Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	Oct. 17, 2024, 10:33 a.m.	Oct. 17, 2024, 11:05 a.m.

Size	1.2MB
Type	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
MD5	`d936bcd060924a3ea77c08a9fe550990`
SHA256	`efadeacca8afa370fce709a27632f7d9a7d684cb55840024421f740494d69633`
CRC32	`5C6CA2C4`
ssdeep	`24576:QjmYtk9aPXnWZJaINseYrCU9PZ0yNJ0+HnxPWg:T4XnWeYlYr5Uyj0mx`
PDB Path	D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE64 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
2140
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Save
  2296
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,
2224
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
1460
- rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred64.dll,Main
  2332
  - netsh.exe netsh wlan show profiles
    2432
  - powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal
    2560
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
dukastotranza.click	A 79.110.62.15	79.110.62.15
specificsecurity.ru	A 79.110.62.15	79.110.62.15
smartkontur.site

IP Address	Status	Action
136.243.104.235	Active	Moloch
164.124.101.2	Active	Moloch
79.110.62.15	Active	Moloch
45.82.153.229	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 79.110.62.15:80 -> 192.168.56.103:49168	2400007	ET DROP Spamhaus DROP Listed Traffic Inbound group 8	Misc Attack
TCP 79.110.62.15:80 -> 192.168.56.103:49168	2402000	ET DROP Dshield Block Listed Source group 1	Misc Attack

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Oct. 17, 2024, 10:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 17, 2024, 10:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 17, 2024, 10:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 17, 2024, 10:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Oct. 17, 2024, 10:26 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Oct. 17, 2024, 10:26 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Oct. 17, 2024, 10:26 a.m.			0	0
IsDebuggerPresent Oct. 17, 2024, 10:26 a.m.			0	0
IsDebuggerPresent Oct. 17, 2024, 10:26 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000384d70 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040ddb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040ddb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040ddb0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e050 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e050 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e0c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e0c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e0c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e0c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e360 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e0c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e0c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e0c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e8a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e8a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e8a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e8a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e8a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e8a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e8a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e8a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000000040e980 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f48b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f48b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f46f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f46f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f48b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f48b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f48b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003668d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003668d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000384c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000384c90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2ed420 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:26 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2ed420 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2ed730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2ed730 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4530 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4530 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4530 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Oct. 17, 2024, 10:27 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003f4530 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

This executable has a PDB path (1 event)

pdb_path

D:\Mktmp\StealerDLL\x64\Release\STEALERDLL.pdb

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe\Path

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Oct. 17, 2024, 10:26 a.m.		1	1	0

The executable contains unknown PE section names indicative of a packer (could be a false positive) (1 event)

section

_RDATA

HTTP traffic contains suspicious features which may be indicative of malware related traffic (2 events)

suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST http://dukastotranza.click/NfjxzZz8jn/index.php
suspicious_features	POST method with no referer header, POST method with no useragent header				suspicious_request	POST http://specificsecurity.ru/NfjxzZz9jn/index.php

Performs some HTTP requests (2 events)

request	POST http://dukastotranza.click/NfjxzZz8jn/index.php
request	POST http://specificsecurity.ru/NfjxzZz9jn/index.php

Sends data using the HTTP POST Method (2 events)

request	POST http://dukastotranza.click/NfjxzZz8jn/index.php
request	POST http://specificsecurity.ru/NfjxzZz9jn/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 175 events)

Time & API	Arguments	Status
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 917504 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000026d0000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002730000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2831000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aae000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aaf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2ab1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2aae000 process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00022000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 589824 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff10000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 65536 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 1056768 (MEM_RESERVE\|MEM_TOP_DOWN) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fffff00000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000da000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00012000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002732000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 12288 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002734000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ea000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00023000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00024000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00112000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000ed000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000db000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d2000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00025000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00160000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00013000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00026000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00113000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000dc000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff000d3000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff0001a000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 4096 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007ff00161000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Oct. 17, 2024, 10:26 a.m.	process_identifier: 2560 region_size: 16384 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002737000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (5 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (5 events)

