26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 42:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 0feca1ec2a55… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 0feca1ec2a55…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/0feca1ec2a554be5179ecad65d8de9c26c3b8e46cb192c636ea19c226460aca7","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","0feca1ec2a554be5179ecad65d8de9c26c3b8e46cb192c636ea19c226460aca7"],"about":{"@type":"SoftwareApplication","name":"63a9c58779aa2cdd08bbdfee0bb0212f.exe","applicationCategory":["peexe","executable"],"identifier":"0feca1ec2a554be5179ecad65d8de9c26c3b8e46cb192c636ea19c226460aca7","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":24,"total":26},"behavioralIndicators":{"malicious":9,"suspicious":13},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T447,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003044.00000000.108180.00409000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003044.00000000.108180.00409000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003044.00000000.108180.00409000.00000002.mdmp")28:T4fb,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "908016798_res.tmp") file/memory contains long string with (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "908016798_res.tmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00003044.00000000.108180.00401000.00000004.mdmp, 00000000-00003044.00000000.108180.00409000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00003044.00000000.108180.00401000.00000004.mdmp, 00000000-00003044.00000000.108180.00409000.00000002.mdmp")29:T525,Found reference to API "SendMessageA" (Indicator: "sendmessage"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "FindWindowA" (Indicator: "findwindow"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "EnumWindows" (Indicator: "enumwindows"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "PostMessageA" (Indicator: "postmessage"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") Found reference to API "ICSendMessage" (Indicator: "sendmessage"; File: "63a9c58779aa2cdd08bbdfee0bb0212f.exe") file/memory contains long string with (Indicator: "sendmessage"; File: "908016798_res.tmp") Found reference to API "SendMessageA" (Indicator: "sendmessage"; Source: "00000000-00003044.00000000.108180.00409000.00000002.mdmp") Found reference to API "FindWindowA" (Indicator: "findwindow"; Source: "00000000-00003044.00000000.108180.00409000.00000002.mdmp") Found reference to API "EnumWindows" (Indicator: "enumwindows"; Source: "00000000-00003044.00000000.108180.00409000.00000002.mdmp") Found reference to API "PostMessageA" (Indicator: "postmessage"; Source: "00000000-00003044.00000000.108180.00409000.00000002.mdmp") Found reference to API "ICSendMessage" (Indicator: "sendmessage"; Source: "00000000-00003044.00000000.108180.00409000.00000002.mdmp")2a:T9f6,"63a9c58779aa2cdd08bbdfee0bb0212f.exe" called "RtlGetVersion" with parameter 000000000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00003044) "userinit.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "userinit.exe" called "RtlGetVersion" with parameter 140100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "userinit.exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000330032005c00750073006500720069006e00690074002e00650078006500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ff2bfb7665054376d8eb0476ac01130000001300000000000000000024004800980100000000000000000000000000000000000025004300980100000000000000000000c06c130000000000200000000000000000000000 (UID: 00000000-00002952)2b:T466,"userinit.