26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 59:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4ae,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 59acf4ae2a67… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 59acf4ae2a67…. Malware family: Trojan.Generic. Threat score 100/100. 17/27 AV engines flagged this file. 9 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2"],"about":{"@type":"SoftwareApplication","name":"f45b853c-c9d3-495e-9acb-d41a4a90029f.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":17,"total":27},"behavioralIndicators":{"malicious":9,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T99b,Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStructure" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt16" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadByte" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt32" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadIntPtr" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "Copy" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "PtrToStringUni" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "SizeOf" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "GetLastWin32Error" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "FreeHGlobal" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "AllocHGlobal" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "StringToHGlobalUni" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin" Observed namespace "System.Runtime.InteropServices.Marshal" and TypeReference "ReadInt64" in "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin"28:T1f8e,Found reference to "HMACSHA1" (Indicator: "HMAC"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "HMACSHA1" (Indicator: "HMACSHA1"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "HMACSHA512" (Indicator: "HMAC"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "HMACSHA512" (Indicator: "HMACSHA512"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "HMACSHA512" (Indicator: "SHA512"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "SHA1Managed" (Indicator: "SHA1Managed"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "RijndaelManaged" (Indicator: "Rijndael"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "RijndaelManaged" (Indicator: "RijndaelManaged"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "Rijndael" (Indicator: "Rijndael"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "HashAlgorithm"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "KeyedHashAlgorithm" (Indicator: "KeyedHashAlgorithm"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "CryptographicException" (Indicator: "CryptographicException"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "SHA1CryptoServiceProvider" (Indicator: "SHA1CryptoServiceProvider"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "RNGCryptoServiceProvider" (Indicator: "RNGCryptoServiceProvider"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "DESCryptoServiceProvider"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDES"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "TripleDESCryptoServiceProvider" (Indicator: "TripleDESCryptoServiceProvider"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp")29:T4b9,"" (Indicator: "enumchildwindows"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found reference to API "SendMessage" (Indicator: "sendmessage"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp")30:Teec,"" (Indicator: "GetDC"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found reference to API "CopyFromScreen" (Indicator: "CopyFromScreen"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp")49:T9e4,"" (Indicator: "base64"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "icrosoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found string "SA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found string "Microsoft Enhanced RSA and AES Cryptographic Provider" (Indicator: "aes"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.DoNotAddrOfCspParentWindowHandle" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "Switch.System.Security.Cryptography.UseLegacyFipsThrow" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "Uses RsaCryptoServiceProvider to encrypt and decrypt" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found string "System.Security.Cryptography.SHA1" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aes"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "aescryptoserviceprovider"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "System.Security.Cryptography"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp")4b:T4ae,Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found reference to API "GetModuleHandle" (Indicator: "GetModuleHandle"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp") Found reference to API "EnumProcessModules" (Indicator: "EnumProcessModules"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp")4c:Tde2,Found string "k__BackingField" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "get_password" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "set_password" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "passwordVaultPtr" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "syncpassword" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "password-check" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "password_value" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "\\passwordstorerc" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "password=" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "password" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string ".*\"password\":\"(.*?)