26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Strictor.Generic Sample 1a42950011ef… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1a42950011ef…. Malware family: Strictor.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f","keywords":["Malicious","Strictor.Generic","malware analysis","sandbox report","threat intelligence","1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f"],"about":{"@type":"SoftwareApplication","name":"bounty-19308062957755894","applicationCategory":["peexe","assembly","executable"],"identifier":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Strictor.Generic","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":9,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:Taab,".exe" touched "Computer" (Path: "HKCU\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\SHELLFOLDER") ".exe" touched "Network" (Path: "HKCU\CLSID\{208D2C60-3AEA-1069-A2D7-08002B30309D}\SHELLFOLDER") ".exe" touched "Recycle Bin" (Path: "HKCU\CLSID\{645FF040-5081-101B-9F08-00AA002F954E}\SHELLFOLDER") ".exe" touched "Control Panel" (Path: "HKCU\CLSID\{26EE0668-A00A-44D7-9371-BEB064C98683}\SHELLFOLDER") ".exe" touched "UsersFiles" (Path: "HKCU\CLSID\{59031A47-3F72-44A7-89C5-5595FE6B30EE}\SHELLFOLDER") ".exe" touched "UsersLibraries" (Path: "HKCU\CLSID\{031E4825-7B94-4DC3-B131-E946B44C8DD5}\SHELLFOLDER") ".exe" touched "CLSID_SearchFolder" (Path: "HKCU\CLSID\{04731B67-D933-450A-90E6-4ACD2E9408FE}\SHELLFOLDER") ".exe" touched "Microsoft OneNote Namespace Extension for Windows Desktop Search" (Path: "HKCU\CLSID\{0875DCB6-C686-4243-9432-ADCCF0B9F2D7}\SHELLFOLDER") ".exe" touched "IE History and Feeds Shell Data Source for Windows Search" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{11016101-E366-4D22-BC06-4ADA335C892B}\SHELLFOLDER") ".exe" touched "@C:\Program Files (x86)\Microsoft Office\Office15\MAPISHELL.DLL,-110" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{138508BC-1E03-49EA-9C8F-EA9E1D05D65D}\SHELLFOLDER") ".exe" touched "Public Folder" (Path: "HKCU\CLSID\{4336A54D-038B-4685-AB02-99BB52D3FB8B}\SHELLFOLDER") ".exe" touched "Control Panel command object for Start menu and desktop" (Path: "HKCU\CLSID\{5399E694-6CE5-4D6C-8FCE-1D8870FDCBA0}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-110" (Path: "HKCU\CLSID\{89D83576-6BD1-4C86-9454-BEB04E94C819}\SHELLFOLDER") ".exe" touched "DXP" (Path: "HKCU\CLSID\{8FD8B88D-30E1-4F25-AC2B-553D3D65F0EA}\SHELLFOLDER") ".exe" touched "CLSID_SearchHome" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{9343812E-1C37-4A49-A12E-4B2D810D956B}\SHELLFOLDER") ".exe" touched "Windows Search Service Media Center Namespace Extension Handler" (Path: "HKCU\CLSID\{98D99750-0B8A-4C59-9151-589053683D73}\SHELLFOLDER") ".exe" touched "Other Users Folder" (Path: "HKCU\CLSID\{B4FB3F98-C1EA-428D-A78A-D1F5659CBA93}\SHELLFOLDER") ".exe" touched "@%systemroot%\system32\mssvp.dll,-112" (Path: "HKCU\CLSID\{BD7A2E7B-21CB-41B2-A086-B309680C6B7E}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuProviderFolder" (Path: "HKCU\CLSID\{DAF95313-E44D-46AF-BE1B-CBACEA2C3065}\SHELLFOLDER") ".exe" touched "CLSID_StartMenuPathCompleteProviderFolder" (Path: "HKCU\CLSID\{E345F35F-9397-435C-8F95-4E922C26259E}\SHELLFOLDER")28:T8e9,"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al," "Snmqo.exe" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"29:T715,".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" ".exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" ".exe" touched file "C:\Windows\Microsoft.Net\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll.config" ".exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches" ".exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\X5G1C45VRY112VBAAXQ2.temp" "powershell.exe" touched file "C:\Users\%OSUSER%\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "powershell.exe" touched file "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe.config" "powershell.exe" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\config\security.config"2a:T60c,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-quirks-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Windows\system32\combase.