	Trojan[PSW]/Win32.Decred
Microsoft	Trojan:Win32/CryptInject.SBR!MSR
ZoneAlarm	HEUR:Trojan-PSW.Win32.Decred.a
GData	DeepScan:Generic.Malware.FPf.4CF24725
Google	Detected
AhnLab-V3	Trojan/Win.Delf.R452782
Acronis	suspicious
VBA32	TScope.Trojan.Delf
ALYac	DeepScan:Generic.Malware.FPf.4CF24725
MAX	malware (ai score=83)
Malwarebytes	Generic.Spyware.Stealer.DDS
Rising	Stealer.Agent!1.C48C (CLASSIC)
Ikarus	Trojan-PSW.Delf
Fortinet	W32/Delf.QYF!tr.spy
AVG	Win32:BotX-gen [Trj]
Panda	Trj/Genetic.gen

cred64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All