\"" (Indicator: "password"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002924.00000000.276141.054C0000.00000004.mdmp") Found string "password_value" (Indicator: "password"; Source: "00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "syncpassword" (Indicator: "password"; Source: "00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "\passwordstorerc" (Indicator: "password"; Source: "00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") file/memory contains long string with (Indicator: "password"; Source: "00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp")4d:Tac2,"Software\Microsoft\Office\11.0\Outlook\Profiles" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "Software\Microsoft\Office\12.0\Outlook\Profiles" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "Software\Microsoft\Office\14.0\Outlook\Profiles" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "Software\Microsoft\Office\15.0\Outlook\Profiles" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "Software\Microsoft\Office\16.0\Outlook\Profiles" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "\VirtualStore\Program Files\Foxmail\mail" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "\VirtualStore\Program Files (x86)\Foxmail\mail" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "\Opera Mail\Opera Mail\wand.dat" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "\Postbox\" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "\Thunderbird\" in Source: 59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin "\\Claws-mail" in Source: 60000a5-hdYUG~Grab "Software\\Microsoft\\Office\\11.0\\Outlook\\Profiles" in Source: 6000102-rl5gxTYGY~Grab "Software\\Microsoft\\Office\\12.0\\Outlook\\Profiles" in Source: 6000102-rl5gxTYGY~Grab "Software\\Microsoft\\Office\\14.0\\Outlook\\Profiles" in Source: 6000102-rl5gxTYGY~Grab "Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles" in Source: 6000102-rl5gxTYGY~Grab "Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles" in Source: 6000102-rl5gxTYGY~Grab "\\Opera Mail\\Opera Mail\\wand.dat" in Source: 6000110-LGBZ4N2f~Grab "\\Pocomail\\accounts.ini" in Source: 6000116-nWe~Grab "\\Postbox\\" in Source: 6000183-EcXJPSf30~of0po "\\Thunderbird\\" in Source: 6000183-EcXJPSf30~of0po "\Postbox\" in Source: 00000000-00002924.00000001.278060.054C0000.00000004.mdmp 00000000-00002924.00000003.285483.054C0000.00000004.mdmp "\Thunderbird\" in Source: 00000000-00002924.00000001.278060.054C0000.00000004.mdmp 00000000-00002924.00000003.285483.054C0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\" in Source: 00000000-00002924.00000001.278060.054C0000.00000004.mdmp 00000000-00002924.00000003.285483.054C0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Postbox\" in Source: 00000000-00002924.00000001.278060.054C0000.00000004.mdmp 00000000-00002924.00000003.285483.054C0000.00000004.mdmp "C:\Users\HAPUBWS\AppData\Roaming\Thunderbird\profiles.ini" in Source: 00000000-00002924.00000001.278060.054C0000.00000004.mdmp 00000000-00002924.00000003.285483.054C0000.00000004.mdmp4e:T7e4,Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "SELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "Select * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "Select * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.0316A000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.0316A000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.0316A000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "SELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "ELECT * FROM Win32_VideoController" (Indicator: " Win32_VideoController"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp") Found string "elect * from Win32_ComputerSystem" (Indicator: " Win32_ComputerSystem"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Process"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp") Found string "ELECT * FROM Win32_Processor" (Indicator: " Win32_Processor"; Source: "00000000-00002924.00000003.285483.00BA2000.00000002.mdmp")4f:Ta8b,"\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "\VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "\VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "\VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "\cftp\Ftplist.txt" (Indicator: "ftplist.txt") "\FTPGetter\servers.xml" (Indicator: "\ftpgetter") "quick.dat" (Indicator: "quick.dat") "FTP Navigator" (Indicator: "ftp navigator") "\\FTP Navigator\\Ftplist.txt" (Indicator: "ftp navigator") "\\FTP Navigator\\Ftplist.txt" (Indicator: "ftplist.txt") "\\VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftp commander") "\\VirtualStore\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftplist.txt") "\\VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftp commander") "\\VirtualStore\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftplist.txt") "\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftp commander") "\\Program Files (x86)\\FTP Commander\\Ftplist.txt" (Indicator: "ftplist.txt") "\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftp commander") "\\Program Files (x86)\\FTP Commander Deluxe\\Ftplist.txt" (Indicator: "ftplist.txt") "\\cftp\\Ftplist.txt" (Indicator: "ftplist.txt") "\\FTPGetter\\servers.xml" (Indicator: "\ftpgetter") "FTP Navigator\Ftplist.txt" (Indicator: "ftp navigator") "FTP Navigator\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftp commander") "VirtualStore\Program Files (x86)\FTP Commander\Ftplist.txt" (Indicator: "ftplist.txt") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftp commander") "Program Files (x86)\FTP Commander Deluxe\Ftplist.txt" (Indicator: "ftplist.txt") "cftp\Ftplist.txt" (Indicator: "ftplist.txt")50:T8ab,Found string "\Device\LanmanRedirector\" (Indicator: "\Device\"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "\\drivers\\etc\\hosts" (Indicator: "\drivers\"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string "\\Device\\LanmanRedirector\\" (Indicator: "\Device\"; File: "59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "\drivers\"; Source: "00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.031A3000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.031A3000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.031A3000.00000004.mdmp") Found string "%SystemRoot%\System32\drivers\etc" (Indicator: "system32\drivers"; Source: "00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.031A3000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.031A3000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.031A3000.00000004.mdmp") Found string "\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "C:\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp") Found string "Could not find a part of the path 'C:\drivers\etc\hosts'." (Indicator: "\drivers\"; Source: "00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp")51:T802,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Observed namespace \"System.Security.Cryptography\" and MemberReference \"TransformFinalBlock\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\.