popup
Summary | ZeroBOX
  1. Home
  2. Result
  3. Report
  4. Detail Analysis

cred64.dll

Malicious Library PWS PE32 PE File DLL
  1. Resubmit sample
Category Machine Started Completed
FILE s1_win7_x6403_us Dec. 13, 2022, 10:09 a.m. Dec. 13, 2022, 10:11 a.m.
Size 126.0KB
Type PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5 66dc0761882ecbb1d06dea6f101f28a8
SHA256 55642e6e20a38399879a1c3614023ecfa7ff85d3896c1f83d928d581af6c4748
CRC32 DF499000
ssdeep 3072:ox7pOYzBekYmWDWCMq6As523HeS9FAiZ87vO2rlL3Rni9:ox7ZNhY/dMq6AO0a7vVlT
Yara
  • IsPE32 - (no description)
  • Malicious_Library_Zero - Malicious_Library
  • IsDLL - (no description)
  • PE_Header_Zero - PE File Signature
  • Win32_PWS_Loki_Zero - Win32 PWS Loki

Name Response Post-Analysis Lookup
No hosts contacted.
IP Address Status Action
62.204.41.13 Active Moloch
45.159.189.115 Active Moloch

Suricata Alerts

Flow SID Signature Category
TCP 62.204.41.13:80 -> 192.168.56.103:49163 2402000 ET DROP Dshield Block Listed Source group 1 Misc Attack

Suricata TLS

No Suricata TLS

Time & API Arguments Status Return Repeated

IsDebuggerPresent

 0 0

IsDebuggerPresent

 0 0
Time & API Arguments Status Return Repeated

GlobalMemoryStatusEx

 1 1 0
section CODE
section DATA
section BSS
Time & API Arguments Status Return Repeated

__exception__

 stacktrace: 
Save+0x3a cred64+0x1a8ce @ 0x7da8ce
rundll32+0x137d @ 0x7b137d
rundll32+0x1326 @ 0x7b1326
rundll32+0x1901 @ 0x7b1901
BaseThreadInitThunk+0x12 VerifyConsoleIoHandle-0xb3 kernel32+0x133ca @ 0x757f33ca
RtlInitializeExceptionChain+0x63 RtlAllocateActivationContextStack-0xa1 ntdll+0x39ed2 @ 0x778d9ed2
RtlInitializeExceptionChain+0x36 RtlAllocateActivationContextStack-0xce ntdll+0x39ea5 @ 0x778d9ea5

exception.instruction_r: 8a 54 02 ff 8d 45 f0 e8 71 a0 fe ff 8b 45 f0 8b
exception.instruction: mov dl, byte ptr [edx + eax + 0xffffffff]
exception.exception_code: 0xc0000005
exception.symbol: Main+0x38f Save-0x12d cred64+0x1a767
exception.address: 0x7da767
registers.esp: 2620120
registers.edi: 0
registers.eax: 0
registers.ebp: 2620168
registers.edx: 0
registers.ebx: 0
registers.esi: 2620200
registers.ecx: 0
1 0 0
suspicious_features POST method with no referer header, POST method with no useragent header, Connection to IP address suspicious_request POST http://62.204.41.13/gjend7w/index.php
request POST http://62.204.41.13/gjend7w/index.php
request POST http://62.204.41.13/gjend7w/index.php
Time & API Arguments Status Return Repeated

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x758f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76971000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744a0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74471000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74461000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74431000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 1880
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74391000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x758f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x76971000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x744a0000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74471000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74461000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74451000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74431000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743f1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x743a1000
process_handle: 0xffffffff
1 0 0

NtProtectVirtualMemory

 process_identifier: 2056
stack_dep_bypass: 0
stack_pivoted: 0
heap_dep_bypass: 0
length: 4096
protection: 64 (PAGE_EXECUTE_READWRITE)
base_address: 0x74391000
process_handle: 0xffffffff
1 0 0
host 62.204.41.13
host 45.159.189.115
file C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\Sessions
file C:\Users\test22\AppData\Roaming\.purple\accounts.xml
registry HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
Elastic malicious (high confidence)
MicroWorld-eScan DeepScan:Generic.Malware.FPf.EE762C0E
FireEye Generic.mg.66dc0761882ecbb1
CAT-QuickHeal Trojan.Amaday.S28469649
ALYac DeepScan:Generic.Malware.FPf.EE762C0E
Cylance Unsafe
Sangfor Trojan.Win32.Save.a
K7AntiVirus Trojan ( 7000000f1 )
K7GW Trojan ( 7000000f1 )
CrowdStrike win/malicious_confidence_90% (W)
Arcabit DeepScan:Generic.Malware.FPf.EE762C0E
VirIT Trojan.Win32.Genus.LVY
Cyren W32/Delf.RN.gen!Eldorado
Symantec Trojan.Amadey!g1
ESET-NOD32 a variant of Win32/PSW.Delf.OTR
ClamAV Win.Malware.Zusy-9753108-0
Kaspersky HEUR:Trojan-PSW.Win32.Decred.a
BitDefender DeepScan:Generic.Malware.FPf.EE762C0E
NANO-Antivirus Trojan.Win32.Decred.jrwsse
Cynet Malicious (score: 100)
Avast Win32:BotX-gen [Trj]
Tencent Malware.Win32.Gencirc.10bd8886
Ad-Aware DeepScan:Generic.Malware.FPf.EE762C0E
TACHYON Trojan/W32.DP-Agent.129024.U
Emsisoft Trojan-PSW.Delf (A)
DrWeb Trojan.SpyBot.1164
VIPRE DeepScan:Generic.Malware.FPf.EE762C0E
TrendMicro TrojanSpy.Win32.AMADEY.SM
McAfee-GW-Edition PWS-FDNA!66DC0761882E
Sophos Troj/Amadey-J
APEX Malicious
Jiangmin Trojan.PSW.Decred.at
Avira HEUR/AGEN.1233121
Antiy-AVL Trojan[PSW]/Win32.Decred
Microsoft Trojan:Win32/CryptInject.SBR!MSR
ZoneAlarm HEUR:Trojan-PSW.Win32.Decred.a
GData DeepScan:Generic.Malware.FPf.EE762C0E
Google Detected
AhnLab-V3 Trojan/Win.Delf.R452782
Acronis suspicious
McAfee PWS-FDNA!66DC0761882E
MAX malware (ai score=81)
VBA32 TScope.Trojan.Delf
Malwarebytes Generic.Spyware.Stealer.DDS
Rising Stealer.Agent!1.C48C (CLASSIC)
Ikarus Trojan-PSW.Delf
MaxSecure Trojan.Malware.74794127.susgen
Fortinet W32/Delf.QYF!tr.spy
AVG Win32:BotX-gen [Trj]
Panda Trj/GdSda.A