Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	July 14, 2023, 4:46 p.m.	July 14, 2023, 4:48 p.m.

Size	1.1MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`5ac4952f9d0b64a682762d2ef24c48dc`
SHA256	`b73a969f9b129f8e89c49f1697078480af1d922ce10607fe3b851d9f6bb428b3`
CRC32	`406B5FCB`
ssdeep	`24576:4aSMLyrm87DcT+RZCPbZ1HslyolNVwkVGivKBDy:8m87DcTsZ6Z1HDWrVGivKBDy`
PDB Path	D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara	UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check IsDLL - (no description) infoStealer_browser_b_Zero - browser info stealer IsPE64 - (no description) Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
2564
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
  2804
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
2648
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
  2796
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,
2740

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
No hosts contacted.

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA July 14, 2023, 4:46 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent July 14, 2023, 4:46 p.m.			0	0
IsDebuggerPresent July 14, 2023, 4:46 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ July 14, 2023, 4:46 p.m.	stacktrace: Save+0x8d973 Main-0x1478d cred64+0x91e43 @ 0x7fef4311e43 Save+0x8f58b Main-0x12b75 cred64+0x93a5b @ 0x7fef4313a5b Save+0x90613 Main-0x11aed cred64+0x94ae3 @ 0x7fef4314ae3 Save+0x909bf Main-0x11741 cred64+0x94e8f @ 0x7fef4314e8f Save+0xa1ae8 Main-0x618 cred64+0xa5fb8 @ 0x7fef4325fb8 Main+0x65 cred64+0xa6635 @ 0x7fef4326635 rundll32+0x2f42 @ 0xffe22f42 rundll32+0x3b7a @ 0xffe23b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d973 Main-0x1478d cred64+0x91e43 exception.address: 0x7fef4311e43 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 24 registers.rbx: 0 registers.rsp: 982032 registers.r11: 976928 registers.r8: 0 registers.r9: 249121079305 registers.rdx: 2404112 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory July 14, 2023, 4:46 p.m.	process_identifier: 2804 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory July 14, 2023, 4:46 p.m.	process_identifier: 2796 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W32.Common.2D861115
Lionic	Trojan.Win32.Stealer.12!c
Cynet	Malicious (score: 100)
FireEye	Gen:Variant.Cerbu.160783
CAT-QuickHeal	Trojanpws.Win64
McAfee	Artemis!5AC4952F9D0B
Malwarebytes	Amadey.Trojan.Downloader.DDS
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005a0ec91 )
Alibaba	TrojanPSW:Win64/Stealer.d203c132
K7GW	Trojan-Downloader ( 005a0ec91 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Cerbu.D2740F
Cyren	W64/ABRisk.SYIP-5395
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.G
ClamAV	Win.Malware.Zusy-9985435-0
Kaspersky	Trojan-PSW.Win64.Stealer.bom
BitDefender	Gen:Variant.Cerbu.160783
ViRobot	Trojan.Win.Z.Cerbu.1110016.D
MicroWorld-eScan	Gen:Variant.Cerbu.160783
Avast	Win64:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13e81605
Emsisoft	Gen:Variant.Cerbu.160783 (B)
F-Secure	Heuristic.HEUR/AGEN.1301090
VIPRE	Gen:Variant.Cerbu.160783
TrendMicro	TROJ_GEN.R002C0DG723
McAfee-GW-Edition	BehavesLike.Win64.Dropper.th
Sophos	Troj/Steal-DCI
Webroot	W32.Trojan.Gen
Avira	HEUR/AGEN.1301090
Antiy-AVL	Trojan[Downloader]/Win32.Amadey
Gridinsoft	Trojan.Win64.Downloader.ns
Microsoft	Trojan:Win32/Amadey!ic
ZoneAlarm	Trojan-PSW.Win64.Stealer.bom
GData	Gen:Variant.Cerbu.160783
Google	Detected
AhnLab-V3	Trojan/Win.Generic.C5288456
ALYac	Gen:Variant.Cerbu.160783
MAX	malware (ai score=87)
Cylance	unsafe
Panda	Trj/CI.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DG723
Rising	Stealer.Convagent!8.1326D (TFE:5:7c4j9hQ2SPS)
Yandex	Trojan.DL.Amadey!ilbTmXZSw+Y
Ikarus	Trojan-PSW.Agent
MaxSecure	Trojan.Malware.212197877.susgen
Fortinet	W32/Amadey.G!tr
AVG	Win64:PWSX-gen [Trj]

cred64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All