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.dll" ".exe" trying to access non-existent file "C:\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe.config"2b:T7d2,".exe" wrote bytes "2e00fe0900002819" to virtual address "0x045D0C5C" ".exe" wrote bytes "267e2e00000414fe" to virtual address "0x045D189C" ".exe" wrote bytes "13300400f0000000060000112003000000fe0e01" to virtual address "0x045D1B14" ".exe" wrote bytes "4a38010000002a02037d3400000438f3ffffff00" to virtual address "0x045D1D94" ".exe" wrote bytes "1330030058000000070000112001000000fe0e00" to virtual address "0x045D1C10" ".exe" wrote bytes "1e027b340000042a" to virtual address "0x045D1D8C" ".exe" wrote bytes "13300500b3080000020000112013000000fe0e03" to virtual address "0x045D0388" ".exe" wrote bytes "13300500b8000000080000112002000000fe0e01" to virtual address "0x045D1C88" ".exe" wrote bytes "133003004d000000010000117ed6080004286218" to virtual address "0x045D0304" ".exe" wrote bytes "1a7e230000042a00" to virtual address "0x045D1384" ".exe" wrote bytes "1a7e050000042a00" to virtual address "0x045D0380" ".exe" wrote bytes "db4dab6c00000000" to virtual address "0x00A02000" (part of module "1A42950011EFA48EFAD99C53904D84F0D89EE37077EDCE320F9781A68CFA9C4F.EXE") ".exe" wrote bytes "1b3006003602000003000011382b020000fe0c06" to virtual address "0x045D0C7C" ".exe" wrote bytes "1a7e070000042a00" to virtual address "0x045D0EFC" ".exe" wrote bytes "3602037d33000004" to virtual address "0x045D1D7C" ".exe" wrote bytes "267e2300000414fe" to virtual address "0x045D1378" ".exe" wrote bytes "133006008b00000004000011007e130900042856" to virtual address "0x045D1978" ".exe" wrote bytes "133003004e000000010000117ed6080004286218" to virtual address "0x045D1AB8" ".exe" wrote bytes "267e0500000414fe" to virtual address "0x045D0374" ".exe" wrote bytes "1a7e060000042a00" to virtual address "0x045D0C74"2c:T587,".exe" wrote 32 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 924) ".exe" wrote 52 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 924) ".exe" wrote 4 bytes to a remote process "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" (Handle: 924) ".exe" wrote 52 bytes to a remote process "C:\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe" (Handle: 556) ".exe" wrote 4 bytes to a remote process "C:\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe" (Handle: 556) ".exe" wrote 4096 bytes to a remote process "C:\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe" (Handle: 556) ".exe" wrote 24576 bytes to a remote process "C:\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe" (Handle: 556) ".exe" wrote 12288 bytes to a remote process "C:\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe" (Handle: 556) ".exe" wrote 32 bytes to a remote process "C:\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe" (Handle: 556) ".exe" wrote 81920 bytes to a remote process "C:\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe" (Handle: 556)2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAAAAAAAAAAAAAAAAAAAAAAAeIiIiIiId3d3d3d3gAAAAIiIiIiIiIiIiIiIh4AAAACP/////////////4eAAAAAj/////////////+HgAAAAI+IiIiIiIiIiIiIh4AAAACP//////////////eAAAAAj/iIiIiIiIiIiIj3gAAAAI//////////////94AAAACP//iIiIiIiIiIiPeAAAAAj//////////////3gAAAAI//+IiIiIiIiIiI94AAAAD///////////////eAAAAA////iIiIiIiIiI/3gHd3dmZmZkb/////////94B///+IiIh2iIiIiIiIj/eAf/j/+I//dv/////////3gH+Hf3Zv/3b4iI+IiIj/94B/iHeGZ/93////iIiI//fwf4h4d4aPh//4j4iIiP/38H+IeHeHj4f///+P+Ij/9/CPiIh3h2+H////j/iI//fwj4iPd/d3h////4//+P/38I+IiIf3h4f///+Ij///9/CPiIiI+IiH//////////fwj///////h///////h3d28I/////4iIf////////4eHCIiIh3d3d3////////+IcAAAAA/////////////4hwAAAAAP////////////iHAAAAAACIiIiIiIiIiIiIcAAAAAAAAAAAAAAAAAAAAAAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAP4AAAD+AAAA/gAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAAgAAAAIAAAACAAAAB/gAAA/4AAAf+AAAP/////w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790455951498,"unified_at":"2026-09-26T20:52:31.498Z","metadata":{"hashes":{"sha256":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f","sha1":"b20382c8f2337277c3467b07f395cda96827f497","md5":"ecaf214bde2e9e856ff914ff601323eb","sha512":"fe6de7336f518c0826b2fcf2769a2639c57a3efd43f8d7a1b572229ebe234cb21199e7c973b301c47d48715926c46db0a8d3197fe680e5fd67295aae907efcac","ssdeep":"24576:TLz3VowLzh0xOxua+8uTUcQTWTbh9/+rHZ8zZQ6gqtQkBMATHXUelVE6:jVzl453DXQTZre9QRqtNRX7","ssdeep_chunks":["24576:TLz3Vow","24576:Lz3VowL","24576:z3VowLz","24576:3VowLzh","24576:VowLzh0","24576:owLzh0x","24576:wLzh0xO","24576:Lzh0xOx","24576:zh0xOxu","24576:h0xOxua","24576:0xOxua+","24576:xOxua+8","24576:Oxua+8u","24576:xua+8uT","24576:ua+8uTU","24576:a+8uTUc","24576:+8uTUcQ","24576:8uTUcQT","24576:uTUcQTW","24576:TUcQTWT","24576:UcQTWTb","24576:cQTWTbh","24576:QTWTbh9","24576:TWTbh9/","24576:WTbh9/+","24576:Tbh9/+r","24576:bh9/+rH","24576:h9/+rHZ","24576:9/+rHZ8","24576:/+rHZ8z","24576:+rHZ8zZ","24576:rHZ8zZQ","24576:HZ8zZQ6","24