26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2d:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T495,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 52d4cc0f07a6… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 52d4cc0f07a6…. Malware family: Trojan.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 12 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d"],"about":{"@type":"SoftwareApplication","name":"bounty-78843705638661805","applicationCategory":["peexe","executable"],"identifier":"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":13,"total":28},"behavioralIndicators":{"malicious":12,"suspicious":29},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T416,PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2347-0040B5F3 PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2346-0040B404 PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2390-00418FFD PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2344-0040B467 PathFileExistsA@SHLWAPI.DLL at 00000000-00003676-21533-2468-0040AE2A PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2349-0040B52D PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2342-0040B4CA PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2341-0040B71C PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2348-0040B590 PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-66-00410EDA PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2345-0040B656 PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2449-0040971E PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2350-0040B28E PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-21533-2343-0040B6B9 PathFileExistsW@SHLWAPI.DLL at 00000000-00003676-30929-2643-00418CCD28:T43f,".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Microsoft\Windows\Caches (UID: 00000000-00003172) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Temp\ (UID: 00000000-00003172) ".exe" called "CreateDirectoryW" with parameter C:\Users (UID: 00000000-00003172) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS (UID: 00000000-00003172) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData (UID: 00000000-00003172) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Temp\nsdD23.tmp (UID: 00000000-00003172) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local (UID: 00000000-00003172) ".exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Local\Temp (UID: 00000000-00003172) "lzkmb.exe" called "CreateDirectoryW" with parameter C:\Users\HAPUBWS\AppData\Roaming\lsoeaawuetxeut (UID: 00000000-00003340)29:T47e,Sleep@KERNEL32.DLL at 00000000-00003340-17876-41-004043CA Sleep@KERNEL32.DLL at 00000000-00003340-17876-31-00404414 Sleep@KERNEL32.DLL at 00000000-00003340-17876-187-0040445D Sleep@KERNEL32.DLL at 00000000-00003676-21533-2603-0040567A Sleep@KERNEL32.DLL at 00000000-00003676-21533-2552-00411140 Sleep@KERNEL32.DLL at 00000000-00003676-21533-2485-0040E18D Sleep@KERNEL32.DLL at 00000000-00003676-21533-1206-00404351 Sleep@KERNEL32.DLL at 00000000-00003676-21533-2425-004094FF Sleep@KERNEL32.DLL at 00000000-00003676-21533-1087-00413980 Sleep@KERNEL32.DLL at 00000000-00003676-21533-2469-0040AF4D Sleep@KERNEL32.DLL at 00000000-00003676-21533-2329-0040402C Sleep@KERNEL32.DLL at 00000000-00003676-21533-2359-00406D28 Sleep@KERNEL32.DLL at 00000000-00003676-21533-2453-00409C1F Sleep@KERNEL32.DLL at 00000000-00003676-21533-2577-004144DA Sleep@KERNEL32.DLL at 00000000-00003676-21533-2549-00410B5C Sleep@KERNEL32.DLL at 00000000-00003676-21533-66-00410EDA Sleep@KERNEL32.DLL at 00000000-00003676-21533-2553-00411253 Sleep@KERNEL32.DLL at 00000000-00003676-21533-2449-0040971E Sleep@KERNEL32.DLL at 00000000-00003676-21533-2450-0040966D2a:T491,"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin" file has an entrypoint instructions - "pushebp,movebp, esp,subesp, 0x3f4,pushebx,pushesi,pushedi,push0x20,popedi,xorebx, ebx,push0x8001,movdword ptr [ebp - 0x14], ebx,movdword ptr [ebp - 4], 0x40a230,movdword ptr [ebp - 0x10], ebx,calldword ptr [0x4080c8],movesi, dword ptr [0x4080cc],leaeax, [ebp - 0x140],pusheax,movdword ptr [ebp - 0x12c], ebx,movdword ptr [ebp - 0x2c], ebx,movdword ptr [ebp - 0x28], ebx,movdword ptr [ebp - 0x140], 0x11c,callesi,testeax, eax,jne0x4036ca,leaeax, [ebp - 0x140],movdword ptr [ebp - 0x140], 0x114,pusheax," "lzkmb.exe" file has an entrypoint instructions - "call0x40865e,jmp0x403924,pushebp,movebp, esp,anddword ptr [0x412e90], 0,subesp, 0x10,pushebx,xorebx, ebx,incebx,ordword ptr [0x412280], ebx,push0xa,call0x40d124,testeax, eax,je0x403bd1,xorecx, ecx,moveax, ebx,movdword ptr [0x412e90], ebx,cpuid,pushesi,movesi, dword ptr [0x412280],pushedi,leaedi, [ebp - 0x10],oresi, 2,movdword ptr [edi], eax,movdword ptr [edi + 4], ebx,movdword ptr [edi + 8], ecx,movdword ptr [edi + 0xc], edx,testdword ptr [ebp - 8], 0x100000,movdword ptr [0x412280], esi,je0x403b0a,"2b:T468,".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to access non-existent file "C:\52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.exe.Local\" ".exe" trying to access non-existent file "C:\52D4CC0F07A62E6D37C82B33480131CC2C1D5B83D11104997F06CAC4D8876F5D.EXE.LOCAL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\SKDOCCS.O" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\KNFJHA.HH" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Temp\LZKMB.EXE"2c:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAAABERERmZmZmZAAAAAAAAAAEYiIiIiIiIiZAAAAAAAAARgRERGREREZiZAAAAAAABGBERERERERGZh3AAAAAAEYEQAAAAAAABGX+IAAAAARgRERERAREREBd493AAABGBERmYgBGZmZEBiH+ZAAEYERGZiIEZiIiZEYd5iZARgRERmYiJiIiIiRAXmZiZGBEREZiIiIiIiIiRGZmZiRgRGRGYiIiIiIiIkQGZmYkYEZkZmIiBiIiIiIkRmZmJGBmZGYiIiBiIgYiJEBmZiRiZmRmIgZiJGZkYiJERmYkYmZkZiIiJGIiJkYGJARmJmJmZGZiIiIiIiIEZiRAZiZiZmRGZiIiIiIiBGIiRGYmYmZkZkRiBiIgYgRmImZmBmJmZGYEZgRmQkZEZmZmZgZiZmRGRmIGYgZiBGZmZkYGYmZkZgZiBmIGYgRmZmRGBmJmZEZEZgYiBGZEZmZERgZiZmZiBmIEZkZiBGZkREYGZiZl5gRmBmIEZgRmRERgRCZiXeJGYgYiBmIGZERGBEACZ94hxiIEZkZiJkREYEQAAB3+HeZiZmIGYiRERgRAAAACI95mZmYiJmZERGBEAAAAAB3iZmZmYmZkREYEQAAAAAACZiZmZmZmRERgRAAAAAAAACZiIiIiIiIiBEAAAAAAAAACZmZmZkREREQAAAAD/AAD//gAAf/wAAD/4AAAf8AAAD+AAAAfAAAADgAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAAABwAAAA+AAAAfwAAAP+AAAH/wAAD/+AAB//wAA/w==1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790995603692,"unified_at":"2026-10-03T02:46:43.692Z","metadata":{"hashes":{"sha256":"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d","sha1":"373c6256339023c584db4f13bc3f856a30c3cabe","md5":"b0f70946dc03f74519457537d9bcf0ef","sha512":"ed3d83970cdbbe86ec9e9a71ed844