Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Aug. 11, 2024, 2:21 p.m.	Aug. 11, 2024, 2:29 p.m.

Size	1.0MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`e4b1979dd4d6f2bf3d6668506ffe80e6`
SHA256	`61c9087a7bd89e6c7b25399f7dcaa95c27f1ede854a79aa47729b4f777d8bb8c`
CRC32	`50935208`
ssdeep	`24576:mmHdWn/tHJ6V/b+nygNPoPOzmyt0z8n+C3gl6dy/nJQ+bO3q3C:UobUKtbOa3C`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) UPX_Zero - UPX packed file Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Main
2648
- netsh.exe netsh wlan show profiles
  2928
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Save
2732
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,
2824
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
164.124.101.2	Active	Moloch
80.66.75.214	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Checks if process is being debugged by a debugger (2 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Aug. 11, 2024, 2:21 p.m.			0	0
IsDebuggerPresent Aug. 11, 2024, 2:21 p.m.			0	0

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\Psi\profiles\default\accounts.xml
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://80.66.75.214/g8djmsaxA/index.php

Performs some HTTP requests (1 event)

request

POST http://80.66.75.214/g8djmsaxA/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://80.66.75.214/g8djmsaxA/index.php

Allocates read-write-execute memory (usually to unpack itself) (28 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73404000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73442000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2648 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73591000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73660000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73441000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x735c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73404000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73442000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Aug. 11, 2024, 2:21 p.m.	process_identifier: 2732 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Aug. 11, 2024, 2:22 p.m.	process_identifier: 1452 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000046a0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (5 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 events)

Time & API	Arguments	Status	Return
Process32NextW Aug. 11, 2024, 2:21 p.m.	snapshot_handle: 0x00000178 process_name: mobsync.exe process_identifier: 2292	1	1
Process32NextW Aug. 11, 2024, 2:21 p.m.	snapshot_handle: 0x00000178 process_name: pw.exe process_identifier: 2332	1	1
Process32NextW Aug. 11, 2024, 2:21 p.m.	snapshot_handle: 0x00000178 process_name: wsqmcons.exe process_identifier: 2376	1	1
Process32NextW Aug. 11, 2024, 2:21 p.m.	snapshot_handle: 0x00000178 process_name: sdclt.exe process_identifier: 2396	1	1
Process32NextW Aug. 11, 2024, 2:21 p.m.	snapshot_handle: 0x00000178 process_name: rundll32.exe process_identifier: 2648	1	1

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

netsh wlan show profiles

Communicates with host for which no DNS query was performed (1 event)

host

80.66.75.214

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets
file	C:\Users\test22\AppData\Roaming\Litecoin\wallets

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (18 events)

file	C:\Windows\.purple\accounts.xml
file	C:\util\Office.2010.Toolkit.and.EZ-Activator.v2.1.5.Final\.purple\accounts.xml
file	C:\Windows\System32\.purple\accounts.xml
file	C:\Program Files\Windows Photo Viewer\.purple\accounts.xml
file	C:\.purple\accounts.xml
file	C:\Program Files\_Sandboxie\.purple\accounts.xml
file	C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file	C:\Program Files\Windows NT\Accessories\.purple\accounts.xml
file	C:\util\.purple\accounts.xml
file	C:\Python27\.purple\accounts.xml
file	C:\Program Files (x86)\Microsoft Office\Office12\.purple\accounts.xml
file	C:\Users\test22\Downloads\.purple\accounts.xml
file	C:\Program Files (x86)\Google\Chrome\Application\.purple\accounts.xml
file	C:\Program Files (x86)\Hnc\Hwp80\.purple\accounts.xml
file	C:\Program Files\_Wireshark\.purple\accounts.xml
file	C:\Windows\SysWOW64\.purple\accounts.xml
file	C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (2 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

File has been identified by 60 AntiVirus engines on VirusTotal as malicious (50 out of 60 events)

Bkav	W32.AIDetectMalware
Lionic	Trojan.Win32.Amadey.l!c
Elastic	malicious (high confidence)
Cynet	Malicious (score: 100)
Skyhigh	BehavesLike.Win32.Dropper.th
ALYac	Gen:Variant.Zusy.440080
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.440080
Sangfor	Infostealer.Win32.Amadey.Vvh6
K7AntiVirus	Trojan-Downloader ( 005a0ec91 )
BitDefender	Gen:Variant.Zusy.440080
K7GW	Trojan-Downloader ( 005a0ec91 )
Arcabit	Trojan.Zusy.D6B710
VirIT	Trojan.Win32.GenusT.DXAH
Symantec	ML.Attribute.HighConfidence
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.G
McAfee	Artemis!E4B1979DD4D6
Avast	Win32:BotX-gen [Trj]
ClamAV	Win.Keylogger.Zusy-10017136-0
Kaspersky	HEUR:Trojan-Spy.Win32.Stealer.gen
Alibaba	TrojanSpy:Win32/Amadey.88af9ca6
NANO-Antivirus	Trojan.Win32.SpyBot.keolwc
MicroWorld-eScan	Gen:Variant.Zusy.440080
Rising	Stealer.Agent!8.C2 (TFE:5:1tQNmVJHBpU)
Emsisoft	Gen:Variant.Zusy.440080 (B)
F-Secure	Heuristic.HEUR/AGEN.1374093
DrWeb	Trojan.SpyBot.1331
Zillya	Downloader.Amadey.Win32.305
TrendMicro	TROJ_GEN.R002C0DH724
McAfeeD	ti!61C9087A7BD8
FireEye	Generic.mg.e4b1979dd4d6f2bf
Sophos	Troj/Steal-DCI
Jiangmin	TrojanSpy.Stealer.ajjd
Google	Detected
Avira	HEUR/AGEN.1374093
MAX	malware (ai score=83)
Antiy-AVL	Trojan[Downloader]/Win32.Amadey
Kingsoft	Win32.Trojan-Spy.Stealer.gen
Gridinsoft	Trojan.Win32.Downloader.oa!s1
Microsoft	Trojan:Win32/Amadey.RDAB!MTB
ZoneAlarm	HEUR:Trojan-Spy.Win32.Stealer.gen
GData	Gen:Variant.Zusy.440080
AhnLab-V3	Trojan/Win.Generic.R642802
BitDefenderTheta	Gen:NN.ZedlaF.36810.av4@a0TKKNli
TACHYON	Trojan-Spy/W32.InfoStealer.1063936.B
DeepInstinct	MALICIOUS
VBA32	TrojanSpy.Stealer
Malwarebytes	Floxif.Virus.FileInfector.DDS
Ikarus	Trojan-PSW.Agent
Panda	Trj/GdSda.A

cred.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All