576:Z8zZQ6g","24576:8zZQ6gq","24576:zZQ6gqt","24576:ZQ6gqtQ","24576:Q6gqtQk","24576:6gqtQkB","24576:gqtQkBM","24576:qtQkBMA","24576:tQkBMAT","24576:QkBMATH","24576:kBMATHX","24576:BMATHXU","24576:MATHXUe","24576:ATHXUel","24576:THXUelV","24576:HXUelVE","24576:XUelVE6","49152:TLz3Vow","49152:Lz3VowL","49152:z3VowLz","49152:3VowLzh","49152:VowLzh0","49152:owLzh0x","49152:wLzh0xO","49152:Lzh0xOx","49152:zh0xOxu","49152:h0xOxua","49152:0xOxua+","49152:xOxua+8","49152:Oxua+8u","49152:xua+8uT","49152:ua+8uTU","49152:a+8uTUc","49152:+8uTUcQ","49152:8uTUcQT","49152:uTUcQTW","49152:TUcQTWT","49152:UcQTWTb","49152:cQTWTbh","49152:QTWTbh9","49152:TWTbh9/","49152:WTbh9/+","49152:Tbh9/+r","49152:bh9/+rH","49152:h9/+rHZ","49152:9/+rHZ8","49152:/+rHZ8z","49152:+rHZ8zZ","49152:rHZ8zZQ","49152:HZ8zZQ6","49152:Z8zZQ6g","49152:8zZQ6gq","49152:zZQ6gqt","49152:ZQ6gqtQ","49152:Q6gqtQk","49152:6gqtQkB","49152:gqtQkBM","49152:qtQkBMA","49152:tQkBMAT","49152:QkBMATH","49152:kBMATHX","49152:BMATHXU","49152:MATHXUe","49152:ATHXUel","49152:THXUelV","49152:HXUelVE","49152:XUelVE6","24576:jVzl453","24576:Vzl453D","24576:zl453DX","24576:l453DXQ","24576:453DXQT","24576:53DXQTZ","24576:3DXQTZr","24576:DXQTZre","24576:XQTZre9","24576:QTZre9Q","24576:TZre9QR","24576:Zre9QRq","24576:re9QRqt","24576:e9QRqtN","24576:9QRqtNR","24576:QRqtNRX","24576:RqtNRX7"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-19308062957755894","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":1248768,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1675448991000,"last_seen":1675452534000,"last_multi_scan":1675452534000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","credentialharvesting","criminal","remcos","suspicious"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":25},"sandbox_signatures":{"informative_count":42,"suspicious_count":15,"malicious_count":9,"total":66},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.MSIL.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Strictor.269948","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Strictor.269948 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/TrojanDownloader.Agent.OQX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan-Downloader ( 0059e7cb1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan-PSW.MSIL.Agensla.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Strictor.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Execution","technique":"PowerShell","attack_id":"T1059.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/001","identifiers":[{"type":"suspicious","value":"Executes powershell with commandline"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"},{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode string content at runtime"},{"type":"informative","value":"Contains ability to load content into memory"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Uses powershell with an encoded commandline"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads the windows installation date"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to open an existing named mutex object"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Discovery","technique":"Software Discovery","attack_id":"T1518","attack_id_wiki":"https://attack.mitre.org/techniques/T1518","identifiers":[{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function memorystream in 1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.bin\n Observed function memorystream in Snmqo.exe","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function replace in 1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.bin\n Observed function replace in Snmqo.exe","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00003328)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003328)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003328)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003328)\n \".exe\" called \"RtlGetVersion\" (UID: 00000000-00003328)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to open an existing named mutex object","description":"\"powershell.exe\" called \"OpenMutexW\" with parameter \"Global\\CLR_CASOFF_MUTEX\" - (UID: 00000000-00002260)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-144","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe\" at 00000000-00003328-0000010C-685841\n \".exe\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\System.Data\\v4.0_4.0.0.0__b77a5c561934e089\\System.Data.dll\" at 00000000-00003328-0000010C-2988818","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"APPENDPATH\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\POWERSHELL.EXE\"; Key: \"PATH\")","origin":"Registry Access","mitre_attack_id":"T1518","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the windows installation date","description":"\"powershell.