26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 5a:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.1055.Generic Sample 25b01c01be67… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 25b01c01be67…. Malware family: Dacic.1055.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 12 malicious and 14 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea","keywords":["Malicious","Dacic.1055.Generic","malware analysis","sandbox report","threat intelligence","25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea"],"about":{"@type":"SoftwareApplication","name":"25b01c01be6785c8779e7a68dbbc002e1228dda16874a.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.1055.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":14},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T8e8,Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "[InjectDependency] WriteProcessMemory failed6" (Indicator: "WriteProcessMemory"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp")28:Tc3e,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt32" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReleaseComObject" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StructureToPtr" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "WriteInt16" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringAnsi" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetDelegateForFunctionPointer" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "GetBuffer" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin"29:T622,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp")2a:T2896,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found reference to "System.Security.Cryptography.HMAC" (Indicator: "HMAC"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp")2b:T7a3,"" (Indicator: "GetDC"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00008132.00000001.153361.00372000.00000002.mdmp")4d:T9e4,"" (Indicator: "password"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "passwords.txt" (Indicator: "password"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "password" (Indicator: "password"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "catch save passwords$" (Indicator: "password"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "SELECT action_url, origin_url, username_value, password_value FROM logins" (Indicator: "password"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "catch passwords sql" (Indicator: "password"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "mark_check_passwords" (Indicator: "password"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "catch quantum passwords sql" (Indicator: "password"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp")50:T547,Found string "SELECT * FROM Win32_LogicalDisk WHERE DeviceID = '" (Indicator: " Win32_LogicalDisk"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "SELECT * FROM Win32_PhysicalMemory" (Indicator: " Win32_PhysicalMemory"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp")51:T4bd,Found string "\Device\HarddiskVolume2Windows\Start Menu\Programs" (Indicator: "\Device\"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found string "\Device\HarddiskVolume1\??\Volume{815ead30-0000-0000-0000-100000000000}" (Indicator: "\Device\"; Source: "00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp") Found string "m32\drivers\SandboxFltr.sys" (Indicator: "\drivers\"; Source: "00000000-00008132.00000000.151439.034A0000.00000002.mdmp, 00000000-00008132.00000001.153361.034A0000.00000002.mdmp, 00000000-00008132.00000002.155279.034A0000.00000002.mdmp")52:Tbed,Found string "DisableBehaviorMonitoring" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "DisableRealtimeMonitoring" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "DisableIOAVProtection" (Indicator: "disableioavprotection"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "disablerealtimemonitoring"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableBehaviorMonitoring $true" (Indicator: "disablebehaviormonitoring"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "DisableBlockAtFirstSeen" (Indicator: "disableblockatfirstseen"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableBlockAtFirstSeen $true" (Indicator: "disableblockatfirstseen"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableIOAVProtection $true" (Indicator: "disableioavprotection"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableIntrusionPreventionSystem $true" (Indicator: "disableintrusionpreventionsystem"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "DisableScriptScanning" (Indicator: "disablescriptscanning"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "disablescriptscanning"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp")53:T1065,Found string "Set-MpPreference -DisableRealtimeMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableBehaviorMonitoring $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableBlockAtFirstSeen $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableIOAVProtection $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisablePrivacyMode $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableArchiveScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableIntrusionPreventionSystem $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -DisableScriptScanning $true" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -SubmitSamplesConsent 2" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -MAPSReporting 0" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -HighThreatDefaultAction 6 -Force" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -ModerateThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -LowThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp") Found string "Set-MpPreference -SevereThreatDefaultAction 6" (Indicator: "Set-MpPreference"; Source: "00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp")54:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file packed with confuser protection","description":"Observed string: \"&Confuser.Core 1.7.0-alpha.4+657fb58dcf\" (Indicator: \"Confuser.Core \") in Source: 25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\n Observed string: \"&Confuser.Core 1.7.0-alpha.4+657fb58dcf\" (Indicator: \"Confuser.Core \") in Source: 00000000-00008132.00000001.153361.00372000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1027.002","relevance":1,"id":"string-232","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"NtQueryInformationProcess\" in \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Observed API \"QueryPerformanceCounter\" in \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Observed API \"NtQueryInformationProcess\" in \"FANBooster131.exe\"\n Observed API \"QueryPerformanceCounter\" in \"FANBooster131.exe\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found reference to API \"NtQueryInformationProcess\" (Indicator: \"NtQueryInformationProcess\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Observed function \"ToBase64String\" in \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Observed function \"FromBase64String\" in \"FANBooster131.exe\"\n Observed function \"ToBase64String\" in \"FANBooster131.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"FANBooster131.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2d","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2e","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFileSystemEntries\" in \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Observed dotnet function \"GetDirectories\" in \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Observed dotnet function \"GetFiles\" in \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Observed dotnet function \"EnumerateFiles\" in \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Observed dotnet function \"GetFileSystemEntries\" in \"FANBooster131.exe\"\n Observed dotnet function \"GetDirectories\" in \"FANBooster131.exe\"\n Observed dotnet function \"GetFiles\" in \"FANBooster131.exe\"\n Observed dotnet function \"EnumerateFiles\" in \"FANBooster131.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found string \"UserName:\" (Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")\n Found string \"get_Is64BitOperatingSystem\" (Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")\n Found string \"GetDrives\" (Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"formhistory.sqlite\" (Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found string \"places.sqlite\" (Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\vmhgfs+\" (Indicator: \"vmhgfs\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found string \"SYSTEM\\CurrentControlSet\\Services\\VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found string \"VBoxSF\" (Indicator: \"VBoxSF\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found string \"VBoxGuest\" (Indicator: \"VBoxGuest\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-660","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual/sandbox environment devices","description":"Found string \"SYSTEM\\CurrentControlSet\\Services\\VBoxGuest\" (Indicator: \"\\vboxguest\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497","relevance":1,"id":"string-667","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00008132-00000C2C-1297114073\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00008132-00000C2C-1297114525\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found string \"SELECT host, isHttpOnly, path, isSecure, expiry, name, value FROM moz_cookies\" (Indicator: \"moz_cookies\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation\" in file \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; File: \"25b01c01be6785c8779e7a68dbbc002e1228dda16874aad8f552b39f63cb2bea.bin\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00008132.00000000.151439.02A30000.00000004.mdmp, 00000000-00008132.00000001.153361.02A30000.00000004.mdmp, 00000000-00008132.00000002.155279.02A30000.00000004.mdmp\")\n Found reference to API \"sendMessageChannelCache\" (Indicator: \"sendmessage\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")\n Found reference to API \"System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35\" (Indicator: \"sendmessage\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00008132.00000000.151439.04B20000.00000004.mdmp, 00000000-00008132.00000001.153361.04B20000.00000004.mdmp, 00000000-00008132.00000002.155279.04B20000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00008132.00000001.153361.00372000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69c511ed9926371f1105fc43"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to read volume data via DOS device path","description":"\"