Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	March 8, 2023, 11:02 a.m.	March 8, 2023, 11:07 a.m.

Size	1.0MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`d4175d9293f11ba1b93acceaccc246f6`
SHA256	`91754bd7d53eec9009fd37b11d67b274b055de8c002faa8c4ac02af60d76943e`
CRC32	`D2A65DF9`
ssdeep	`24576:xdaH8CpPW2AnZVrZ+7xr1bZfVahxs43IF9:HF2AnZVrZSxhZfVaDM`
PDB Path	D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara	UPX_Zero - UPX packed file Malicious_Library_Zero - Malicious_Library OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT PE_Header_Zero - PE File Signature IsPE64 - (no description)

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
2056
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
  2212
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,
2148
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
1684
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
  2252

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

No Suricata Alerts

No Suricata TLS

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA March 8, 2023, 11:02 a.m.	computer_name: TEST22-PC	1	1	0

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent March 8, 2023, 11:02 a.m.			0	0
IsDebuggerPresent March 8, 2023, 11:02 a.m.			0	0

pdb_path

D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

section

_RDATA

Time & API	Arguments	Status	Return	Repeated
__exception__ March 8, 2023, 11:02 a.m.	stacktrace: Save+0x8d733 Main-0x1371d cred64+0x91303 @ 0x7fef3d81303 Save+0x8f34b Main-0x11b05 cred64+0x92f1b @ 0x7fef3d82f1b Save+0x903d3 Main-0x10a7d cred64+0x93fa3 @ 0x7fef3d83fa3 Save+0x9077f Main-0x106d1 cred64+0x9434f @ 0x7fef3d8434f Save+0xa0838 Main-0x618 cred64+0xa4408 @ 0x7fef3d94408 Main+0x65 cred64+0xa4a85 @ 0x7fef3d94a85 rundll32+0x2f42 @ 0xff862f42 rundll32+0x3b7a @ 0xff863b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 7a exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d733 Main-0x1371d cred64+0x91303 exception.address: 0x7fef3d81303 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 586 registers.rbx: 0 registers.rsp: 1177776 registers.r11: 1172672 registers.r8: 0 registers.r9: 236236177417 registers.rdx: 2011168 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1	0	0

Bkav	W32.FlaVoredP.Trojan
Lionic	Trojan.Win32.Stealer.12!c
MicroWorld-eScan	Gen:Variant.Mikey.143765
ClamAV	Win.Malware.Zusy-9985435-0
FireEye	Gen:Variant.Mikey.143765
ALYac	Trojan.Agent.Amadey
Malwarebytes	Spyware.PasswordStealer
VIPRE	Gen:Variant.Mikey.143765
Sangfor	Infostealer.Win64.Amadey.Vfz3
K7AntiVirus	Password-Stealer ( 0059c99d1 )
Alibaba	TrojanPSW:Win64/Stealer.530f263a
K7GW	Password-Stealer ( 0059c99d1 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Mikey.D23195
VirIT	Trojan.Win64.Agent.BUQ
Cyren	W64/Kryptik.ISH.gen!Eldorado
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/PSW.Agent.CW
Paloalto	generic.ml
Cynet	Malicious (score: 100)
Kaspersky	Trojan-PSW.Win64.Stealer.tz
BitDefender	Gen:Variant.Mikey.143765
NANO-Antivirus	Trojan.Win64.Amadey.juyxof
Avast	Win64:TrojanX-gen [Trj]
Tencent	Win64.Trojan-QQPass.QQRob.Bkjl
Emsisoft	Gen:Variant.Mikey.143765 (B)
DrWeb	Trojan.SpyBot.1180
Zillya	Trojan.Agent.Win64.24037
TrendMicro	TROJ_GEN.R002C0DBJ23
McAfee-GW-Edition	BehavesLike.Win64.Dropper.th
Sophos	Troj/Steal-DCI
Ikarus	Trojan-PSW.Agent
Avira	TR/AD.Amadey.lydwq
Antiy-AVL	Trojan[PSW]/Win64.Agent
Gridinsoft	Trojan.Win64.Agent.cl
Microsoft	Trojan:Win64/Amadey.CA!MTB
ViRobot	Trojan.Win.Z.Mikey.1074176.A
GData	Gen:Variant.Mikey.143765
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R551446
McAfee	PWS-FDOE!D4175D9293F1
MAX	malware (ai score=81)
TrendMicro-HouseCall	TROJ_GEN.R002C0DBJ23
Rising	Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)
Fortinet	W64/Agent.CW!tr.pws
AVG	Win64:TrojanX-gen [Trj]
Panda	Trj/CI.A

cred64.dll