883197e4db8158f0fe551d07ad3956f5a11f70211b32d002097f94fe5da0c412e61e3bd54181db5f59d8d411e34d784d037","ssdeep":"12288:FYIVcKxsozwYGYAq3nArsgYUY72y+PrXH6Yi:FY2t2gwYbvwXYUI2fHM","ssdeep_chunks":["12288:FYIVcKx","12288:YIVcKxs","12288:IVcKxso","12288:VcKxsoz","12288:cKxsozw","12288:KxsozwY","12288:xsozwYG","12288:sozwYGY","12288:ozwYGYA","12288:zwYGYAq","12288:wYGYAq3","12288:YGYAq3n","12288:GYAq3nA","12288:YAq3nAr","12288:Aq3nArs","12288:q3nArsg","12288:3nArsgY","12288:nArsgYU","12288:ArsgYUY","12288:rsgYUY7","12288:sgYUY72","12288:gYUY72y","12288:YUY72y+","12288:UY72y+P","12288:Y72y+Pr","12288:72y+PrX","12288:2y+PrXH","12288:y+PrXH6","12288:+PrXH6Y","12288:PrXH6Yi","24576:FYIVcKx","24576:YIVcKxs","24576:IVcKxso","24576:VcKxsoz","24576:cKxsozw","24576:KxsozwY","24576:xsozwYG","24576:sozwYGY","24576:ozwYGYA","24576:zwYGYAq","24576:wYGYAq3","24576:YGYAq3n","24576:GYAq3nA","24576:YAq3nAr","24576:Aq3nArs","24576:q3nArsg","24576:3nArsgY","24576:nArsgYU","24576:ArsgYUY","24576:rsgYUY7","24576:sgYUY72","24576:gYUY72y","24576:YUY72y+","24576:UY72y+P","24576:Y72y+Pr","24576:72y+PrX","24576:2y+PrXH","24576:y+PrXH6","24576:+PrXH6Y","24576:PrXH6Yi","12288:FY2t2gw","12288:Y2t2gwY","12288:2t2gwYb","12288:t2gwYbv","12288:2gwYbvw","12288:gwYbvwX","12288:wYbvwXY","12288:YbvwXYU","12288:bvwXYUI","12288:vwXYUI2","12288:wXYUI2f","12288:XYUI2fH","12288:YUI2fHM"],"imphash":"61259b55b8912888e90f516ca08dc514"},"file_info":{"file_name":"bounty-78843705638661805","file_type":["peexe","executable"],"file_type_id":"exe","file_size":510400,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1676289562000,"last_seen":1679699508000,"last_multi_scan":1679699508000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","credentialharvesting","criminal","remcos","evasive"]},"stats":{"av":{"malicious_count":13,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":75,"suspicious_count":29,"malicious_count":12,"total":116},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.tshg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"HEUR/AGEN.1337962","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65437854","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.GenericKD.65437854 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Injector.bf","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Backdoor.Win32.Remcos.gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Loader.jurucx","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Genus.OSL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.RmRAT","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Agent.Win32.3230517","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to create a process"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"suspicious","value":"Contains ability to open/control a service"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Execution","technique":"Exploitation for Client Execution","attack_id":"T1203","attack_id_wiki":"https://attack.mitre.org/techniques/T1203","identifiers":[{"type":"suspicious","value":"Contains ability to download file/payload"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Persistence","technique":"Registry Run Keys / Startup Folder","attack_id":"T1547.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/001","identifiers":[{"type":"suspicious","value":"Modifies auto-execute functionality by setting/creating a value in the registry"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Privilege Escalation","technique":"Process Hollowing","attack_id":"T1055.012","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/012","identifiers":[{"type":"malicious","value":"Sets thread context in a remote process (often injection or process hollowing)"},{"type":"malicious","value":"Creates a process in suspended mode (likely for process injection)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Privilege Escalation","technique":"Process Doppelg��nging","attack_id":"T1055.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/013","identifiers":[{"type":"informative","value":"Contains ability to unmaps a view of a section from the process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to enable or disable privileges in the specified access token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"},{"type":"informative","value":"Imports system security related APIs"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Defense Evasion","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"suspicious","value":"Opens file with deletion access rights"},{"type":"informative","value":"Calls an API typically used to remove a directory"},{"type":"suspicious","value":"Marks file for deletion"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Defense Evasion","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"informative","value":"Drops files inside appdata directory"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Found debugger evasion api strings"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"suspicious","value":"Contains ability to hook/unhook windows functions"},{"type":"suspicious","value":"Contains ability to retrieve keyboard strokes"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Credential Access","technique":"Credentials In Files","attack_id":"T1552.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1552/001","identifiers":[{"type":"malicious","value":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Read windows product name from registry"},{"type":"informative","value":"Found registry key string for installed applications"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"},{"type":"informative","value":"Calls an API possibly used to retrieve a handle to the foreground window"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query local/system time"},{"type":"informative","value":"Contains ability to query machine time"},{"type":"informative","value":"Contains ability to query the machine timezone"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to lookup the windows account name"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to retrieve is X64 architecture"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains ability to query the system locale"},{"type":"suspicious","value":"Contains ability to check if a debugger is running"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Contains ability to verify if file exist on disk"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Tries to access non-existent files"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve local language"},{"type":"informative","value":"Contains ability to retreive system language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Collection","technique":"Clipboard Data","attack_id":"T1115","attack_id_wiki":"https://attack.mitre.org/techniques/T1115","identifiers":[{"type":"suspicious","value":"Contains ability to read clipboard data"},{"type":"suspicious","value":"Contains ability to open the clipboard"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Calls an API possibly used to take screenshots"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Writes a PE file header to disc"},{"type":"informative","value":"Dropped files"},{"type":"suspicious","value":"Contains ability to download files from the internet"},{"type":"suspicious","value":"Drops executable files"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Command and Control","technique":"DNS","attack_id":"T1071.