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "userinit.exe" called "GetVersionExA" with parameter 940000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002952) "userinit.exe" called "GetVersionExA" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000200000000000000d8eb0476a07f19000080fd7f9a5cfc7600b0fd7f883659014480fd7f00000000400000003f0000001d0000000080fd7f7c365901c15cfc76608203771d0000000080fd7f9a5cfc7600b0fd7fa03659015789fb76808303771317f074d8eb0476 (UID: 00000000-00002952)2c:T30c0,Observed string: "HARDWARE\DESCRIPTION\System\CentralProcessor\0" (Indicator: "hardware\description\system\centralprocessor") in Source: 63a9c58779aa2cdd08bbdfee0bb0212f.exe Observed string: "!This program cannot be run in DOS mode.Rich.text`.rdata@.data.rsrc@.reloct#Ht_^]2_^][SUV3_^][SVW3L$,VSUV3SSSSj RPV@j QR_^][GD]_[YSUVW_^]2k@Ph_^]2CE][SUVWj_^]3D$ |Vh` ^][Y.PQV^][Yt$ W_^]3T$(jL$0@jD$@hT$ R_^][LSUVWL$\_^][d|$43\$,PhL$4SQ\$,;D$4VPT$@RhT$$RD$@P\$0;L$$_SUVW_^][SUVW3QRhvidcL$XQt)WjL$,QT$0fPQPPT$ jD$4`Vhp4_^][t$$P_^][L$(jD$,PL$(QU_^][_^][D$ VL$$jD$(3_^][dJ@RPT$ SUVL$ _^]_^]3L$ QVD$ 3_^][QUWj[_]Y[_]Y_^][?\uK8\uCtJ<\u8T$$j_^][_^][_^][dL$ j_^[dSUVW_^][dI@QP?\uK8\uCtJ<\u8SUVW|$lj._^]2_^]2D$lRPj_^]2T$lhlD$lhhL$lhdD$lRPD$ TD$4DD$9V9]9c9l9v99":':D:I:7?B?N?a?q?w?70K0T0f02U3h33;4G44[5v5M6U6d7l7y78e8k8:-:s::3;R;< <$<(<3<|<>0>E>l>s>030;0S01+1Y13;3M3Z3b34S5t56L7P7T7X7\7`7d7h7l7p7t7x7|78=8m88Z9v99L:U:h:x::4;?;s;;(I>O>t>3W3c3k34"40484=4G4L4V4[4e4j4t4y45%545@5H5R56C7e7o738U8_8959?9<3%>/>0#1(1<11%2W2\23a3l34'4O45B5I5v56"6(6\6h6~67L7X7n78/868D8K88$9I996:H:S:_:;>$>;>R>>H?L?P?T?X?\?C0_0f021272A2Z2i23(3C3r3w34*4746/6E6k6s66,7E7d78E8K8T8d8u88(9<9C9^9c9|9:,:=:D:W:m:;=;L;S;X;];o;~;6>}>+0>0D0b0111~11J2f2r23 3%3+343;3@3J3O3Y3^3h3m3w3|34+40464?4F4K4U4Z4d4i4s4x44i5{55,6567<7n7:<;E;|;<=<[<|<>3>j>?d?h?l?p?t?7,8Y88#9B9H9i9:&;Z;=[=V>?>?F?m?*02090x00x1|12(282G2Q24$414E4[4455p56!6:6C6d67=7f7798E8g89H:U:h:q:x:A;;$<>C>Q>Y>u0|0223E3N3Z34D4U4c4x45#6X6\6`6d6h6s68 9)92990:j:o:=.=B=>Q>a>q>2%272_2e2q2333G3p34)4A45F5{5566<6A6I6Q6V6`6e6o6t6~68*8;8M8c89D9T9Z9;K;P;U;;7<<<>]>?"?'?-?4?=?D?0=0Q0i01#1)1?1E1O1V1\1n1u1}12+2C2333M3|36"6d6j6u673797F7L7T7Y7_7h7m7v7|78 8A8m89#9Y9_9:!;(;-;?;F;M;<6 >$>(>,>r>?(?P?Y?0G0w00+1d112!2'282S2h2o23o3~34=4T45"5(515<5A5m5s5}56L6y66A7H7N7w77L8R89':,:F:;9;R;s;<&=-=>(>B>?F?f?n?/0:0K0z0131:1?1f112$2P2v23m3|33#4g45&6?6i68(8/8:8L8X8g8n885:C:;$=X=g=282<2@2D2H2L2P2T2X2\2`2d2h2l25Y6}6v154.?3?|?&010C0I02?3!44b5h5n56$6*6Y6a6g6r67!7}7898\8|88=9Q9t9:%:*:H:M:i:;7;W;w;<7!>?>_>|>?9?\?y?0<0Y0|01)1L15 5$5(54585<5@5D5H5L5P5`5d5h5x55X6d6p6|6\3`3x4545@5\5h56$6,646T6t6x67 7<7H7d7p78 8<8H8d8p8909D9P9l9t9:,:4:@:\:d:p:;$;0;L;T;`;|;; <4<@<\ >(>X>l>x>? ?\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002148.00000000.139565.03070000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00003416]\n Process \"WerFault.exe\" [UID: 00000000-00003740]\n Process \"WerFault.exe\" [UID: 00000000-00003568]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"}]},{"level":"informative","category":"General","name":"An application crash occurred","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\"","origin":"Monitored Target","id":"target-2","sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 743A0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Progman\" (Program manager) in Source: 63a9c58779aa2cdd08bbdfee0bb0212f.exe\n \"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 63a9c58779aa2cdd08bbdfee0bb0212f.exe\n \"Progman\" (Program manager) in Source: 00000000-00002148.00000000.139565.00409000.00000002.mdmp\n 00000000-00002148.00000000.139565.03790000.00000002.mdmp\n \"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00002148.00000000.139565.00409000.00000002.mdmp\n 00000000-00002148.00000000.139565.03790000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modify auto-execute functionality","description":"Found string \"SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\\" (Indicator: \"software\\microsoft\\active setup\\installed components\"; in File: \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\")\n Found string \"Software\\Microsoft\\Active Setup\\Installed Components\\\" (Indicator: \"software\\microsoft\\active setup\\installed components\"; in File: \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\")\n Found string \"SOFTWARE\\Microsoft\\Active Setup\\Installed Components\\\" (Indicator: \"software\\microsoft\\active setup\\installed components\"; in Source: \"00000000-00002148.00000000.139565.00401000.00000004.mdmp, 00000000-00002148.00000000.139565.00409000.00000002.mdmp\")\n Found string \"Software\\Microsoft\\Active Setup\\Installed Components\\\" (Indicator: \"software\\microsoft\\active setup\\installed components\"; in