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"INSTALLDATE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-13","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\".exe\" called \"CopyFileW\" (UID: 00000000-00003328)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Wbnjnlwiifu (UID: 00000000-00003328)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations (UID: 00000000-00002260)\n \"powershell.exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00002260)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==\" - (UID: 00000000-00003328)\n \".exe\" called \"CreateProcessA\" with parameter \"C:\\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe\" - (UID: 00000000-00003328)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"91.231.84.41:52651\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"_SHuassist.mtx\"\n \"\\Sessions\\1\\BaseNamedObjects\\Remcos-SURYWD\"\n \"Remcos-SURYWD\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"DelegateExecute\" (Indicator: \"DelegateExecute\")\n \"ThemeApiConnectionRequest\" (Indicator: \"ThemeApiConnectionRequest\")","origin":"File/Memory","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 66E90000\n \"powershell.exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v2.0.50727_32\\mscorlib\\9f895c66454577eff9c77442d0c84f71\\mscorlib.ni.dll\" at 63580000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$27","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.bin\" has an executable section named \".text\"\n \"Snmqo.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$28","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x12e600\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x12e550\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" [Source: 00000000-00003328-00000C0C-7780418169]\n Observed system executable string:\"\"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==\" [Source: 00000000-00003328-00000C0C-7780418169]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"powershell.exe\" (UID: 00000000-00002260) was launched with modified environment variables: \"Path\"\n Process \".exe\" (UID: 00000000-00001876) was launched with modified environment variables: \"Path\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgA ...\" (UID: 00000000-00002260)\n Spawned process \".exe\" (UID: 00000000-00001876)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgA ...\" (UID: 00000000-00002260)\n Spawned process \".exe\" (UID: 00000000-00001876)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"Snmqo.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\Wbnjnlwiifu\\Snmqo.exe]- [targetUID: 00000000-00003328]\n \"X5G1C45VRY112VBAAXQ2.temp\" has type \"data\"- Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\X5G1C45VRY112VBAAXQ2.temp]- [targetUID: 00000000-00002260]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"$29","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$2a","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ICP-i,j.MG\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003328)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileW\" (UID: 00000000-00003328)\n \".exe\" called \"FindNextFileW\" (UID: 00000000-00003328)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"System Destruction","name":"Opens file with deletion access rights","description":"\"powershell.exe\" opened \"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\X5G1C45VRY112VBAAXQ2.temp\" with delete access\n \"powershell.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\SECURITY.CONFIG.CCH.2260.907500171\" with delete access\n \"powershell.exe\" opened \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\CONFIG\\ENTERPRISESEC.CONFIG.CCH.2260.907500171\" with delete access\n \"powershell.exe\" opened \"%APPDATA%\\Microsoft\\CLR SECURITY CONFIG\\V2.0.50727.312\\SECURITY.CONFIG.CCH.2260.907500171\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to decompress content at runtime","description":"Observed function system.io.compression.gzipstream in 1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.bin\n Observed function system.io.compression.gzipstream in Snmqo.exe","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"Snmqo.exe\" - Location: [%APPDATA%\\Wbnjnlwiifu\\Snmqo.exe]- [targetUID: 