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/004","identifiers":[{"type":"informative","value":"Queries DNS server"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"},{"type":"malicious","value":"Uses network protocols on unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - Possible RC4 Encryption"},{"type":"informative","value":"Contains ability to perform encryption (API string)"},{"type":"suspicious","value":"Contains key cryptographic functions of the CryptoAPI"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"tactic":"Impact","technique":"System Shutdown/Reboot","attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"malicious","value":"Contains ability to reboot/shutdown the operating system"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource\" (UID: 00000000-00003172)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to remove a directory","description":"\".exe\" called \"RemoveDirectoryW\" with parameter %TEMP%\\nsdD23.tmp\\ (UID: 00000000-00003172)","origin":"API Call","mitre_attack_id":"T1070.004","relevance":3,"id":"api-121","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to unmaps a view of a section from the process (API string)","description":"Observed api string:\"NtUnmapViewOfSection\" [Source: 21533-1498-0041A8DA]","origin":"File/Memory","mitre_attack_id":"T1055.013","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"UnhandledExceptionFilter\" [Source: nmdavrpjtcgwp.exe.1867599251]\n Observed api string:\"SetUnhandledExceptionFilter\" [Source: nmdavrpjtcgwp.exe.1867599251]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003340-17876-16-0040883D\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003340-17876-243-0040881A\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003676-21533-1527-004327AE\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003676-21533-13-00432D4B\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00003676-21533-84-004398AC\n SetUnhandledExceptionFilter@KERNEL32.dll at 42890-352-0040881A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"IsDebuggerPresent\" [Source: nmdavrpjtcgwp.exe.1867599251]\n Observed string:\"OutputDebugString\" [Source: nmdavrpjtcgwp.exe.1867599251]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".ndata\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Observed api string:\"CryptUnprotectData which can perform decryption and does an integrity check of the data\"[Source: 21533-2337-00406071]","origin":"File/Memory","mitre_attack_id":"T1471","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API possibly used to retrieve a handle to the foreground window","description":"\".exe\" called \"GetForegroundWindow\" (UID: 00000000-00003172)","origin":"API Call","mitre_attack_id":"T1010","relevance":3,"id":"api-142","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\".exe\" called \"GetActiveWindow\" (UID: 00000000-00003172)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00003172)\n \".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00003172)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003172)\n \".exe\" called \"RtlGetVersion\" (UID: 00000000-00003172)\n \"lzkmb.exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00003340)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve is X64 architecture","description":"\".exe\" called \"IsWow64Process\" with parameter \"3172\" - (UID: 00000000-00003172)\n \"lzkmb.exe\" called \"IsWow64Process\" with parameter \"3340\" - (UID: 00000000-00003340)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve local language","description":"\".exe\" called \"GetLocaleInfoW\" with parameter \"1033\" - (UID: 00000000-00003172)","origin":"API Call","mitre_attack_id":"T1614.001","relevance":3,"id":"api-147","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount64@KERNEL32.DLL at 00000000-00003340-17876-212-0040865E\n GetTickCount@KERNEL32.DLL at 00000000-00003676-21533-1108-00419AC6\n GetTickCount@KERNEL32.DLL at 00000000-00003676-21533-1087-00413980\n GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00003676-21533-1137-00419797\n GetTickCount@KERNEL32.DLL at 00000000-00003676-21533-2577-004144DA\n GlobalMemoryStatusEx@KERNEL32.DLL at 00000000-00003676-30929-2639-0041975C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindFirstFileW@KERNEL32.DLL at 00000000-00003676-21533-2401-00408398\n FindFirstFileW@KERNEL32.DLL at 00000000-00003676-21533-2403-004087A0\n FindFirstFileW@KERNEL32.DLL at 00000000-00003676-21533-2361-00407848\n FindFirstFileW@KERNEL32.DLL at 00000000-00003676-21533-2385-004068CD\n FindFirstFileW@KERNEL32.DLL at 00000000-00003676-21533-2398-0041A01B\n FindFirstFileA@KERNEL32.DLL at 00000000-00003676-21533-2466-0040AA71\n FindFirstFileW@KERNEL32.DLL at 00000000-00003676-21533-2350-0040B28E\n FindFirstFileA@KERNEL32.DLL at 00000000-00003676-21533-2467-0040AC78","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetDriveTypeA@KERNEL32.DLL at 00000000-00003676-21533-2357-00406B3E\n GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00003676-21533-2359-00406D28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003340-17876-212-0040865E\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003676-21533-968-00445E86\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003676-21533-29-00432BD6\n GetTimeZoneInformation@KERNEL32.DLL at 00000000-00003676-21533-2301-00446894","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003340-17876-212-0040865E\n GetLocalTime@KERNEL32.DLL at 00000000-00003676-21533-1138-00404F31\n GetLocalTime@KERNEL32.DLL at 00000000-00003676-21533-433-004194DA\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003676-21533-968-00445E86\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00003676-21533-29-00432BD6\n