Source: \"00000000-00002148.00000000.139565.00409000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1547","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"}]},{"level":"suspicious","category":"Network Related","name":"Attempts to call internet-related API for network communication","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"NtAlpcSendWaitReceivePort\" with parameters (UID: 00000000-00002148)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":2,"id":"api-291","sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to find a resource in a module","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"FindResourceA\" with parameter \"104\" - (UID: 00000000-00010488)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Calls an API typically used to load a resource in memory","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"LoadResource with parameter {'hModule': '0', 'hResInfo': '4231568'}\" (UID: 00000000-00010488)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00010488)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"CreateProcessA\" with parameter \"userinit.exe\" - (UID: 00000000-00010488)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\SysWOW64\\userinit.exe\" [Source: 00000000-00010488-00000BC0-1304385977]\n Observed system executable string:\"%WINDIR%\\SYSTEM32\\userinit.exe\" [Source: 00000000-00010488-00000BC0-1304388488]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called an API \"AdjustTokenPrivileges\" (UID: 00000000-00010488)","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSWOW64\\USERINIT.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to enumerate process encountered in a system snapshot","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"Process32FirstW with parameter [System Process]\" (UID: 00000000-00010488)\n \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"Process32NextW with parameter System\" (UID: 00000000-00010488)\n \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"Process32NextW with parameter Registry\" (UID: 00000000-00010488)\n \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"Process32NextW with parameter smss.exe\" (UID: 00000000-00010488)\n \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"Process32NextW with parameter csrss.exe\" (UID: 00000000-00010488)\n \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"Process32NextW with parameter wininit.exe\" (UID: 00000000-00010488)\n \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"Process32NextW with parameter winlogon.exe\" (UID: 00000000-00010488)","origin":"API Call","mitre_attack_id":"T1057","relevance":5,"id":"api-104","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"level":"malicious","category":"Anti-Detection/Stealthiness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" called \"CreateProcessA\" with parameter \"userinit.exe\" - (UID: 00000000-00010488)","origin":"API Call","mitre_attack_id":"T1055","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"level":"malicious","category":"Installation/Persistence","name":"Creates a thread in a remote process","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" creates a thread in process \"C:\\Windows\\SysWOW64\\userinit.exe\" (Handle: 620)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":8,"id":"api-18","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"level":"informative","category":"General","name":"Fails to load modules at runtime","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]\n \"userinit.exe\" failed to load missing module \"api-ms-win-core-fibers-l1-1-1\" - [base:0; Status:c0000135]\n \"userinit.exe\" failed to load missing module \"api-ms-win-core-localization-l1-2-1\" - [base:0; Status:c0000135]","origin":"API Call","mitre_attack_id":"T1574.002","relevance":1,"id":"api-22","sources":[{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"register-cimprovider.exe\" (Indicator: \"register-cimprovider.