Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	May 28, 2023, 1:42 p.m.	May 28, 2023, 2:21 p.m.

Size	1.0MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`076fcb9fd24a6fa50386d9e7cd8dd3cc`
SHA256	`3d5d48ea2b6f76af583e541602950d89b8d96a13654469df3bc58dcddf879e9d`
CRC32	`3DC8EC76`
ssdeep	`24576:4Mq/RX0hoa8wrC+azFbtZhUYFauTZyRMDo:4ioa8wrCHz3ZhUYRA0o`
PDB Path	D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check Malicious_Library_Zero - Malicious_Library IsDLL - (no description) IsPE64 - (no description) Ave_Maria_Zero - Remote Access Trojan that is also called WARZONE RAT PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
2152
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
  2308
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,
2240
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
1704
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
  2348

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA May 28, 2023, 1:35 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent May 28, 2023, 1:35 p.m.			0	0
IsDebuggerPresent May 28, 2023, 1:35 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ May 28, 2023, 1:35 p.m.	stacktrace: Save+0x8d733 Main-0x1478d cred64+0x91b73 @ 0x7fef3da1b73 Save+0x8f34b Main-0x12b75 cred64+0x9378b @ 0x7fef3da378b Save+0x903d3 Main-0x11aed cred64+0x94813 @ 0x7fef3da4813 Save+0x9077f Main-0x11741 cred64+0x94bbf @ 0x7fef3da4bbf Save+0xa18a8 Main-0x618 cred64+0xa5ce8 @ 0x7fef3db5ce8 Main+0x65 cred64+0xa6365 @ 0x7fef3db6365 rundll32+0x2f42 @ 0xff842f42 rundll32+0x3b7a @ 0xff843b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76fd652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x776ec521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d733 Main-0x1478d cred64+0x91b73 exception.address: 0x7fef3da1b73 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 273 registers.rbx: 0 registers.rsp: 1636992 registers.r11: 1631888 registers.r8: 0 registers.r9: 236236177417 registers.rdx: 2666528 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1	0	0

File has been identified by 48 AntiVirus engines on VirusTotal as malicious (48 events)

Elastic	malicious (high confidence)
MicroWorld-eScan	Trojan.GenericKD.67147004
ClamAV	Win.Malware.Zusy-9985435-0
CAT-QuickHeal	Trojan.IGENERIC
McAfee	PWS-FDPG!076FCB9FD24A
Malwarebytes	Generic.Malware.AI.DDS
Sangfor	Trojan.Win32.Save.a
Alibaba	TrojanPSW:Win64/Stealer.134848e7
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Generic.D40094FC
VirIT	Trojan.Win64.Genus.LR
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.G
Cynet	Malicious (score: 100)
Kaspersky	Trojan-PSW.Win64.Stealer.auj
BitDefender	Trojan.GenericKD.67147004
ViRobot	Trojan.Win.Z.Mikey.1088512.R
Avast	Win64:TrojanX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13afc33d
Emsisoft	Trojan.GenericKD.67147004 (B)
F-Secure	Trojan.TR/Redcap.jphdl
DrWeb	Trojan.SpyBot.1205
VIPRE	Trojan.GenericKD.67147004
TrendMicro	TROJ_GEN.R002C0DEK23
McAfee-GW-Edition	BehavesLike.Win64.Dropper.th
FireEye	Trojan.GenericKD.67147004
Sophos	Troj/Steal-DCI
Jiangmin	Trojan.PSW.Stealer.cfw
Avira	TR/Redcap.jphdl
MAX	malware (ai score=81)
Antiy-AVL	Trojan[Downloader]/Win32.Amadey
Microsoft	Trojan:Win64/Amadey.CAV!MTB
ZoneAlarm	Trojan-PSW.Win64.Stealer.auj
GData	Trojan.GenericKD.67147004
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R561816
TACHYON	Trojan-PWS/W64.InfoStealer.1088512
VBA32	TrojanPSW.Win64.Stealer
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DEK23
Rising	Stealer.Agent!8.C2 (TFE:5:8Idbp2vqW9I)
Yandex	Trojan.DL.Amadey!8VcuS9mIThA
Ikarus	Trojan-PSW.Agent
MaxSecure	Trojan.Malware.208616034.susgen
Fortinet	W32/Amadey.G!tr.dldr
AVG	Win64:TrojanX-gen [Trj]
DeepInstinct	MALICIOUS

cred64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All