GetLocalTime@KERNEL32.DLL at 00000000-00003676-21533-2600-00404FD4\n GetLocalTime@KERNEL32.DLL at 00000000-00003676-21533-1090-0040A0B0\n GetSystemTimes@KERNEL32.DLL at 00000000-00003676-30929-2637-004197E0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the machine timezone","description":"GetTimeZoneInformation@KERNEL32.DLL at 00000000-00003676-21533-2301-00446894","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-48","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00003676-21533-1103-0040E2BB\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003676-21533-1412-0044F7F0\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003676-21533-1403-00445E1C\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003676-21533-1386-00445914\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003676-21533-1417-0044F17B\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003676-21533-1414-0044F216\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003676-21533-1382-0044EEB8\n GetUserDefaultLCID@KERNEL32.DLL at 00000000-00003676-21533-1390-00445F4C\n EnumSystemLocalesW@KERNEL32.DLL at 00000000-00003676-21533-1413-0044F130\n GetLocaleInfoW@KERNEL32.DLL at 00000000-00003676-21533-1416-0044F61C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")\n \"lzkmb.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")\n \"lzkmb.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"AUTHENTICODEENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retreive system language (API string)","description":"Observed api:\"GetUserDefaultUILanguage\"[Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed api string:\"GetVersionExW \" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: nmdavrpjtcgwp.exe.1867599251]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to verify if file exist on disk","description":"$27","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":1,"id":"stream-124","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Makes a code branch decision directly after an API that is environment aware","description":"Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-0000013Ch], 0Ah\" and \"jnc 004036DBh\" at 00000000-00003172-13943-1-00403640\n Found API call GetVersionExW@KERNEL32.DLL directly followed by \"cmp dword ptr [ebp-0000013Ch], 0Ah\" and \"jnc 004036DBh\" at 00000000-00003172-15612-1-00403640\n Found API call GetTimeZoneInformation@KERNEL32.DLL directly followed by \"cmp eax, FFFFFFFFh\" and \"je 004469C0h\" at 00000000-00003676-21533-2301-00446894\n Found API call EnumServicesStatusW@ADVAPI32.DLL directly followed by \"cmp dword ptr [esp+14h], esi\" and \"jbe 004189D0h\" at 00000000-00003676-30929-2632-004186FE","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-39","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Possibly tries to detect the presence of a debugger","description":"GetProcessHeap@KERNEL32.DLL at 00000000-00003340-17876-8-00408126\n GetProcessHeap@KERNEL32.DLL at 00000000-00003340-17876-117-00401319\n GetProcessHeap@KERNEL32.DLL at 00000000-00003340-17876-160-0040CC7E\n GetProcessHeap@KERNEL32.DLL at 00000000-00003340-17876-125-0040184E\n GetProcessHeap@KERNEL32.DLL at 00000000-00003340-17876-116-0040140E\n GetProcessHeap@KERNEL32.DLL at 00000000-00003676-21533-1213-00410763\n GetProcessHeap@KERNEL32.DLL at 00000000-00003676-21533-1214-00410ADC","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")\n \"lzkmb.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"$28","origin":"API Call","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a process","description":"\".exe\" called \"CreateProcessW\" with parameter \"\"%TEMP%\\lzkmb.exe\" %TEMP%\\knfjha.hh\" - (UID: 00000000-00003172)\n \"lzkmb.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\lzkmb.exe\" - (UID: 00000000-00003340)","origin":"API Call","mitre_attack_id":"T1106","relevance":5,"id":"api-128","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"185.16.39.117:1823\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"$29","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryW@KERNEL32.DLL at 00000000-00003340-17876-18-0040BE46\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003340-17876-115-0040116F\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003676-21533-22-00445A95\n LoadLibraryA@KERNEL32.DLL at 00000000-00003676-21533-1140-004137DC\n LoadLibraryA@KERNEL32.DLL at 00000000-00003676-21533-2337-00406071\n LoadLibraryExW@KERNEL32.DLL at 00000000-00003676-21533-10-00436AB3\n LoadLibraryA@KERNEL32.DLL at 00000000-00003676-21533-2577-004144DA\n LoadLibraryA@KERNEL32.DLL at 00000000-00003676-21533-2564-004128E3","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"CreateThread\" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Installer\\RunOnceEntries\"\n \"/k %windir%\\System32\\reg.exe ADD HKLM\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Policies\\System /v EnableLUA /t REG_DWORD /d 0 /f\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Run\\\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Policies\\Explorer\\Run\\\"\n \"Software\\Classes\\mscfile\\shell\\open\\command\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders\"\n \"Software\\\"\n \"\\Opera Software\\Opera Stable\\\"\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\"\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Rmc-X402GF\"\n \"Rmc-X402GF\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\msica_%x_%d","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Found suspicious keywords in script (string)","description":"Observed keyword:\"Scripting.FileSystemObject\" [Source: 21533-2471-0040BC59]\n Observed keyword:\"WScript.Shell\" [Source: 21533-2476-0040C3B8]\n Observed keyword:\"Scripting.FileSystemObject\" [Source: 21533-2476-0040C3B8]","origin":"File/Memory","relevance":1,"id":"string-154","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Loads rich edit control libraries","description":"\".exe\" loaded module \"%WINDIR%\\System32\\riched20.dll\" at 6CC10000","origin":"Loaded Module","id":"module-2","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \".exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin\" has an executable section named \".text\"\n \"lzkmb.