\\root\\cimv2; Source: \"00000000-00002924.00000000.276141.030C0000.00000004.mdmp, 00000000-00002924.00000001.278060.030C0000.00000004.mdmp, 00000000-00002924.00000002.279980.030C0000.00000004.mdmp, 00000000-00002924.00000003.285483.030C0000.00000004.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")\n Found string - \\\\.\\root\\c\n; Source: \"00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")\n Found string - \\\\.\\root\\c; Source: \"00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$29","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2a","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Able to detect if debugger is present","description":"Observed API \"CheckRemoteDebuggerPresent\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1622","relevance":1,"id":"static-220","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"CheckRemoteDebuggerPresent\" (Indicator: \"CheckRemoteDebuggerPresent\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002924.00000000.276141.054C0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Observed function \"ToBase64String\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found api reference \"BCryptImportKey\" (Indicator: \"BCryptImportKey\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/decrypt data using TripleDES","description":"Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"TripleDESCryptoServiceProvider\" (Indicator: \"TripleDESCryptoServiceProvider\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-486","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002924.00000000.276141.054C0000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.RijndaelManaged\" and TypeReference \".ctor\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Observed namespace \"System.Security.Cryptography.TripleDESCryptoServiceProvider\" and TypeReference \".ctor\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Observed namespace \"System.Security.Cryptography.DESCryptoServiceProvider\" and TypeReference \".ctor\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Observed namespace \"System.Security.Cryptography.Rijndael\" and TypeReference \"Create\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric encryption (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateEncryptor\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-165","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"[PRIVATE KEY LOCATION: \\\"{0}\\\"]\" (Indicator: \"private key\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")\n Found string \"PRIVATE KEY LOCATION: \"{0}\"]\" (Indicator: \"private key\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Dotnet code contains ability to generate random numbers","description":"Observed namespace \"System.Security.Cryptography.RNGCryptoServiceProvider\" and TypeReference \".ctor\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Observed namespace \"System.Security.Cryptography.RandomNumberGenerator\" and TypeReference \"GetBytes\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-150","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"Keep\" in header \"GET /line/?fields=hosting HTTP/1.1Host: ip-api.comConnection: Keep-Alive\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$2e","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 168279; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002924-00000C2C-3249619699\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetFiles\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Observed dotnet function \"GetDirectories\" in \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"get_UserName\" (Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002924-00000C2C-3249619699\")\n Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found string \"GetLastInputInfo\" (Indicator: \"GetLastInputInfo\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"ProcessIdToSessionId\" (Indicator: \"ProcessIdToSessionId\"; Source: \"00000000-00002924-00000C2C-3253755178\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00002924-00000C2C-3248071251\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00002924-00000C2C-3248071724\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"GetAddrInfoW\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00002924-00000C2C-3253200259\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"NtQuerySystemInformation\" in file \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Found system information discovery API: \"NtQuerySystemInformation\" in \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nDate: Sat\n 21 Mar 2026 14:24:43 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 6\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>66616C73650A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$3d","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002924.00000000.276141.054C0000.00000004.mdmp, 00000000-00002924.00000001.278060.054C0000.00000004.mdmp, 00000000-00002924.00000003.285483.054C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueEx\" in file \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Found registry query API: \"RegOpenKeyEx\" in file \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\"\n Found registry query API: \"RegQueryValueEx\" in \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\"\n Found registry query API: \"RegOpenKeyEx\" in \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; File: \"59acf4ae2a676101f77b8fe254a6c9f488f126bcc879d1b86fec7860a0e539d2.bin\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")\n Found reference to API \"GetKeyState\" (Indicator: \"GetKeyState\"; Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"get_ProcessName\" (Source: \"00000000-00002924.00000003.285483.00BA2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$49","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69beaa08bdadce4db50b07ee"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"