24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 55:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T505,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Shellcode.Loader.Marte.X.Generic Sample 2925c1e22082… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2925c1e22082…. Malware family: Shellcode.Loader.Marte.X.Generic. Threat score 100/100. 21/27 AV engines flagged this file. 3 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c","keywords":["Malicious","Shellcode.Loader.Marte.X.Generic","malware analysis","sandbox report","threat intelligence","2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c"],"about":{"@type":"SoftwareApplication","name":"2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin","applicationCategory":["peexe","executable"],"identifier":"2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Shellcode.Loader.Marte.X.Generic","antivirusDetections":{"malicious":21,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T7e2,Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp")26:T6d6,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp")27:T5b4,Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp")28:T65c,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02DD6000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02DD6000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp")29:T6ae,"" (Indicator: "GetDC"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp")4c:Tf24,Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp") Found reference to API "FindFirstFileExW" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "131454281497,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.171",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "131468273001,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.187",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "131472942151,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.187",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "131467107869,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.171",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "131470897211,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.187",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "131472378773,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.187",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "131453124307,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.171",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "131465934349,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.171",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "131469178301,1868,3117,,FindFirstFileA,kernel32.dll,"01:17:53.187",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000002.299726.02E15000.00000004.mdmp") Found reference to API "258907509707,1868,3117,,FindFirstFileA,kernel32.dll,"01:18:46.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000003.302540.02E0C000.00000004.mdmp") Found reference to API "258911504243,1868,3117,,FindFirstFileA,kernel32.dll,"01:18:46.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000003.302540.02E0C000.00000004.mdmp") Found reference to API "258896128913,1868,3117,,FindFirstFileA,kernel32.dll,"01:18:46.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000003.302540.02E0C000.00000004.mdmp") Found reference to API "258908364127,1868,3117,,FindFirstFileA,kernel32.dll,"01:18:46.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000003.302540.02E0C000.00000004.mdmp") Found reference to API "258897469727,1868,3117,,FindFirstFileA,kernel32.dll,"01:18:46.281",RX=0,PX=0" (Indicator: "FindFirstFile"; Source: "00000000-00002196.00000003.302540.02E0C000.00000004.mdmp")4d:Tac9,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp")4e:T65a,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp")4f:T413,Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "K32GetModuleFileNameExW" (Indicator: "GetModuleFileName"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "GetModuleFileNameA" (Indicator: "GetModuleFileName"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "GetModuleFileNameW" (Indicator: "GetModuleFileName"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp")50:T55e,Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002196.00000000.295886.0099F000.00000004.mdmp, 00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000002.299726.0099F000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00002196.00000001.297809.00963000.00000004.mdmp, 00000000-00002196.00000003.302540.00963000.00000004.mdmp")51:T691,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"file/memory contains long string with (Indicator: \"Aes\"; Source: \"00000000-00002196.00000003.302540.02E09000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"Aes\"; Source: \"00000000-00002196.00000003.302540.02E0C000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002196.00000001.297809.00963000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002196.00000003.302540.00963000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"2925c1e2208221fb4c42e8987b17a8c479f94c35ae9054a5c98bcd7fa9ec773c.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 9388-5394-004198EC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002196-11920-5-00928DD0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002196-11920-45-0092D3F3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002196-11920-1367-00929760\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00002196-11920-2762-009298EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00002196-11920-2811-009285E9","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".fptable\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002196-00000C2C-3594020141\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Cryptographic Related","name":"Calls an API typically used to convert data from string to binary","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00002196.00000000.295886.02D90000.00000004.mdmp, 00000000-00002196.00000001.297809.02D90000.00000004.mdmp, 00000000-00002196.00000002.299726.02D90000.00000004.mdmp, 00000000-00002196.00000003.302540.02D90000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"698864faf7801c7f4e0748b1"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"