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin\" has an writable section named \".data\"\n \"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin\" has an writable section named \".ndata\"\n \"lzkmb.exe\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2a","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Possibly use system binaries","description":"Observed system executable string:\"%WINDIR%\\System32\\cmd.exe\" [Source: 21533-1288-0040E501]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Queries DNS server","description":"\"ucremcz1.ddns.net\"","origin":"Network Traffic","mitre_attack_id":"T1071.004","relevance":1,"id":"network-51","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"lzkmb.exe\" with commandline \"%TEMP%\\knfjha.hh\" (UID: 00000000-00003340)\n Spawned process \"lzkmb.exe\" (UID: 00000000-00003676)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"lzkmb.exe\" with commandline \"%TEMP%\\knfjha.hh\" (UID: 00000000-00003340)\n Spawned process \"lzkmb.exe\" (UID: 00000000-00003676)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Connects to LPC ports","description":"\".exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to lookup the windows account name","description":"GetUserNameW@ADVAPI32.DLL at 00000000-00003676-21533-1203-004195F8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1033","relevance":5,"id":"stream-28","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"lzkmb.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"- Location: [%TEMP%\\lzkmb.exe]- [targetUID: 00000000-00003172]\n \"nmdavrpjtcgwp.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"- Location: [%APPDATA%\\lsoeaawuetxeut\\nmdavrpjtcgwp.exe]- [targetUID: 00000000-00003340]\n \"skdoccs.o\" has type \"data\"- Location: [%TEMP%\\skdoccs.o]- [targetUID: 00000000-00003172]\n \"nsyD03.tmp\" has type \"data\"- Location: [%TEMP%\\nsyD03.tmp]- [targetUID: 00000000-00003172]\n \"logs.dat\" has type \"data\"- Location: [%APPDATA%\\remcos\\logs.dat]- [targetUID: 00000000-00003676]\n \"knfjha.hh\" has type \"data\"- Location: [%TEMP%\\knfjha.hh]- [targetUID: 00000000-00003172]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \".exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\"\n \"lzkmb.exe\" touched file \"%WINDIR%\\AppPatch\\sysmain.sdb\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files","description":"$2b","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\"lzkmb.exe\" writes a file \"%APPDATA%\\remcos\\logs.dat\"\n \"lzkmb.exe\" writes a file \"%APPDATA%\\remcos\\logs.dat\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://nsis.sf.net/NSIS_Error\"\n Heuristic match: \"ucremcz1.ddns.net\"\n Heuristic match: \"* BreakingSecurity.net\"\n Pattern match: \"http://geoplugin.net/json.gp\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - Possible RC4 Encryption","description":"Internal YARA signature for possible RC4 encryption matched on file \"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin\"\n Internal YARA signature for possible RC4 encryption matched on file \"lzkmb.exe\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to update the user profile (API string)","description":"Observed api string:\"SystemParametersInfoW\" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API possibly used to take screenshots","description":"\".exe\" called \"CreateCompatibleBitmap\" (UID: 00000000-00003172)","origin":"API Call","mitre_attack_id":"T1113","relevance":3,"id":"api-105","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"lzkmb.exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00003340)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"\".exe\" called \"FindFirstFileW\" (UID: 00000000-00003172)\n \".exe\" called \"FindNextFileW\" (UID: 00000000-00003172)","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileW\" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]\n Observed api string:\"FindNextFileW\" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]\n Observed API string:\"GetModuleFileName\" [Source: 21533-1498-0041A8DA]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Observed api string:\"GetSystemMetrics\" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 21533-2601-0041A419","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to enable or disable privileges in the specified access token (API string)","description":"Observed api string:\"AdjustTokenPrivileges\" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"Observed api string:\"SetFileSecurityW which can Sets the security of a file or directory object\"[Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeShutdownPrivilege which can Shut down the system\"[Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"lzkmb.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"SetFileSecurityW\" which can \"Sets the security of a file or directory object\" [Source: 52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.bin]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops executable files inside temp directory","description":"\"lzkmb.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"- Location: [%TEMP%\\lzkmb.exe]- [targetUID: 00000000-00003172]","origin":"Binary File","relevance":3,"id":"binary-33","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Drops files inside appdata directory","description":"Dropped file: \"nmdavrpjtcgwp.exe\" - Location: [%APPDATA%\\lsoeaawuetxeut\\nmdavrpjtcgwp.exe]- [targetUID: 00000000-00003340]\n Dropped file: \"logs.dat\" - Location: [%APPDATA%\\remcos\\logs.dat]- [targetUID: 00000000-00003676]","origin":"Binary File","mitre_attack_id":"T1036","relevance":3,"id":"binary-37","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"lzkmb.exe\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")\n \"lzkmb.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"lzkmb.