24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dropper.Trojan.Generic Sample 068b89e2ec56… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 068b89e2ec56…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 23/30 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f","keywords":["Malicious","Dropper.Trojan.Generic","malware analysis","sandbox report","threat intelligence","068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dropper.Trojan.Generic","antivirusDetections":{"malicious":23,"total":30},"behavioralIndicators":{"malicious":8,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tbb2,Found string "GetLastActivePopup" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: USER32.DLL) Found string "GetActiveWindow" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: USER32.DLL) Found string "MessageBoxA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: USER32.DLL) Found string "LoadLibraryW" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNEL32.DLL) Found string "GetProcessWindowStation" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: USER32.DLL) Found string "GetUserObjectInformationA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: USER32.DLL) Found string "GetLocalTime" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "GetWindowsDirectoryA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "GetExitCodeThread" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "CreateThread" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "GetCurrentProcessId" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "GetComputerNameA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNEL32.DLL) Found string "DeviceIoControl" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "GetDriveTypeA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "GetDiskFreeSpaceExA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "QueryPerformanceCounter" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNEL32.DLL) Found string "FindClose" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "FindNextFileA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "FindFirstFileA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL) Found string "CreateDirectoryA" (Source: 068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin, API is part of module: KERNELBASE.DLL)26:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB3d3d3d3d3d3d3d3d3d3dweIiIiIiIiIiIiIiIiIiIcHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh/////////////////+HB4f/////////////////hweH/////////////////4cHh3d3d3d3d3d3d3d3d3eHB4iIiIiIiIiIiIiIiIiIhweEREREREREREREAAAAAAcHhERERERERERERIgIgIgHB4RERERERERERESICICIBweEREREREREREREREREREcHiIiIiIiIiIiIiIiIiIiHB3d3d3d3d3d3d3d3d3d3dwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD/////AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD//////////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791560835021,"unified_at":"2026-10-09T15:47:15.021Z","metadata":{"hashes":{"sha256":"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f","sha1":"8ca1882483aa6df273b89ed799a2121495e54598","md5":"70e3d7afd1f7be807f6a720537e6c495","sha512":"a0a7d345788806a4214a047d2812836bffbd061c613c44cdbf7ac6344708fb051e6055741b9a3932fc20242ee2b8a8d57ee2c398194b46683b3d48c6b8988ad2","ssdeep":"6144:V+ZQBif8C4cDgF/JAJd4rpaXwddxh2NeLKjJa:V+ZgiIlF/qJdopaCeeLKd","ssdeep_chunks":["6144:V+ZQBif","6144:+ZQBif8","6144:ZQBif8C","6144:QBif8C4","6144:Bif8C4c","6144:if8C4cD","6144:f8C4cDg","6144:8C4cDgF","6144:C4cDgF/","6144:4cDgF/J","6144:cDgF/JA","6144:DgF/JAJ","6144:gF/JAJd","6144:F/JAJd4","6144:/JAJd4r","6144:JAJd4rp","6144:AJd4rpa","6144:Jd4rpaX","6144:d4rpaXw","6144:4rpaXwd","6144:rpaXwdd","6144:paXwddx","6144:aXwddxh","6144:Xwddxh2","6144:wddxh2N","6144:ddxh2Ne","6144:dxh2NeL","6144:xh2NeLK","6144:h2NeLKj","6144:2NeLKjJ","6144:NeLKjJa","12288:V+ZQBif","12288:+ZQBif8","12288:ZQBif8C","12288:QBif8C4","12288:Bif8C4c","12288:if8C4cD","12288:f8C4cDg","12288:8C4cDgF","12288:C4cDgF/","12288:4cDgF/J","12288:cDgF/JA","12288:DgF/JAJ","12288:gF/JAJd","12288:F/JAJd4","12288:/JAJd4r","12288:JAJd4rp","12288:AJd4rpa","12288:Jd4rpaX","12288:d4rpaXw","12288:4rpaXwd","12288:rpaXwdd","12288:paXwddx","12288:aXwddxh","12288:Xwddxh2","12288:wddxh2N","12288:ddxh2Ne","12288:dxh2NeL","12288:xh2NeLK","12288:h2NeLKj","12288:2NeLKjJ","12288:NeLKjJa","6144:V+ZgiIl","6144:+ZgiIlF","6144:ZgiIlF/","6144:giIlF/q","6144:iIlF/qJ","6144:IlF/qJd","6144:lF/qJdo","6144:F/qJdop","6144:/qJdopa","6144:qJdopaC","6144:JdopaCe","6144:dopaCee","6144:opaCeeL","6144:paCeeLK","6144:aCeeLKd"],"imphash":"cbd2d2e6dc4af99dc6e36207fd153077"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":282624,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1541050758000,"last_seen":1591706092000,"last_multi_scan":1591706092000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["gop","guardianofpeace","keydoor","operationtroy","silentchollima","whoisteam"]},"stats":{"av":{"malicious_count":23,"suspicious_count":0,"total_engines":30},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":10},"sandbox_signatures":{"informative_count":14,"suspicious_count":16,"malicious_count":8,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"Ahnlab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Npkon","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.AGeneric","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"BitDefender","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Generic.9459981","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"crowdstrikefalconml":{"name":"CrowdStrike Falcon ML","success":true,"verdict":"malicious","threat_name":"Unavailable (permanently_failed)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/OnlineGames.AQ.