Time & API	Arguments	Status	Return
Process32NextW Oct. 17, 2024, 10:26 a.m.	snapshot_handle: 0x0000000000000128 process_name: SearchFilterHost.exe process_identifier: 1696	1	1
Process32NextW Oct. 17, 2024, 10:26 a.m.	snapshot_handle: 0x0000000000000128 process_name: pw.exe process_identifier: 800	1	1
Process32NextW Oct. 17, 2024, 10:26 a.m.	snapshot_handle: 0x0000000000000128 process_name: rundll32.exe process_identifier: 1460	1	1
Process32NextW Oct. 17, 2024, 10:26 a.m.	snapshot_handle: 0x0000000000000128 process_name: rundll32.exe process_identifier: 2332	1	1
Process32NextW Oct. 17, 2024, 10:26 a.m.	snapshot_handle: 0x0000000000000128 process_name: schtasks.exe process_identifier: 2380	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Oct. 17, 2024, 10:26 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

netsh wlan show profiles

Communicates with host for which no DNS query was performed (2 events)

host	136.243.104.235
host	45.82.153.229

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets
file	C:\Users\test22\AppData\Roaming\Litecoin\wallets

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (12 events)

file	C:\Windows\.purple\accounts.xml
file	C:\Python27\.purple\accounts.xml
file	C:\Windows\System32\.purple\accounts.xml
file	C:\.purple\accounts.xml
file	C:\SystemRoot\System32\.purple\accounts.xml
file	C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file	C:\Program Files (x86)\Microsoft Office\Office15\.purple\accounts.xml
file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\.purple\accounts.xml
file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file	C:\Windows\SysWOW64\.purple\accounts.xml
file	C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\.purple\accounts.xml

Harvests credentials from local email clients (2 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000002\SMTP Server
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003\SMTP Server

File has been identified by 52 AntiVirus engines on VirusTotal as malicious (50 out of 52 events)

Lionic	Trojan.Win32.Convagent.i!c
Cynet	Malicious (score: 100)
ALYac	Gen:Variant.Zusy.477261
Cylance	Unsafe
VIPRE	Gen:Variant.Zusy.477261
Sangfor	Infostealer.Win32.Convagent.Vvqy
CrowdStrike	win/malicious_confidence_100% (D)
BitDefender	Gen:Variant.Zusy.477261
K7GW	Password-Stealer ( 0059c7191 )
K7AntiVirus	Password-Stealer ( 0059c7191 )
Arcabit	Trojan.Zusy.D7484D
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win64/PSW.Agent.CW
Avast	Win64:BotX-gen [Trj]
ClamAV	Win.Keylogger.Zusy-10017136-0
Kaspersky	HEUR:Trojan-PSW.Win32.Convagent.gen
Alibaba	TrojanPSW:Win32/Convagent.8e7869e9
MicroWorld-eScan	Gen:Variant.Zusy.477261
Rising	Stealer.Agent!8.C2 (TFE:5:PmswK9jgQcH)
Emsisoft	Gen:Variant.Zusy.477261 (B)
F-Secure	Heuristic.HEUR/AGEN.1364344
DrWeb	Trojan.PWS.Stealer.39956
Zillya	Trojan.Agent.Win64.63899
McAfeeD	ti!EFADEACCA8AF
CTX	dll.trojan.convagent
Sophos	Mal/Generic-S
FireEye	Gen:Variant.Zusy.477261
Jiangmin	Trojan.PSW.Convagent.ow
Google	Detected
Avira	HEUR/AGEN.1364344
Antiy-AVL	Trojan[PSW]/Win32.Convagent
Kingsoft	Win32.Trojan-PSW.Convagent.gen
Microsoft	PWS:Win32/Multiverze
ZoneAlarm	HEUR:Trojan-PSW.Win32.Convagent.gen
GData	Gen:Variant.Zusy.477261
Varist	W64/Kryptik.LNI.gen!Eldorado
AhnLab-V3	Trojan/Win.Generic.C5288456
McAfee	Artemis!D936BCD06092
DeepInstinct	MALICIOUS
Malwarebytes	Spyware.Stealer
Ikarus	Trojan-PSW.Agent
Panda	Trj/Chgt.AD
TrendMicro-HouseCall	TROJ_GEN.R002H0CI524
Tencent	Malware.Win32.Gencirc.1418f591
Yandex	Trojan.PWS.Agent!oXZrSnSzNRA
huorong	TrojanSpy/Stealer.hk
MaxSecure	Trojan.Malware.109650624.susgen
Fortinet	W64/Agent.CW!tr.pws
AVG	Win64:BotX-gen [Trj]

cred64.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All