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to check if a debugger is running","description":"IsDebuggerPresent@KERNEL32.DLL at 00000000-00003340-17876-18-0040BE46\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003340-17876-12-00403BD6\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003340-17876-14-0040ACCE\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003676-21533-1527-004327AE\n IsDebuggerPresent@KERNEL32.DLL at 00000000-00003676-21533-84-004398AC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":3,"id":"stream-75","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Contains ability to open/control a service","description":"OpenServiceW@ADVAPI32.DLL at 00000000-00003340-17876-113-004010C7\n OpenServiceW@ADVAPI32.DLL at 00000000-00003676-30929-2632-004186FE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1569.002","relevance":8,"id":"stream-14","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Contains key cryptographic functions of the CryptoAPI","description":"CryptAcquireContextA@ADVAPI32.DLL at 00000000-00003676-21533-753-004315EC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1486","relevance":4,"id":"stream-10","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"15/90 reputation engines marked \"http://ucremcz1.ddns.net\" as malicious (16% detection rate)\n 3/90 reputation engines marked \"http://geoplugin.net/json.gp\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"41/70 Antivirus vendors marked sample as malicious (58% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"General","name":"Contains ability to find and load resources of a specific module","description":"LoadResource@KERNEL32.DLL at 00000000-00003676-21533-1497-00419493","origin":"Hybrid Analysis Technology","relevance":1,"id":"stream-32","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\".exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"lzkmb.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"- Location: [%TEMP%\\lzkmb.exe]- [targetUID: 00000000-00003172]\n \"nmdavrpjtcgwp.exe\" has type \"PE32 executable (console) Intel 80386 for MS Windows\"- Location: [%APPDATA%\\lsoeaawuetxeut\\nmdavrpjtcgwp.exe]- [targetUID: 00000000-00003340]","origin":"Binary File","mitre_attack_id":"T1105","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Modifies auto-execute functionality by setting/creating a value in the registry","description":"\"lzkmb.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\RUN\"; Key: \"ITGMVXDNNN\"; Value: \"%APPDATA%\\lsoeaawuetxeut\\nmdavrpjtcgwp.ex\")","origin":"Registry Access","mitre_attack_id":"T1547.001","relevance":8,"id":"registry-0","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Writes a PE file header to disc","description":"\".exe\" wrote 16384 bytes starting with PE header signature to file \"%APPDATA%\\lsoeaawuetxeut\\nmdavrpjtcgwp.exe\": 4d5aff000300000004000000ffff0000ff00000000000000400000000000000000000000000000000000000000000000000000000000000000000000ff0000000e1fff0e00ff09ff21ff014cff21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000 ...","origin":"API Call","mitre_attack_id":"T1105","relevance":10,"id":"api-43","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to download file/payload","description":"URLDownloadToFileW@URLMON.DLL at 00000000-00003676-21533-2354-004063C6\n URLDownloadToFileW@URLMON.DLL at 00000000-00003676-21533-2577-004144DA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1203","relevance":5,"id":"stream-83","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"socket@WS2_32.DLL at 00000000-00003676-21533-1076-0040480D\n closesocket@WS2_32.DLL at 00000000-00003676-21533-397-00404E06","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"48.95.6.59\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Pattern Matching","name":"Contains ability to download files from the internet","description":"URLDownloadToFileW@URLMON.DLL at 00000000-00003676-21533-2354-004063C6\n URLDownloadToFileW@URLMON.DLL at 00000000-00003676-21533-2577-004144DA\n recv@WS2_32.DLL at 00000000-00003676-21533-581-00404B76\n InternetReadFile@WININET.DLL at 00000000-00003676-30929-2624-0041936B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1105","relevance":10,"id":"stream-17","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Contains ability to update the user profile","description":"SystemParametersInfoW@USER32.DLL at 00000000-00003676-21533-2360-0041A76C","origin":"Hybrid Analysis Technology","relevance":5,"id":"stream-123","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"Process32FirstW@KERNEL32.DLL at 00000000-00003676-21533-1251-0040DE34\n Process32FirstW@KERNEL32.DLL at 00000000-00003676-21533-2486-0040E2E7","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to open the clipboard","description":"OpenClipboard@USER32.DLL at 00000000-00003676-21533-2577-004144DA\n OpenClipboard@USER32.DLL at 00000000-00003676-21533-2455-0040A65A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":10,"id":"stream-0","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read clipboard data","description":"GetClipboardData@USER32.DLL at 00000000-00003676-21533-2577-004144DA\n GetClipboardData@USER32.DLL at 00000000-00003676-21533-2455-0040A65A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1115","relevance":5,"id":"stream-74","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve keyboard strokes","description":"GetKeyboardState@USER32.DLL at 00000000-00003676-21533-2424-00409468","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":8,"id":"stream-12","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineW@KERNEL32.DLL at 00000000-00003172-13943-1-00403640\n GetCommandLineW@KERNEL32.DLL at 00000000-00003172-15612-1-00403640\n GetCommandLineW@KERNEL32.DLL at 00000000-00003340-17876-1-00403A93\n GetCommandLineW@KERNEL32.DLL at 00000000-00003340-17876-51-00401962\n GetCommandLineW@KERNEL32.dll at 42890-1-00403A93","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameW@KERNEL32.DLL at 00000000-00003340-17876-8-00408126\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003340-17876-109-004011E3\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003340-17876-194-004082F6\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003676-21533-1251-0040DE34\n GetModuleFileNameExW@PSAPI.DLL at 00000000-00003676-21533-1257-00419F87\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003676-21533-2556-00411899\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003676-21533-65-0040D3F0\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003676-21533-2471-0040BC59\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003676-21533-2476-0040C3B8\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003676-21533-2329-0040402C\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003676-21533-221-0041959F\n GetModuleFileNameW@KERNEL32.DLL at 00000000-00003676-21533-2475-0040BFDE","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browser information locations related strings","description":"\"\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"google\\chrome\\user data\") in Source: 21533-2461-0040A953\n \"\\AppData\\Roaming\\Mozilla\\Firefox\\Profiles\\\" (Indicator: \"mozilla\\firefox\\\") in Source: 21533-2466-0040AA71\n \"\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" (Indicator: \"google\\chrome\\user data\") in Source: 21533-2465-0040A9E2\n \"\\Mozilla\\Firefox\\Profiles\\\" (Indicator: \"mozilla\\firefox\\\") in Source: 21533-2350-0040B28E","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-93","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Read windows product name from registry","description":"\"lzkmb.