Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Oct. 16, 2023, 6:34 p.m.	Oct. 16, 2023, 6:39 p.m.

Size	1.1MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`a83604e32360e2b32ece536021559f13`
SHA256	`dfcf830d9f445d17b12870cb37e682f6d1ddd3b9693f42aed2b6e167363dc412`
CRC32	`BFDEEC3B`
ssdeep	`24576:CaS3LyrV872cT+RZCPrZ13b1yolNVQ3whaH:VV872cTsZKZ13EWwwhaH`
PDB Path	D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb
Yara	Malicious_Library_Zero - Malicious_Library UPX_Zero - UPX packed file infoStealer_browser_b_Zero - browser info stealer PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
2636
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
  2828
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
2552
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
  2788
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,
2728

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
94.198.50.231	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (1 event)

Time & API	Arguments	Status	Return	Repeated
GetComputerNameA Oct. 16, 2023, 6:26 p.m.	computer_name: TEST22-PC	1	1	0

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 16, 2023, 6:26 p.m.			0	0
IsDebuggerPresent Oct. 16, 2023, 6:26 p.m.			0	0

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\Amadey\StealerDLL\x64\Release\STEALERDLL.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

One or more processes crashed (1 event)

Time & API	Arguments	Status	Return	Repeated
__exception__ Oct. 16, 2023, 6:26 p.m.	stacktrace: Save+0x8d973 Main-0x1478d cred64+0x91e43 @ 0x7fef41e1e43 Save+0x8f58b Main-0x12b75 cred64+0x93a5b @ 0x7fef41e3a5b Save+0x90613 Main-0x11aed cred64+0x94ae3 @ 0x7fef41e4ae3 Save+0x909bf Main-0x11741 cred64+0x94e8f @ 0x7fef41e4e8f Save+0xa1ae8 Main-0x618 cred64+0xa5fb8 @ 0x7fef41f5fb8 Main+0x65 cred64+0xa6635 @ 0x7fef41f6635 rundll32+0x2f42 @ 0xff222f42 rundll32+0x3b7a @ 0xff223b7a BaseThreadInitThunk+0xd CreateThread-0x53 kernel32+0x1652d @ 0x76c2652d RtlUserThreadStart+0x21 strchr-0x3df ntdll+0x2c521 @ 0x76d5c521 exception.instruction_r: 42 38 3c 00 75 f7 48 8b d0 48 8d 4c 24 50 e8 fa exception.instruction: cmp byte ptr [rax + r8], dil exception.exception_code: 0xc0000005 exception.symbol: Save+0x8d973 Main-0x1478d cred64+0x91e43 exception.address: 0x7fef41e1e43 registers.r14: 0 registers.r15: 0 registers.rcx: 1099511627775 registers.rsi: 0 registers.r10: 10 registers.rbx: 0 registers.rsp: 2293584 registers.r11: 2288480 registers.r8: 0 registers.r9: 347893268520 registers.rdx: 4437392 registers.r12: 0 registers.rbp: 0 registers.rdi: 0 registers.rax: 1 registers.r13: 0	1	0	0

Allocates read-write-execute memory (usually to unpack itself) (2 events)

Time & API	Arguments	Status	Return	Repeated
NtProtectVirtualMemory Oct. 16, 2023, 6:26 p.m.	process_identifier: 2788 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0
NtProtectVirtualMemory Oct. 16, 2023, 6:26 p.m.	process_identifier: 2828 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000000007304c000 process_handle: 0xffffffffffffffff	1	0	0

Communicates with host for which no DNS query was performed (1 event)

host

94.198.50.231

File has been identified by 51 AntiVirus engines on VirusTotal as malicious (50 out of 51 events)

Bkav	W64.AIDetectMalware
Lionic	Trojan.Win32.Convagent.4!c
MicroWorld-eScan	Gen:Variant.Zusy.477261
CAT-QuickHeal	Trojanpws.Convagent
Skyhigh	BehavesLike.Win64.Emotet.th
ALYac	Gen:Variant.Zusy.477261
Malwarebytes	Malware.AI.3926716592
VIPRE	Gen:Variant.Zusy.477261
Sangfor	Trojan.Win32.Save.a
K7AntiVirus	Trojan-Downloader ( 005a4ab01 )
Alibaba	TrojanDownloader:Win32/Amadey.ff278edf
K7GW	Trojan-Downloader ( 005a4ab01 )
CrowdStrike	win/malicious_confidence_100% (W)
Arcabit	Trojan.Zusy.D7484D
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.G
Cynet	Malicious (score: 100)
ClamAV	Win.Malware.Zusy-9985435-0
Kaspersky	Trojan.Win32.Nymaim.ccag
BitDefender	Gen:Variant.Zusy.477261
Avast	Win64:PWSX-gen [Trj]
Tencent	Malware.Win32.Gencirc.13f1884f
Emsisoft	Gen:Variant.Zusy.477261 (B)
F-Secure	Heuristic.HEUR/AGEN.1301090
DrWeb	Trojan.SpyBot.1263
Zillya	Trojan.Nymaim.Win32.13582
TrendMicro	TROJ_GEN.R002C0DJC23
FireEye	Gen:Variant.Zusy.477261
Sophos	Troj/Steal-DCI
Ikarus	Trojan-PSW.Agent
Jiangmin	Trojan.PSW.Stealer.cnb
Varist	W64/Zusy.RV.gen!Eldorado
Avira	HEUR/AGEN.1301090
Antiy-AVL	Trojan[Downloader]/Win32.Amadey
Microsoft	Trojan:Win32/Amadey!ic
ViRobot	Trojan.Win.Z.Zusy.1110016.M
ZoneAlarm	Trojan.Win32.Nymaim.ccag
GData	Gen:Variant.Zusy.477261
Google	Detected
AhnLab-V3	Trojan/Win.Generic.R595469
McAfee	Artemis!A83604E32360
MAX	malware (ai score=87)
Cylance	unsafe
Panda	Trj/GdSda.A
TrendMicro-HouseCall	TROJ_GEN.R002C0DJC23
Rising	Stealer.Convagent!8.1326D (TFE:5:7c4j9hQ2SPS)
Yandex	Trojan.DL.Amadey!7mLEC54USNE
MaxSecure	Trojan.Malware.300983.susgen
AVG	Win64:PWSX-gen [Trj]

cred64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All