00000000-00003328]\n Dropped file: \"X5G1C45VRY112VBAAXQ2.temp\" - Location: [%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\X5G1C45VRY112VBAAXQ2.temp]- [targetUID: 00000000-00002260]","origin":"Binary File","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"\n \"Snmqo.exe\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"powershell.exe\" (Path: \"HKCU\\CONTROL PANEL\\INTERNATIONAL\"; Key: \"SYEARMONTH\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00000000-00003328-00000105-3351499\n \".exe\" queried SystemProcessInformation at 00000000-00003328-00000105-4359629","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights\n \"powershell.exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".text\n .text with unusual entropies 7.99857491534\n 7.99857491534","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Uses powershell with an encoded commandline","description":"Process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==\" (UID: 00000000-00002260)","origin":"Monitored Target","mitre_attack_id":"T1027","relevance":10,"id":"target-28","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"33/70 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"General","name":"Executes powershell with commandline","description":"Process \"powershell.exe\" with commandline \"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==\" (UID: 00000000-00002260)","origin":"Monitored Target","mitre_attack_id":"T1059.001","relevance":5,"id":"target-110","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\desktop.ini\"\n \"powershell.exe\" read file \"%APPDATA%\\Microsoft\\Windows\\Start Menu\\Programs\\desktop.ini\"\n \"powershell.exe\" read file \"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"Snmqo.exe\" has type \"PE32 executable (GUI) Intel 80386 Mono/.Net assembly for MS Windows\"- Location: [%APPDATA%\\Wbnjnlwiifu\\Snmqo.exe]- [targetUID: 00000000-00003328]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"SNMQO\"; Value: \"\"%APPDATA%\\Wbnjnlwiifu\\Snmqo.exe\"\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"1.0.0.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00003328)\n \"powershell.exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00002260)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\".exe\" called \"CreateProcessA\" with parameter \"C:\\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe\" - (UID: 00000000-00003328)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"33/70 Antivirus vendors marked sample as malicious (47% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"33/70 Antivirus vendors marked dropped file \"Snmqo.exe\" as malicious (classified as \"Gen:Variant.Strictor\" with 47% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"33/70 Antivirus vendors marked spawned process \".exe\" (PID: 1876) as malicious (classified as \"Gen:Variant.Strictor\" with 47% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\".exe\" set thread context in remote process \"C:\\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe\" (PID: 00000754)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"$2c","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 91.231.84.41 on port 52651","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]}],"incidents":[{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries process information"},{"detail":"Queries sensitive IE security settings"},{"detail":"Queries the display settings of system associated file extensions"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":7,"imported_dlls_count":111,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":6,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","credentialharvesting","criminal","remcos","suspicious"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"63dd5e606b2d967dd1246db4","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.Strictor","contacted_countries":["UKR"],"submit_name":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe","analysis_start_time":"2023-02-03T19:20:01+00:00","indicators_count":{"informative":42,"suspicious":21,"malicious":9},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"91.231.84.41","port":52651,"protocol":"TCP","country":"Ukraine","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}],"processes":[{"pid":3328,"ppid":0,"name":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe","command_line":"","sha256":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f","normalized_path":"C:\\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe","uid":"00000000-00