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\"; Key: \"PRODUCTNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-105","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"System Destruction","name":"Marks file for deletion","description":"\".exe\" marked \"%TEMP%\\nsiCF2.tmp\" for deletion\n \".exe\" marked \"%TEMP%\\nsdD23.tmp\" for deletion","origin":"API Call","mitre_attack_id":"T1070.004","relevance":10,"id":"api-26","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"\".exe\" opened \"%TEMP%\\nsiCF2.tmp\" with delete access","origin":"API Call","mitre_attack_id":"T1070.004","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueW@ADVAPI32.DLL at 00000000-00003172-13943-1-00403640\n LookupPrivilegeValueW@ADVAPI32.DLL at 00000000-00003172-15612-1-00403640\n AdjustTokenPrivileges@ADVAPI32.DLL at 00000000-00003676-30929-2626-00415C90","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to hook/unhook windows functions","description":"UnhookWindowsHookEx@USER32.DLL at 00000000-00003676-21533-2426-0040A025\n SetWindowsHookExA@USER32.DLL at 00000000-00003676-21533-2423-00409340\n UnhookWindowsHookEx@USER32.DLL at 00000000-00003676-21533-2473-0040A7F2\n UnhookWindowsHookEx@USER32.DLL at 00000000-00003676-21533-1089-00409F9A","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1056.001","relevance":5,"id":"stream-107","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegCreateKeyExW\n RegDeleteValueW\n RegCloseKey\n OpenProcessToken\n RegEnumKeyW\n RegOpenKeyExW\n RegDeleteKeyW\n CopyFileW\n GetModuleFileNameW\n GetVersionExW\n GetFileAttributesW\n GetFileSize\n GetCommandLineW\n LoadLibraryExW\n CreateDirectoryW\n DeleteFileW\n GetProcAddress\n GetTempFileNameW\n GetModuleHandleA\n CreateThread\n GetSystemDirectoryW\n FindNextFileW\n GetTempPathW\n FindFirstFileW\n GetModuleHandleW\n WriteFile\n CreateFileW\n CreateProcessW\n Sleep\n GetTickCount\n ShellExecuteExW\n FindWindowExW\n RegOpenKeyW\n CreateServiceW\n UnhandledExceptionFilter\n GetStartupInfoW\n GetTickCount64\n LoadLibraryW\n TerminateProcess\n IsDebuggerPresent\n GetModuleHandleExW\n OutputDebugStringW\n WSASocketW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"d055f0756473f9750000000051c1cc769498cc76ee9ccc7675dcce76273ece760fb3d27600000000acdc19771bf71977c1081b77c0d91977152e197736da1977d5d9197730c61977e0c2197742c619771bc6197786c4197772c6197700000000\" to virtual address \"0x6E241000\" (part of module \"SHFOLDER.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a process in suspended mode (likely for process injection)","description":"\"lzkmb.exe\" called \"CreateProcessW\" with parameter \"%TEMP%\\lzkmb.exe\" - (UID: 00000000-00003340)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-129","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"41/70 Antivirus vendors marked sample as malicious (58% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"35/71 Antivirus vendors marked dropped file \"lzkmb.exe\" as malicious (classified as \"Trojan.Generic\" with 49% detection rate)\n 35/71 Antivirus vendors marked dropped file \"nmdavrpjtcgwp.exe\" as malicious (classified as \"Trojan.Generic\" with 49% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"35/71 Antivirus vendors marked spawned process \"lzkmb.exe\" (PID: 3340) as malicious (classified as \"Trojan.Generic\" with 49% detection rate)\n 35/71 Antivirus vendors marked spawned process \"lzkmb.exe\" (PID: 3676) as malicious (classified as \"Trojan.Generic\" with 49% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Sets thread context in a remote process (often injection or process hollowing)","description":"\"lzkmb.exe\" set thread context in remote process \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\" (PID: 00000e5c)","origin":"API Call","mitre_attack_id":"T1055.012","relevance":10,"id":"api-14","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\".exe\" wrote 32 bytes to a remote process \"%TEMP%\\lzkmb.exe\" (Handle: 380)\n \".exe\" wrote 52 bytes to a remote process \"%TEMP%\\lzkmb.exe\" (Handle: 380)\n \".exe\" wrote 4 bytes to a remote process \"%TEMP%\\lzkmb.exe\" (Handle: 380)\n \"lzkmb.exe\" wrote 32 bytes to a remote process \"%TEMP%\\lzkmb.exe\" (Handle: 228)\n \"lzkmb.exe\" wrote 52 bytes to a remote process \"%TEMP%\\lzkmb.exe\" (Handle: 228)\n \"lzkmb.exe\" wrote 4 bytes to a remote process \"%TEMP%\\lzkmb.exe\" (Handle: 228)","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"\"http://geoplugin.net/json.gp\" (Indicator: \"geoplugin.net\"; File: \"00000000-00003676.00000001.69682.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 185.16.39.117 on port 1823","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"Spyware/Information Retrieval","name":"Found FTP credentials location strings","description":"\"\\AppData\\Local\\Google\\Chrome\\\" (Indicator: \"\\google\\chrome\\\") in Source: 21533-2346-0040B404\n \"\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Login Data\" (Indicator: \"\\google\\chrome\\\") in Source: 21533-2461-0040A953\n \"\\AppData\\Local\\Google\\Chrome\\User Data\\Default\\Cookies\" (Indicator: \"\\google\\chrome\\\") in Source: 21533-2465-0040A9E2","origin":"File/Memory","mitre_attack_id":"T1552.001","relevance":6,"id":"string-11","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Contains ability to reboot/shutdown the operating system","description":"ExitWindowsEx@USER32.DLL at 00000000-00003172-13943-1-00403640\n ExitWindowsEx@USER32.DLL at 00000000-00003172-15612-1-00403640\n ExitWindowsEx@USER32.DLL at 00000000-00003676-21533-2577-004144DA","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1529","relevance":5,"id":"stream-23","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}],"incidents":[{"name":"Spyware","details_count":5,"details":[{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to open the clipboard"},{"detail":"Contains ability to retrieve keyboard strokes"},{"detail":"Contains ability to read clipboard data"},{"detail":"Found browser information locations related strings"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"Stealer/Phishing","details_count":1,"details":[{"detail":"Found FTP credentials location strings"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"Persistence","details_count":3,"details":[{"detail":"Writes data to a remote process"},{"detail":"Modifies