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dropped:Trojan.Generic.9459981 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Spy.Keydoor.D trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/MalBehav.gen!B","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"Ikarus","success":true,"verdict":"malicious","threat_name":"Trojan-Dropper.Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"RDN/Generic PWS.ol","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Sdbot.cctgug","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"malicious","threat_name":"Trojan.Daws.18668","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Unavailable (permanently_failed)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"malicious","threat_name":"Trojan/W32.Agent.282624.KE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"totaldefense":{"name":"Total Defense","success":true,"verdict":"malicious","threat_name":"Win32/Tnega.XARZ!suspicious","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"TrendMicro","success":true,"verdict":"malicious","threat_name":"TROJ_GE.E4811872","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"TrendMicro House Call","success":true,"verdict":"malicious","threat_name":"TROJ_GE.E4811872","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"BScope.Backdoor.IRCbot","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"windowsdefender":{"name":"Windows Defender","success":true,"verdict":"malicious","threat_name":"AmsiScanBuffer failed. Did you disable something for Windows Defender?","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xviruspersonalguard":{"name":"Xvirus Personal Guard","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dropper.Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1215","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1055","identifiers":[{"type":"malicious","value":"Allocates virtual memory in a remote process"},{"type":"suspicious","value":"Contains ability to write to a remote process"},{"type":"suspicious","value":"Contains ability to create a remote thread (often used for process injection)"},{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1124","identifiers":[{"type":"informative","value":"Contains ability to query the machine timezone"},{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1083","identifiers":[{"type":"informative","value":"Contains ability to query volume size"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Exfiltration","technique":"Data Compressed","attack_id":"T1002","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/wiki/Technique/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetLocalTime@KERNEL32.dll at 20948-685-1000F1C0\n GetLocalTime@KERNEL32.dll at 20948-688-1000F0D0\n GetSystemTimeAsFileTime@KERNEL32.dll at 20948-592-1001CDA9\n GetLocalTime@KERNEL32.dll at 20948-689-1000EF80\n GetLocalTime@KERNEL32.dll at 20948-822-1001B83E\n GetLocalTime@KERNEL32.dll at 20948-823-1001B8A5\n GetLocalTime@KERNEL32.dll at 20948-781-1000BF10\n GetLocalTime@KERNEL32.dll at 20948-892-10001B50\n GetLocalTime@KERNEL32.dll at 20948-905-100011B0\n GetSystemTimeAsFileTime@KERNEL32.dll at 20948-936-1001E49C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.dll at 20948-650-10022318","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.DLL at 00028876-00002852-16784-1-004070A9\n GetVersionExA@KERNEL32.dll at 20948-378-10026997","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query volume size","description":"GetDiskFreeSpaceA@KERNEL32.DLL at 00028876-00002852-16784-146-00404040\n GetDiskFreeSpaceA@KERNEL32.dll at 20948-483-10017980\n GetDiskFreeSpaceExA@KERNEL32.dll at 20948-851-100025C0\n GetDiskFreeSpaceExA@KERNEL32.dll at 20948-778-1000BDA0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-37","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExA@KERNEL32.dll directly followed by \"cmp dword ptr [ebp-10h], 02h\" and \"jne 100269F9h\" at 20948-378-10026997\n Found API call GetTimeZoneInformation@KERNEL32.dll directly followed by \"cmp eax, FFFFFFFFh\" and \"je 10022566h\" at 20948-650-10022318\n Found API call GetLocalTime@KERNEL32.dll directly followed by \"cmp esi, dword ptr [100306B8h]\" and \"jnl 10001BA1h\" at 20948-892-10001B50","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Rpc\" at 00028876-00002852-0000010C-4986931323","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"General","name":"Runs shell commands","description":"\"cmd /c %WINDIR%\\system32\\\\ud.bat\" on 2018-11-1.06:36:59.153","origin":"Monitored Target","relevance":5,"id":"target-3","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c %WINDIR%\\system32\\\\ud.bat\" (UID: 00029400-00001192)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"cmd.exe\" with commandline \"cmd /c %WINDIR%\\system32\\\\ud.bat\" (UID: 00029400-00001192)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"ud.bat\" has type \"DOS batch file ASCII text with CRLF CR line terminators\"\n \"odbcc32.