24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 27:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T41f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample 1ea818b42112… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 1ea818b42112…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2"],"about":{"@type":"SoftwareApplication","name":"morbery.exe","applicationCategory":["peexe","executable"],"identifier":"1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":0},"behavioralIndicators":{"malicious":6,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T8e1,"" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\TeamViewer\mosbesy.exe" (Handle: 264) "" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\TeamViewer\mosbesy.exe" (Handle: 264) "" wrote 4 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\TeamViewer\mosbesy.exe" (Handle: 264) "" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Roaming\TeamViewer\mosbesy.exe" (Handle: 264) "mosbesy.exe" wrote 32 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 52 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 4 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 8 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 544 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 72 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 1024 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 133120 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 21504 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 4096 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 1536 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 21 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 16 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 48 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 9 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 15 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 6 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224) "mosbesy.exe" wrote 5 bytes to a remote process "C:\Windows\System32\svchost.exe" (Handle: 224)26:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790314778914,"unified_at":"2026-09-25T05:39:38.914Z","metadata":{"hashes":{"sha256":"1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2","sha1":"6dd890c85cd6bff326107bfea82d8e5274463cfd","md5":"4598fe6c73be9f241006dfb35a76704a","sha512":"df38c1f7c5e83446397b1403b0b60316ab30333365dab325e0aecaac319a038de7608df4d6bb9638e736dc70b95b77a7f305eb88af82b5e3d41dbc9a0c77029f","ssdeep":"6144:GJQVhr/vnh+hDvlmSSaXq7CWE2z9JK7Uc1va:iwhzPh+HmSJXqGWE2q","ssdeep_chunks":["6144:GJQVhr/","6144:JQVhr/v","6144:QVhr/vn","6144:Vhr/vnh","6144:hr/vnh+","6144:r/vnh+h","6144:/vnh+hD","6144:vnh+hDv","6144:nh+hDvl","6144:h+hDvlm","6144:+hDvlmS","6144:hDvlmSS","6144:DvlmSSa","6144:vlmSSaX","6144:lmSSaXq","6144:mSSaXq7","6144:SSaXq7C","6144:SaXq7CW","6144:aXq7CWE","6144:Xq7CWE2","6144:q7CWE2z","6144:7CWE2z9","6144:CWE2z9J","6144:WE2z9JK","6144:E2z9JK7","6144:2z9JK7U","6144:z9JK7Uc","6144:9JK7Uc1","6144:JK7Uc1v","6144:K7Uc1va","12288:GJQVhr/","12288:JQVhr/v","12288:QVhr/vn","12288:Vhr/vnh","12288:hr/vnh+","12288:r/vnh+h","12288:/vnh+hD","12288:vnh+hDv","12288:nh+hDvl","12288:h+hDvlm","12288:+hDvlmS","12288:hDvlmSS","12288:DvlmSSa","12288:vlmSSaX","12288:lmSSaXq","12288:mSSaXq7","12288:SSaXq7C","12288:SaXq7CW","12288:aXq7CWE","12288:Xq7CWE2","12288:q7CWE2z","12288:7CWE2z9","12288:CWE2z9J","12288:WE2z9JK","12288:E2z9JK7","12288:2z9JK7U","12288:z9JK7Uc","12288:9JK7Uc1","12288:JK7Uc1v","12288:K7Uc1va","6144:iwhzPh+","6144:whzPh+H","6144:hzPh+Hm","6144:zPh+HmS","6144:Ph+HmSJ","6144:h+HmSJX","6144:+HmSJXq","6144:HmSJXqG","6144:mSJXqGW","6144:SJXqGWE","6144:JXqGWE2","6144:XqGWE2q"],"imphash":"6a21db7ad2d46dc3ebc96ad6fa27385a"},"file_info":{"file_name":"morbery.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":348160,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1521722519000,"last_seen":1739253743000,"last_multi_scan":1739253743000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":0},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":0},"sandbox_signatures":{"informative_count":12,"suspicious_count":9,"malicious_count":6,"total":27},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{}},"rule_matches":{},"attributions":{},"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"GetVersion@KERNEL32.dll at 5497-1-00412610","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\"svchost.exe\" queries volume information of \"C:\\\" at 00014209-00003752-00000046-52157238","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information of an entire harddrive","description":"\"svchost.exe\" queries volume information of \"C:\\\" at 00014209-00003752-00000046-52157238","origin":"API