24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 5c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4e9,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.A9349469.A.Generic Sample 486786f62873… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 486786f62873…. Malware family: Dacic.A9349469.A.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 13 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd","keywords":["Malicious","Dacic.A9349469.A.Generic","malware analysis","sandbox report","threat intelligence","486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd"],"about":{"@type":"SoftwareApplication","name":"486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin","applicationCategory":["peexe","executable"],"identifier":"486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.A9349469.A.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":13,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Tca2,Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "ZwMapViewOfSection" (Indicator: "ZwMapViewOfSection"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")26:T89a,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")27:T592,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "FreeLibraryWhenCallbackReturns" (Indicator: "FreeLibrary"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")28:T8c0,"" (Indicator: "GetDC"; Source: "00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007380.00000000.123950.02ED0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007380.00000000.123950.02ED0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007380.00000000.123950.02ED0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007380.00000000.123950.02ED0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007380.00000000.123950.02ED0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007380.00000000.123950.02ED0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007380.00000000.123950.02ED0000.00000004.mdmp")4e:T590,Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "FindFirstFileW" (Indicator: "FindFirstFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "FindNextFileW" (Indicator: "FindNextFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "FindFirstFileA" (Indicator: "FindFirstFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "FindNextFileA" (Indicator: "FindNextFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "FindFirstFileExA" (Indicator: "FindFirstFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")4f:Tc0c,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "Process32NextW" (Indicator: "Process32Next"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "Process32FirstW" (Indicator: "Process32First"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetCurrentProcessorNumber" (Indicator: "GetCurrentProcess"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp, 00000000-00007192.00000002.127923.10001000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")50:T81a,Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetFileInformationByHandleEx" (Indicator: "GetFileInformationByHandle"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetTempPathW" (Indicator: "GetTempPath"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetTempFileNameW" (Indicator: "GetTempFileName"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetSystemDirectoryA" (Indicator: "GetSystemDirectory"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")51:T4c2,Found reference to API "GetUserNameW" (Indicator: "GetUserName"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "WTSQuerySessionInformationW" (Indicator: "WTSQuerySessionInformation"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "OpenProcessToken" (Indicator: "OpenProcessToken"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found reference to API "GetUserNameW" (Indicator: "GetUserName"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")52:Tc37,Found string "[Tab]" (Indicator: "[tab]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[Alt]" (Indicator: "[alt]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[Alt]" (Indicator: "[Alt]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[Pause]" (Indicator: "[pause]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[Esc]" (Indicator: "[esc]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[End]" (Indicator: "[end]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[Left]" (Indicator: "[left]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[Right]" (Indicator: "[right]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[Down]" (Indicator: "[down]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[F10]" (Indicator: "[F10]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[F11]" (Indicator: "[F11]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[F12]" (Indicator: "[F12]"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found string "[Tab]" (Indicator: "[tab]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[Alt]" (Indicator: "[alt]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[Alt]" (Indicator: "[Alt]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[Pause]" (Indicator: "[pause]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[Esc]" (Indicator: "[esc]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[End]" (Indicator: "[end]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[Left]" (Indicator: "[left]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[Right]" (Indicator: "[right]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[Down]" (Indicator: "[down]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")53:T7ea,Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin"), Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin"), Found reference to API "").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; File: "486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin") Found reference to API "fso.DeleteFile "" (Indicator: "DeleteFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp"), Found reference to API "fso.DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp"), Found reference to API "CreateObject("Scripting.FileSystemObject").DeleteFile(Wscript.ScriptFullName)" (Indicator: "DeleteFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp"), Found reference to API "DeleteFileA" (Indicator: "DeleteFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp"), Found reference to API "DeleteFileW" (Indicator: "DeleteFile"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp"), Found reference to API "RemoveDirectoryW" (Indicator: "RemoveDirectory"; Source: "00000000-00007192.00000000.124081.0045A000.00000002.mdmp")54:Ta61,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007380.00000000.123950.02ED0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"698a4b292c7aaeb2b90374c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; File: \"486786f628734fcde180598771c220dc0fb889650cf6a7be20a82bd7b79673cd.bin\")\n Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007192.00000000.124081.0045A000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007192.00000000.124081.0045A000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"698a4b292c7aaeb2b90374c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Loads the debugger/analysis tool module","description":"\"rmclient.exe\" loaded module \"%WINDIR%\\SysWOW64\\pstorec.dll\" at 72730000","origin":"Loaded Module","mitre_attack_id":"T1518.001","relevance":3,"id":"module-16","sources":[{"report_type":"sandbox","report_id":"698a4b292c7aaeb2b90374c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$28","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"698a4b292c7aaeb2b90374c5"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007192.00000000.124081.02D80000.00000004.mdmp, 00000000-00007192.00000001.126001.02D80000.00000004.mdmp, 00000000-00007192.00000002.127923.02D80000.00000004.mdmp, 00000000-00007192.00000003.133294.02D80000.00000004.mdmp\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007380.00000000.123950.02ED0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"698a4b292c7aaeb2b90374c5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"remcos.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007192)\n \"remcos.exe\" called \"RtlDecompressBuffer\" with parameters (UID: 00000000-00007192)\n \"remcos.exe\" called \"RtlCompressBuffer\" with parameters (UID: 00000000-00007192)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"698a4b292c7aaeb2b90374c5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"remcos.exe\" called \"GlobalMemoryStatusEx\" with parameters (UID: 00000000-00007192)\n \"remcos.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007192)\n \"remcos.exe\" called \"GetComputerNameExW\" with parameters (UID: 00000000-00007192)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"698a4b292c7aaeb2b90374c5"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\" Microsoft Corporation\"\n \"remcos.exe.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"698a4b292c7aaeb2b90374c5"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"