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Installation/Persistance","name":"Opens the MountPointManager (often used to detect additional infection locations)","description":"\"cmd.exe\" opened \"\\Device\\MountPointManager\"","origin":"API Call","relevance":5,"id":"api-51","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\System32\\odbcc32.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\kernel32.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\wkssvc.dll\"\n \".exe\" touched file \"%WINDIR%\\System32\\svcsum.dll\"\n \".exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \".exe\" touched file \"%WINDIR%\\System32\\ud.bat\"\n \".exe\" touched file \"%WINDIR%\\System32\\rsaenh.dll\"\n \".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"cmd.exe\" touched file \"%WINDIR%\\System32\\en-US\\cmd.exe.mui\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.bin\" was detected as \"Microsoft visual C++ 5.0\"\n \"odbcc32.dll\" was detected as \"Microsoft visual C++ v7.0\"","origin":"Static Parser","mitre_attack_id":"T1002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\".exe\" at 00028876-00002852-00000105-9108120539","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00028876-00002852-00000105-9075694795","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00028876-00002852-16784-181-004025A0","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to create a remote thread (often used for process injection)","description":"CreateRemoteThread@KERNEL32.DLL at 00028876-00002852-16784-81-004015E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-5","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Contains ability to write to a remote process","description":"WriteProcessMemory@KERNEL32.DLL at 00028876-00002852-16784-81-004015E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1055","relevance":8,"id":"stream-34","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\".exe\" is creating a new process\n \".exe\" is creating a new process (Name: \"%WINDIR%\\System32\\cmd.exe\", Handle: 152)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"odbcc32.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"110.45.144.22:443\"\n \"110.45.144.167:8080\"\n \"210.221.154.138:443\"\n \"221.141.1.201:443\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00028876-00002852-16784-82-00402510","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1215","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n CreateToolhelp32Snapshot\n Process32First\n LoadLibraryA\n GetFileAttributesA\n CopyFileA\n GetModuleFileNameA\n Process32Next\n GetFileSize\n WriteProcessMemory\n OpenProcess\n LockResource\n DeleteFileA\n OpenFileMappingA\n UnhandledExceptionFilter\n WinExec\n GetCommandLineA\n GetProcAddress\n MapViewOfFile\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n CreateFileMappingA\n TerminateProcess\n CreateFileA\n GetTickCount\n FindResourceA\n VirtualAlloc\n RegCloseKey\n RegCreateKeyExA\n RegOpenKeyExA\n RegDeleteValueA\n GetDriveTypeA\n GetTempPathA\n DeviceIoControl\n CreateThread\n VirtualProtect\n GetVersionExA\n ExitThread\n CreateDirectoryA\n FindFirstFileA\n GetComputerNameA\n FindNextFileA\n CreateProcessA\n Sleep\n InternetGetConnectedState\n accept\n WSAStartup\n connect\n closesocket\n send\n listen\n recv\n socket\n bind","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$25","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"odbcc32.dll\" has a section named \".plugins\"","origin":"Static Parser","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"C:\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"42/67 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"5/10 Antivirus vendors marked sample as malicious (50% detection rate)\n 42/67 Antivirus vendors marked sample as malicious (62% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.dll at 20948-852-10002130","origin":"Hybrid Analysis Technology","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"22/49 Antivirus vendors marked dropped file \"odbcc32.dll\" as malicious (classified as \"Trojan.Generic\" with 44% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\".exe\" allocated memory in \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"\".exe\" wrote 24 bytes to a remote process \"%WINDIR%\\System32\\spoolsv.exe\" (Handle: 144)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"Internal YARA signature matched on process \"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.exe\"\n Internal YARA signature matched on file \"all.bstring\"","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"711145017a3b4401ab8b02007f950200fc8c0200729602006cc805001ecd41017d264101\" to virtual address \"0x769A07E4\" (part of module \"USER32.DLL\")\n \"cmd.exe\" wrote bytes \"711145017a3b4401ab8b02007f950200fc8c0200729602006cc805001ecd41017d264101\" to virtual address \"0x769A07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":25,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":26,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["gop","guardianofpeace","keydoor","operationtroy","silentchollima","whoisteam"],"sample_flags":["Extracted Files","Sample not shared","TOR analysis"],"sandbox_reports":[{"id":"5bda90207ca3e11f4b730824","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Trojan.Generic","submit_name":"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.exe","analysis_start_time":"2018-11-01T06:37:34+00:00","indicators_count":{"informative":14,"suspicious":12,"malicious":12},"tags":["Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true},{"id":"5bda90207ca3e11f3e41f04a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Dropper.Trojan.Generic","submit_name":"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.exe","analysis_start_time":"2018-11-01T06:35:40+00:00","indicators_count":{"informative":14,"suspicious":15,"malicious":12},"tags":["Extracted Files","Sample not shared","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}],"processes":[{"pid":2852,"ppid":0,"name":"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.exe","command_line":"","sha256":"068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f","normalized_path":"C:\\068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f.exe","uid":"00028876-00002852","icon":"$26"},{"pid":1192,"ppid":2852,"name":"cmd.exe","command_line":"cmd /c %WINDIR%\\system32\\\\ud.bat","sha256":"17f746d82695fa9b35493b41859d39d786d32b23a9d2e00f4011dec7a02402ae","normalized_path":"%WINDIR%\\System32\\cmd.exe","parent_uid":"00028876-00002852","uid":"00029400-00001192"}],"all_imported_dlls":["msvcrt.dll","sspicli.dll","userenv.dll","winbrand.dll","kernel32.dll","KernelBase.dll","sechost.dll","rpcrt4.dll","shlwapi.dll","rsaenh.dll","profapi.dll","user32.dll","lpk.dll","advapi32.dll","msctf.dll","cryptbase.dll","ntdll.dll","gdi32.dll","usp10.dll","imm32.dll","cryptsp.dll","apphelp.dll","wow64.dll","wow64cpu.dll","wow64win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"odbcc32.dll","sha256":"3184ba3a77f794a941985abec1c0bffec8ed3391db8f5adbaa4a284c3b33fc2c","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"name":"ud.bat","sha256":"6eb2dca26f2abb92606d2cbe114c1f03800fbd05fab3feef7656b281098741ba","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]}],"files_written":[{"path":"%WINDIR%\\System32\\odbcc32.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%WINDIR%\\System32\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%WINDIR%\\System32\\wkssvc.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%WINDIR%\\System32\\svcsum.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%APPDATA%\\Microsoft","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%APPDATA%\\Microsoft\\Crypto","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-4162757579-3804539371-4239455898-1000\\021404ae7ed34c62769bc54bbab242b6_e47c61d2-1dae-480e-827a-ae8d797649df","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\System32\\en-US\\cmd.exe.mui","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%WINDIR%\\System32\\ud.bat","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%WINDIR%\\System32","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"C:\\Windows","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"},{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\system32\\ud.bat","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f3e41f04a"}]},{"path":"%WINDIR%\\SysWOW64\\odbcc32.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\SysWOW64\\kernel32.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\SysWOW64\\wkssvc.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\SysWOW64\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%APPDATA%\\Microsoft\\Crypto\\RSA\\S-1-5-21-686412048-2446563785-1323799475-1001\\d153dbf7408b1530cf8d0f0aa640ce7c_6b06490d-f9fd-424c-8b6d-83edc4369e89","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\SysWOW64","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]},{"path":"%WINDIR%\\SysWOW64\\ud.bat","sources":[{"report_type":"sandbox","report_id":"5bda90207ca3e11f4b730824"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["5bda90207ca3e11f4b730824","5bda90207ca3e11f3e41f04a"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Dropper.Trojan.Generic Sample 068b89e2ec56… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 068b89e2ec56…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 23/30 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f"}],["$","meta","4",{"property":"og:title","content":"Malicious Dropper.Trojan.Generic Sample 068b89e2ec56… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 068b89e2ec56…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 23/30 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/068b89e2ec5655d006f2788ea328e5f12bd57ba761ee03c4de2fb0aa01c92c7f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dropper.Trojan.Generic Sample 068b89e2ec56… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 068b89e2ec56…. Malware family: Dropper.Trojan.Generic. Threat score 100/100. 23/30 AV engines flagged this file. 8 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]