Call","relevance":8,"id":"api-39","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"svchost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"2.20.189.74:80\"\n \"2.20.189.19:80\"\n \"52.138.216.83:52654\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\B9B5A32C8CB0128\"\n \"B9B5A32C8CB0128\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"mosbesy.exe\" (UID: 00013117-00002580)\n Spawned process \"svchost.exe\" with commandline \"-k netsvcs\" (UID: 00014209-00003752)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"\"\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui\"\n \"\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"\" touched file \"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui\"\n \"\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \"mosbesy.exe\" touched file \"%WINDIR%\\Fonts\\StaticCache.dat\"\n \"mosbesy.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"mosbesy.exe\" touched file \"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui\"\n \"svchost.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2003/05/soap-envelope\"\n Pattern match: \"http://www.microsoft.com\"\n Pattern match: \"www.microsoft.com\"\n Pattern match: \"https://validation.sls.microsoft.com/SLWGA/WatAdminTemplate.dll\"\n Pattern match: \"www.microsoft.com/pkiops/crl/MicSecSerCA2011_2011-10-18.crl0\"\n Pattern match: \"www.microsoft.com/pkiops/certs/MicSecSerCA2011_2011-10-18.crt0\"\n Pattern match: \"crl.microsoft.com/pki/crl/products/MicRooCerAut2011_\"\n Pattern match: \"www.microsoft.com/pki/certs/MicRooCerAut2011_2011_03_22.crt0\"\n Pattern match: \"https://validation.sls.microsoft.com/SLWGA/slwga.asmx\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"\n \"mosbesy.exe\" opened \"\\Device\\KsecDD\"\n \"svchost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Creates new processes","description":"\"\" is creating a new process (Name: \"%APPDATA%\\TeamViewer\\mosbesy.exe\", Handle: 264)\n \"mosbesy.exe\" is creating a new process (Name: \"\\REGISTRY\\USER\\S-1-5-21-686412048-2446563785-1323799475-1001\\Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\", Handle: 224)","origin":"API Call","relevance":8,"id":"api-2","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Loads the task scheduler COM API","description":"\"svchost.exe\" loaded module \"%WINDIR%\\System32\\taskschd.dll\" at FA9B0000","origin":"Loaded Module","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"POST /6b06490d-f9fd-424c-8b6d-83edc4369e89/ HTTP/1.1Cache-Control: no-cacheConnection: ClosePragma: no-cacheContent-Type: application/soap+xmlUser-Agent: WSDAPIContent-Length: 733Host: 192.168.56.152:5357\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \"mosbesy.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetVersionExA\n GetModuleFileNameA\n LoadLibraryA\n UnhandledExceptionFilter\n GetCommandLineA\n GetProcAddress\n MapViewOfFile\n GetModuleHandleA\n WriteFile\n GetStartupInfoA\n TerminateProcess\n VirtualAlloc\n SleepEx","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"\" wrote bytes \"711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02\" to virtual address \"0x754707E4\" (part of module \"USER32.DLL\")\n \"mosbesy.exe\" wrote bytes \"711122027a3b2102ab8b02007f950200fc8c0200729602006cc805001ecd1e027d261e02\" to virtual address \"0x754707E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"mosbesy.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\"\" created file \"%APPDATA%\\TeamViewer\\mosbesy.exe:Zone.Identifier\"","origin":"API Call","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"17/66 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"17/66 Antivirus vendors marked sample as malicious (25% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"17/66 Antivirus vendors marked spawned process \"mosbesy.exe\" (PID: 2580) as malicious (classified as \"ML.Attribute\" with 25% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$25","origin":"API Call","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 52.138.216.83 on port 52654","origin":"Network Traffic","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"\" searching for class \"Shell_TrayWnd\"\n \"mosbesy.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"\n \"mosbesy.