Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 27, 2023, 10:13 a.m.	Jan. 27, 2023, 10:15 a.m.

Size	860.5KB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`e2ee20e2f0a8853cae1772d095543799`
SHA256	`18f33da5db9ab9b2339158aaef6663ff97fa2994395211cf23626ffa7c1db9ae`
CRC32	`0B18DD23`
ssdeep	`24576:fMxb+U4AFWNkTbWgp6d461tnfpgOH+Rwj5u:fYtaNbhZ+aj5u`
PDB Path	D:\Mktmp\Amadey\StealerDLL\Release\STEALERDLL.pdb
Yara	IsPE32 - (no description) OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT PE_Header_Zero - PE File Signature Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Main
2548
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Save
2640
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,
2732
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
77.73.133.72	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 27, 2023, 10:13 a.m.			0	0
IsDebuggerPresent Jan. 27, 2023, 10:13 a.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\StealerDLL\Release\STEALERDLL.pdb

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\.purple\accounts.xml
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://77.73.133.72/8bmdh3Slb2/index.php

Performs some HTTP requests (1 event)

request

POST http://77.73.133.72/8bmdh3Slb2/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://77.73.133.72/8bmdh3Slb2/index.php

Allocates read-write-execute memory (usually to unpack itself) (29 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73364000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73432000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2548 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73431000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733a1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73364000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73432000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 27, 2023, 10:13 a.m.	process_identifier: 2640 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 27, 2023, 10:07 a.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046f0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (5 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (38 events)

Time & API	Arguments	Status	Return
Process32FirstW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: [System Process] process_identifier: 0	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: System process_identifier: 4	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: smss.exe process_identifier: 224	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: csrss.exe process_identifier: 304	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: wininit.exe process_identifier: 352	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: csrss.exe process_identifier: 360	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: winlogon.exe process_identifier: 400	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: services.exe process_identifier: 444	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: lsass.exe process_identifier: 460	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: lsm.exe process_identifier: 468	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 572	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 652	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 724	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 784	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 832	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: audiodg.exe process_identifier: 900	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 992	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 292	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: spoolsv.exe process_identifier: 324	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 1048	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: srvany.exe process_identifier: 1284	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: KMService.exe process_identifier: 1436	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: conhost.exe process_identifier: 1448	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: taskhost.exe process_identifier: 1600	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: sppsvc.exe process_identifier: 1820	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: svchost.exe process_identifier: 1896	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: dwm.exe process_identifier: 1260	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: explorer.exe process_identifier: 1452	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: pw.exe process_identifier: 988	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: SearchIndexer.exe process_identifier: 1160	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: SearchProtocolHost.exe process_identifier: 936	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: SearchFilterHost.exe process_identifier: 2000	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: mobsync.exe process_identifier: 2284	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: pw.exe process_identifier: 2324	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: wsqmcons.exe process_identifier: 2352	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: taskhost.exe process_identifier: 2372	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: sdclt.exe process_identifier: 2380	1	1
Process32NextW Jan. 27, 2023, 10:13 a.m.	snapshot_handle: 0x0000016c process_name: rundll32.exe process_identifier: 2548	1	1

Communicates with host for which no DNS query was performed (1 event)

host

77.73.133.72

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets
file	C:\Users\test22\AppData\Roaming\Litecoin\wallets

Harvests credentials from local FTP client softwares (1 event)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml

Harvests information related to installed instant messenger clients (17 events)

file	C:\Windows\.purple\accounts.xml
file	C:\util\Office.2010.Toolkit.and.EZ-Activator.v2.1.5.Final\.purple\accounts.xml
file	C:\Windows\System32\.purple\accounts.xml
file	C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file	C:\.purple\accounts.xml
file	C:\Program Files\_Sandboxie\.purple\accounts.xml
file	C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file	C:\Program Files\Windows NT\Accessories\.purple\accounts.xml
file	C:\util\.purple\accounts.xml
file	C:\Python27\.purple\accounts.xml
file	C:\Program Files (x86)\Microsoft Office\Office12\.purple\accounts.xml
file	C:\Users\test22\Downloads\.purple\accounts.xml
file	C:\Program Files (x86)\Google\Chrome\Application\.purple\accounts.xml
file	C:\Program Files (x86)\Hnc\Hwp80\.purple\accounts.xml
file	C:\Program Files\_Wireshark\.purple\accounts.xml
file	C:\Windows\SysWOW64\.purple\accounts.xml
file	C:\Program Files\Windows Photo Viewer\.purple\accounts.xml

File has been identified by 38 AntiVirus engines on VirusTotal as malicious (38 events)

Lionic	Trojan.Win32.Generic.4!c
DrWeb	Trojan.PWS.Spy.21673
MicroWorld-eScan	Gen:Variant.Zusy.440080
FireEye	Generic.mg.e2ee20e2f0a8853c
ALYac	Gen:Variant.Zusy.440080
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.440080
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Password-Stealer ( 0059c4ce1 )
K7GW	Password-Stealer ( 0059c4ce1 )
Arcabit	Trojan.Zusy.D6B710
BitDefenderTheta	Gen:NN.ZedlaF.36212.1u4@aGov3cgi
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/PSW.Agent.OPN
Cynet	Malicious (score: 100)
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Zusy.440080
NANO-Antivirus	Trojan.Win32.Mlw.juilzu
Avast	Win32:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.11722144
Emsisoft	Gen:Variant.Zusy.440080 (B)
Zillya	Trojan.Agent.Win32.3189918
McAfee-GW-Edition	BehavesLike.Win32.Generic.ch
Sophos	Mal/Generic-S + Troj/Steal-DCI
Antiy-AVL	Trojan[PSW]/Win32.Agent
Microsoft	Trojan:Win64/Amadey.CA!MTB
GData	Gen:Variant.Zusy.440080
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5288735
McAfee	Artemis!E2EE20E2F0A8
MAX	malware (ai score=84)
Malwarebytes	Spyware.PasswordStealer
Rising	Stealer.Agent!8.C2 (TFE:5:U9P1qqwbTJD)
Yandex	Trojan.PWS.Agent!jIftDANpk2E
Ikarus	Trojan-PSW.Agent
AVG	Win32:PWSX-gen [Trj]
Panda	Trj/GdSda.A

cred.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All