auto-execute functionality by setting/creating a value in the registry"},{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"Fingerprint","details_count":2,"details":[{"detail":"Reads the windows installation language"},{"detail":"Contains ability to retrieve information about the current system"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"Evasive","details_count":4,"details":[{"detail":"Marks file for deletion"},{"detail":"Contains ability to check if a debugger is running"},{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 1 domain and 1 host"}],"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":71,"dropped_files_count":0,"extracted_files_count":6,"files_written_count":11,"files_deleted_count":0,"registry_keys_created_count":2,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":2,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":1,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","credentialharvesting","criminal","remcos","evasive"],"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"63ea2ba05582230ecf6ed99b","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Generic","contacted_countries":["POL"],"submit_name":"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.exe","analysis_start_time":"2023-02-13T12:22:57+00:00","indicators_count":{"informative":75,"suspicious":48,"malicious":12},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"185.16.39.117","port":1823,"protocol":"TCP","country":"Poland","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}],"dns_resolutions":[{"domain":"ucremcz1.ddns.net","address":"185.16.39.117","ttl":60,"country":"Poland","registrar_name":"TLDS LLC. d/b/a SRSPlus","registrar_organization":"No-IP.com","registrar_name_servers":"NF1.NO-IP.COM","registrar_creation_date":"2001-06-28T00:00:00+00:00","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}],"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}],"processes":[{"pid":3172,"ppid":0,"name":"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.exe","command_line":"","sha256":"52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d","normalized_path":"C:\\52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d.exe","uid":"00000000-00003172","icon":"$2c"},{"pid":3340,"ppid":3172,"name":"lzkmb.exe","command_line":"%TEMP%\\knfjha.hh","sha256":"f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4","normalized_path":"%TEMP%\\lzkmb.exe","parent_uid":"00000000-00003172","uid":"00000000-00003340"},{"pid":3676,"ppid":3340,"name":"lzkmb.exe","command_line":"","sha256":"f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4","normalized_path":"%TEMP%\\lzkmb.exe","parent_uid":"00000000-00003340","uid":"00000000-00003676"}],"all_imported_dlls":["sspicli.dll","winnsi.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","oleaut32.dll","devobj.dll","apphelp.dll","wship6.dll","ntdll.dll","shell32.dll","ws2_32.dll","wsock32.dll","rtutils.dll","GdiPlus.dll","psapi.dll","shlwapi.dll","usp10.dll","nsi.dll","fltLib.dll","clbcatq.dll","shfolder.dll","mscms.dll","rasadhlp.dll","iertutil.dll","rpcss.dll","crypt32.dll","mswsock.dll","dnsapi.dll","IPHLPAPI.DLL","KernelBase.dll","setupapi.dll","comdlg32.dll","winmm.dll","gdi32.dll","user32.dll","api-ms-win-core-synch-l1-2-0.dll","kernel32.dll","propsys.dll","advapi32.dll","comctl32.dll","msctf.dll","oleaccrc.dll","urlmon.dll","api-ms-win-downlevel-user32-l1-1-0.dll","api-ms-win-downlevel-version-l1-1-0.dll","sechost.dll","riched20.dll","msasn1.dll","odbcint.dll","wininet.dll","FWPUCLNT.DLL","api-ms-win-downlevel-shlwapi-l1-1-0.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","userenv.dll","cfgmgr32.dll","dwmapi.dll","WSHTCPIP.DLL","imm32.dll","lpk.dll","odbc32.dll","normaliz.dll","ole32.dll","ntmarta.dll","msvcrt.dll","oleacc.dll","Wldap32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","uxtheme.dll","rpcrt4.dll","profapi.dll","cryptbase.dll","version.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"nmdavrpjtcgwp.exe","sha256":"f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"lzkmb.exe","sha256":"f0e9b2a827b79b610136b6bcdd508d0a086f94165ac23eefb1992371076f5dd4","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"knfjha.hh","sha256":"02de3931623e485d24b2adf8b8ccbee8a0998e3110ef6eb46ab1f7e6604f8d6d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"logs.dat","sha256":"fd085bd7ef4cc6de7bed5dd71da3fdd48f341bd61d0a5c661c9f544e5d435eed","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"nsyD03.tmp","sha256":"ad2fe67b4e21afd206ac3a13b69a0c45e53f3c013eb2eaed495eb3be3cfdd77f","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"skdoccs.o","sha256":"ccfc233126a7a6f2968e12428f8a72e552c0a8893532fff88f21e03e5b7c0bd0","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"%TEMP%\\nsiCF2.tmp","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"%TEMP%\\nsyD03.tmp","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"%TEMP%\\nsdD23.tmp","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"C:\\Users","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"%USERPROFILE%\\AppData","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"%LOCALAPPDATA%\\Temp","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"%APPDATA%\\lsoeaawuetxeut\\nmdavrpjtcgwp.exe","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"path":"%APPDATA%\\remcos","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\RMC-X402GF\\\\","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Rmc-X402GF","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]},{"name":"Rmc-X402GF","sources":[{"report_type":"sandbox","report_id":"63ea2ba05582230ecf6ed99b"}]}]}},"report_ids":{"sandbox_job_ids":["63ea2ba05582230ecf6ed99b"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 52d4cc0f07a6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 52d4cc0f07a6…. Malware family: Trojan.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 12 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 52d4cc0f07a6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 52d4cc0f07a6…. Malware family: Trojan.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 12 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/52d4cc0f07a62e6d37c82b33480131cc2c1d5b83d11104997f06cac4d8876f5d"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 52d4cc0f07a6… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 52d4cc0f07a6…. Malware family: Trojan.Generic. Threat score 100/100. 13/28 AV engines flagged this file. 12 malicious and 29 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2d","11",{}]]