003328","icon":"$2d"},{"pid":2260,"ppid":3328,"name":"powershell.exe","command_line":"-ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==","sha256":"6c05e11399b7e3c8ed31bae72014cf249c144a8f4a2c54a758eb2e6fad47aec7","normalized_path":"%WINDIR%\\System32\\WindowsPowerShell\\v1.0\\powershell.exe","parent_uid":"00000000-00003328","uid":"00000000-00002260"},{"pid":1876,"ppid":3328,"name":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe","command_line":"","sha256":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f","normalized_path":"C:\\1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f.exe","parent_uid":"00000000-00003328","uid":"00000000-00001876"}],"all_imported_dlls":["System.Core.ni.dll","cfgmgr32.dll","usp10.dll","ieframe.dll","ntshrui.dll","msctf.dll","mscorlib.ni.dll","cscapi.dll","System.Configuration.Install.ni.dll","wininet.dll","lpk.dll","shlwapi.dll","mscoreei.dll","cryptbase.dll","api-ms-win-core-xstate-l2-1-0.dll","nlssorting.dll","psapi.dll","clr.dll","vcruntime140_clr0400.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","ole32.dll","uxtheme.dll","Microsoft.PowerShell.ConsoleHost.ni.dll","System.Transactions.ni.dll","msasn1.dll","sspicli.dll","clbcatq.dll","normaliz.dll","System.ni.dll","atl.dll","slc.dll","Microsoft.PowerShell.Commands.Utility.ni.dll","mscorwks.dll","Microsoft.PowerShell.Security.ni.dll","mscorrc.dll","System.DirectoryServices.ni.dll","shfolder.dll","tzres.dll","netutils.dll","WSHTCPIP.DLL","mscoree.dll","api-ms-win-downlevel-user32-l1-1-0.dll","Wldap32.dll","urlmon.dll","System.Xml.ni.dll","dnsapi.dll","winrnr.dll","KernelBase.dll","shell32.dll","imm32.dll","ucrtbase_clr0400.dll","secur32.dll","api-ms-win-core-synch-l1-2-0.dll","devobj.dll","rsaenh.dll","pnrpnsp.dll","rasadhlp.dll","ntdll.dll","System.Data.ni.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","setupapi.dll","comctl32.dll","Microsoft.PowerShell.Commands.Diagnostics.ni.dll","nlaapi.dll","NapiNSP.dll","userenv.dll","user32.dll","clrjit.dll","System.Numerics.ni.dll","propsys.dll","ntmarta.dll","System.Transactions.dll","FWPUCLNT.DLL","System.Data.dll","profapi.dll","shdocvw.dll","cryptsp.dll","msvcr80.dll","advapi32.dll","rpcss.dll","crypt32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","apphelp.dll","linkinfo.dll","Microsoft.WSMan.Management.ni.dll","Microsoft.PowerShell.Commands.Management.ni.dll","fltLib.dll","kernel32.dll","gdi32.dll","System.Management.Automation.ni.dll","System.Management.Automation.dll","System.Management.ni.dll","msvcp60.dll","winmm.dll","System.Runtime.Serialization.ni.dll","version.dll","msvcrt.dll","sechost.dll","rpcrt4.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","iertutil.dll","Microsoft.WSMan.Runtime.dll","api-ms-win-downlevel-shell32-l1-1-0.dll","oleaut32.dll","srvcli.dll","mscorjit.dll","GdiPlus.dll","mswsock.dll","ws2_32.dll","nsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"Snmqo.exe","sha256":"1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"X5G1C45VRY112VBAAXQ2.temp","sha256":"b149003b272d70d20fb691581d2e649bfe7e9b4430c6974331b31188ee31d029","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\X5G1C45VRY112VBAAXQ2.temp","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"path":"%APPDATA%\\Wbnjnlwiifu\\Snmqo.exe","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\REMCOS-SURYWD\\\\","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"_SHuassist.mtx","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Remcos-SURYWD","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]},{"name":"Remcos-SURYWD","sources":[{"report_type":"sandbox","report_id":"63dd5e606b2d967dd1246db4"}]}]}},"report_ids":{"sandbox_job_ids":["63dd5e606b2d967dd1246db4"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Strictor.Generic Sample 1a42950011ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1a42950011ef…. Malware family: Strictor.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f"}],["$","meta","4",{"property":"og:title","content":"Malicious Strictor.Generic Sample 1a42950011ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1a42950011ef…. Malware family: Strictor.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1a42950011efa48efad99c53904d84f0d89ee37077edce320f9781a68cfa9c4f"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Strictor.Generic Sample 1a42950011ef… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1a42950011ef…. Malware family: Strictor.Generic. Threat score 100/100. 8/28 AV engines flagged this file. 9 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]