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"level":"malicious","category":"Installation/Persistence","name":"Allocates virtual memory in a remote process","description":"\"63a9c58779aa2cdd08bbdfee0bb0212f.exe\" allocated memory in \"C:\\63a9c58779aa2cdd08bbdfee0bb0212f.exe\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Possibly checks for the presence of a forensics/monitoring tool"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]}]},"activity":{"stats":{"process_count":4,"spawned_processes_count":4,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":12,"imported_dlls_count":101,"dropped_files_count":0,"extracted_files_count":4,"files_written_count":5,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["parite","gh0st","pcrat","rat","backdoor","fusing","farfli","windows-server-utility"],"sample_flags":["Network Traffic","Extracted Files","Sample Crashed"],"sandbox_reports":[{"id":"683159179043e7893800a2b5","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["KOR"],"submit_name":"63a9c58779aa2cdd08bbdfee0bb0212f.exe","analysis_start_time":"2025-05-24T05:28:55+00:00","indicators_count":{"informative":171,"suspicious":30,"malicious":10},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6831591171e7cc740f003cfe","environment_id":110,"environment_description":"Windows 7 32 bit (HWP Support)","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["KOR"],"submit_name":"63a9c58779aa2cdd08bbdfee0bb0212f.exe","analysis_start_time":"2025-05-24T05:28:50+00:00","indicators_count":{"informative":168,"suspicious":30,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"6831590cfedb7e8f6f0d248a","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["KOR"],"submit_name":"63a9c58779aa2cdd08bbdfee0bb0212f.exe","analysis_start_time":"2025-05-24T05:28:45+00:00","indicators_count":{"informative":167,"suspicious":30,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"68315906fcab49f0330b93a9","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["KOR"],"submit_name":"63a9c58779aa2cdd08bbdfee0bb0212f.exe","analysis_start_time":"2025-05-24T05:28:39+00:00","indicators_count":{"informative":157,"suspicious":29,"malicious":8},"tags":["Network Traffic","Extracted Files"],"is_in_unified_schema":true},{"id":"683159018e1a31b407048b34","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":80,"submit_name":"63a9c58779aa2cdd08bbdfee0bb0212f.exe","analysis_start_time":"2025-05-24T05:28:33+00:00","indicators_count":{"informative":129,"suspicious":17,"malicious":2},"tags":["Sample Crashed"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"175.194.143.205","port":8000,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"683159018e1a31b407048b34"}],"processes":[{"pid":2148,"ppid":0,"name":"63a9c58779aa2cdd08bbdfee0bb0212f.exe","command_line":"","sha256":"0feca1ec2a554be5179ecad65d8de9c26c3b8e46cb192c636ea19c226460aca7","normalized_path":"C:\\63a9c58779aa2cdd08bbdfee0bb0212f.exe","uid":"00000000-00002148","icon":"$40"},{"pid":3740,"ppid":2148,"name":"WerFault.exe","command_line":"-u -p 2148 -s 552","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002148","uid":"00000000-00003740"},{"pid":3568,"ppid":2148,"name":"WerFault.exe","command_line":"-u -p 2148 -s 552","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","parent_uid":"00000000-00002148","uid":"00000000-00003568"},{"pid":3416,"ppid":0,"name":"WerFault.exe","command_line":"-pss -s 440 -p 2148 -ip 2148","sha256":"98c1d80ffcc985b270dbae237d737e574c0085ffb1e60519814608bdb770d093","normalized_path":"%WINDIR%\\SysWOW64\\WerFault.exe","uid":"00000000-00003416","icon":"$41"}],"all_imported_dlls":["api-ms-win-downlevel-version-l1-1-0.dll","dnsapi.dll","crypt32.dll","uxtheme.dll","userenv.dll","imm32.dll","mswsock.dll","WSHTCPIP.DLL","propsys.dll","quartz.dll","fltLib.dll","lpk.dll","setupapi.dll","cfgmgr32.dll","NapiNSP.dll","avicap32.dll","normaliz.dll","usp10.dll","advapi32.dll","oleaut32.dll","version.dll","sfc_os.dll","msvcrt.dll","shell32.dll","908016813_lang.dll","nlaapi.dll","pnrpnsp.dll","clbcatq.dll","rpcrt4.dll","devobj.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","urlmon.dll","comctl32.dll","qcap.dll","msasn1.dll","gdi32.dll","msctf.dll","api-ms-win-core-synch-l1-2-0.dll","ws2_32.dll","msvfw32.dll","devenum.dll","ole32.dll","ntdll.dll","msacm32.dll","profapi.dll","rpcss.dll","shlwapi.dll","user32.dll","apphelp.dll","samcli.