Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 22, 2023, 3:25 p.m.	Jan. 22, 2023, 3:32 p.m.

Size	1.0MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`17ffefed5c2de006ac35f47b84d2477b`
SHA256	`398235467c51419c4d2df6b9a0fad678730ae52b6db55d26e96f7ba70cae2dc3`
CRC32	`FFC11D5C`
ssdeep	`24576:JVaH8jJPWhQnZzrZ+7xr1rZfVlTxd43vlB5m:/AhQnZzrZSxxZfVlU9`
PDB Path	D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara	OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library IsPE64 - (no description) UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
2540
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
  2776
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
2624
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
  2796
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,
2716

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Jan. 22, 2023, 3:25 p.m.	computer_name: TEST22-PC	1	1	0

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 22, 2023, 3:25 p.m.			0	0
IsDebuggerPresent Jan. 22, 2023, 3:25 p.m.			0	0

pdb_path

D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

section

_RDATA

Time & API	Arguments	Status	Return	Repeated
__exception__ Jan. 22, 2023, 3:25 p.m.	stacktrace: Save+0x8d733 Main-0x1371d cred64+0x91303 @ 0x7fef41f1303 Save+0x8f34b Main-0x11b05 cred64+0x92f1b @ 0x7fef41f2f1b Save+0x903d3 Main-0x10a7d cred64+0x93fa3 @ 0x7fef41f3fa3 Save+0x9077f Main-0x106d1 cred64+0x9434f @ 0x7fef41f434f Save+0xa0838 Main-0x618 cred64+0xa4408 @ 0x7fef4204408 Main+0x65 cred64+0xa4a85 @ 0x7fef4204a85 rundll32+0x2f42 @ 0xff392f42 rundll32+0x3b7a @ 0xff393b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 7a exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d733 Main-0x1371d cred64+0x91303 exception.address: 0x7fef41f1303 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 182 registers.rbx: 0 registers.rsp: 2292032 registers.r11: 2286928 registers.r8: 0 registers.r9: 253416505352 registers.rdx: 3583872 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1	0	0

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Jan. 22, 2023, 3:25 p.m.	process_identifier: 2776 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Jan. 22, 2023, 3:25 p.m.	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0

MicroWorld-eScan	Gen:Variant.Mikey.143765
Zillya	Trojan.Stealer.Win32.33491
CrowdStrike	win/malicious_confidence_60% (D)
Arcabit	Trojan.Mikey.D23195
VirIT	Trojan.Win64.Agent.BUQ
Cyren	W64/Kryptik.ISH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	Win64/PSW.Agent.CW
Cynet	Malicious (score: 100)
Kaspersky	VHO:Trojan-PSW.Win32.Stealer.gen
BitDefender	Gen:Variant.Mikey.143765
Avast	Win64:TrojanX-gen [Trj]
Emsisoft	Gen:Variant.Mikey.143765 (B)
DrWeb	Trojan.SpyBot.1180
VIPRE	Gen:Variant.Mikey.143765
FireEye	Gen:Variant.Mikey.143765
Sophos	Troj/Steal-DCI
Jiangmin	Trojan.PSW.Stealer.bxo
Antiy-AVL	Trojan[PSW]/Win32.Stealer
Microsoft	Trojan:Win64/Amadey.CA!MTB
GData	Gen:Variant.Mikey.143765
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R551446
ALYac	Gen:Variant.Mikey.143765
MAX	malware (ai score=86)
Malwarebytes	Spyware.PasswordStealer
Rising	Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)
Ikarus	Trojan-PSW.Agent
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win64:TrojanX-gen [Trj]

cred64.dll