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method)","origin":"File/Memory","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Scans for the windows taskbar (may be used for explorer injection)","description":"\"\" searching for class \"Shell_TrayWnd\"\n \"mosbesy.exe\" searching for class \"Shell_TrayWnd\"","origin":"API Call","relevance":10,"id":"api-17","sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]}],"incidents":[{"name":"Remote Access","details_count":2,"details":[{"detail":"Uses network protocols on unusual ports"},{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":3,"imported_dlls_count":44,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":14,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":3,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Sample not shared"],"sandbox_reports":[{"id":"5ab3b0327ca3e132ce73dd17","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"ML.Attribute","contacted_countries":["EU","USA"],"submit_name":"morbery.exe","analysis_start_time":"2018-03-22T14:39:12+00:00","indicators_count":{"informative":10,"suspicious":8,"malicious":8},"tags":["Multi-Process","Network Traffic","Sample not shared"],"is_in_unified_schema":true},{"id":"5ab3a3397ca3e111e34ba047","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"FileRepMalware","submit_name":"morbery.exe","analysis_start_time":"2018-03-22T13:36:55+00:00","indicators_count":{"informative":7,"suspicious":8,"malicious":7},"tags":["Multi-Process"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"2.20.189.74","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"address":"2.20.189.19","port":80,"protocol":"TCP","country":"European Union","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"address":"52.138.216.83","port":52654,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}],"processes":[{"pid":2260,"ppid":0,"name":"morbery.exe","command_line":"","sha256":"1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2","normalized_path":"C:\\morbery.exe","uid":"00012018-00002260","icon":"$26"},{"pid":2580,"ppid":2260,"name":"mosbesy.exe","command_line":"","sha256":"1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2","normalized_path":"%APPDATA%\\TeamViewer\\mosbesy.exe","parent_uid":"00012018-00002260","uid":"00013117-00002580"},{"pid":3752,"ppid":2580,"name":"svchost.exe","command_line":"-k netsvcs","sha256":"93b2ed4004ed5f7f3039dd7ecbd22c7e4e24b6373b4d9ef8d6e45a179b13a5e8","normalized_path":"%WINDIR%\\System32\\svchost.exe","parent_uid":"00013117-00002580","uid":"00014209-00003752"}],"all_imported_dlls":["clbcatq.dll","ws2_32.dll","crypt32.dll","ntdll.dll","kernel32.dll","winhttp.dll","nsi.dll","ncrypt.dll","wow64.dll","msvcrt.dll","dwmapi.dll","oleaut32.dll","winnsi.dll","gdi32.dll","cryptbase.dll","shell32.dll","shlwapi.dll","webio.dll","rpcss.dll","imm32.dll","wow64win.dll","lpk.dll","usp10.dll","rpcrt4.dll","sspicli.dll","uxtheme.dll","apphelp.dll","taskschd.dll","wow64cpu.dll","ole32.dll","msasn1.dll","ntmarta.dll","Wldap32.dll","tzres.dll","advapi32.dll","IPHLPAPI.DLL","userenv.dll","profapi.dll","bcrypt.dll","user32.dll","KernelBase.dll","sechost.dll","comctl32.dll","msctf.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"%WINDIR%\\SysWOW64\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"path":"%APPDATA%\\TeamViewer","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"C:\\morbery.exe","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%APPDATA%\\TeamViewer\\mosbesy.exe","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"C:\\morbery.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%APPDATA%\\TeamViewer\\mosbesy.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%WINDIR%\\SysWOW64\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%WINDIR%\\System32\\tzres.dll","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"path":"%WINDIR%\\System32\\en-US\\tzres.dll.mui","sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\EXCLUSIONS\\","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]},{"key":"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS DEFENDER\\EXCLUSIONS\\PATHS\\","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"},{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\B9B5A32C8CB0128","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"name":"B9B5A32C8CB0128","sources":[{"report_type":"sandbox","report_id":"5ab3b0327ca3e132ce73dd17"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\858C65FC97F0128","sources":[{"report_type":"sandbox","report_id":"5ab3a3397ca3e111e34ba047"}]}]}},"report_ids":{"sandbox_job_ids":["5ab3b0327ca3e132ce73dd17","5ab3a3397ca3e111e34ba047"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Sample 1ea818b42112… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 1ea818b42112…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample 1ea818b42112… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 1ea818b42112…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/1ea818b42112608931b01892a9b24d4120a8f96140b69531305ac0d7135eb3a2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample 1ea818b42112… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 1ea818b42112…. Threat score 100/100. 0/0 AV engines flagged this file. 6 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L27","11",{}]]