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","mpr.dll","wintrust.dll","VxSSL32.dll","nsi.dll","dwmapi.dll","KernelBase.dll","api-ms-win-downlevel-user32-l1-1-0.dll","Wldap32.dll","kernel32.dll","sspicli.dll","winmm.dll","sfc.dll","iertutil.dll","wininet.dll","winrnr.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","FWPUCLNT.DLL","rasadhlp.dll","AcGenral.dll","msvcp60.dll","psapi.dll","cryptbase.dll","msdmo.dll","sechost.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","ntmarta.dll","win32u.dll","gdi32full.dll","SHCore.dll","combase.dll","cryptsp.dll","powrprof.dll","wow64.dll","wow64win.dll","bcryptprimitives.dll","wow64cpu.dll","kernel.appcore.dll","msvcp_win.dll","ucrtbase.dll","windows.storage.dll","wow64con.dll","bcrypt.dll","wow64base.dll","908637828_lang.dll","IPHLPAPI.DLL","wshbth.dll","nlansp_c.dll","WinTypes.dll","908534253_lang.dll","908115562_lang.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"908016798_res.tmp","sha256":"e9a8aa59af51253e7ba25b092ef2b954d6fadf004be4f19f0d29ff0c25dc8ffd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"}]},{"name":"908637828_res.tmp","sha256":"e9a8aa59af51253e7ba25b092ef2b954d6fadf004be4f19f0d29ff0c25dc8ffd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"name":"908534238_res.tmp","sha256":"e9a8aa59af51253e7ba25b092ef2b954d6fadf004be4f19f0d29ff0c25dc8ffd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"}]},{"name":"908115531_res.tmp","sha256":"e9a8aa59af51253e7ba25b092ef2b954d6fadf004be4f19f0d29ff0c25dc8ffd","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]}],"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"path":"%TEMP%\\908016798_res.tmp","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"}]},{"path":"%TEMP%\\908637828_res.tmp","sources":[{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"}]},{"path":"%TEMP%\\908534238_res.tmp","sources":[{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"}]},{"path":"%TEMP%\\908115531_res.tmp","sources":[{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\26PV/6xsmA62IyihSnbh9mWtPmw7zc/mQzUqHuiG3WE=","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"DBWinMutex","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"26PV/6xsmA62IyihSnbh9mWtPmw7zc/mQzUqHuiG3WE=","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"68315906fcab49f0330b93a9"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\AMResourceMutex3","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-2092356043-4041700817-663127204-1001","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"}]},{"name":"AMResourceMutex3","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"{29D975B3-B256-45a0-A146-A36594F825F7}","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{29D975B3-B256-45a0-A146-A36594F825F7}","sources":[{"report_type":"sandbox","report_id":"6831590cfedb7e8f6f0d248a"},{"report_type":"sandbox","report_id":"6831591171e7cc740f003cfe"},{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]},{"name":"eed3bd3a-a1ad-4e99-987b-d7cb3fcfa7f0 - S-1-5-21-686412048-2446563785-1323799475-1001","sources":[{"report_type":"sandbox","report_id":"683159179043e7893800a2b5"}]}]}},"report_ids":{"sandbox_job_ids":["68315906fcab49f0330b93a9","683159179043e7893800a2b5","6831591171e7cc740f003cfe","6831590cfedb7e8f6f0d248a","683159018e1a31b407048b34"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 0feca1ec2a55… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 0feca1ec2a55…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/0feca1ec2a554be5179ecad65d8de9c26c3b8e46cb192c636ea19c226460aca7"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 0feca1ec2a55… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 0feca1ec2a55…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/0feca1ec2a554be5179ecad65d8de9c26c3b8e46cb192c636ea19c226460aca7"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 0feca1ec2a55… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 0feca1ec2a55…. Malware family: Trojan.Generic. Threat score 100/100. 24/26 AV engines flagged this file. 9 malicious and 13 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L42","11",{}]]