21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 35:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4fc,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_90% Sample 5a4ae73d9dea… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5a4ae73d9dea…. Malware family: Win/malicious_confidence_90%. Threat score 100/100. 3/27 AV engines flagged this file. 2 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a","keywords":["Malicious","Win/malicious_confidence_90%","malware analysis","sandbox report","threat intelligence","5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a"],"about":{"@type":"SoftwareApplication","name":"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin","applicationCategory":["peexe","64bits","executable"],"identifier":"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_90%","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":2,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3eId3d3d3d3dwAAd3d3eHd3+Ih3h3d3d3cAAHd3d3iHd4d4d4d3d3d3AAB3d3d/iHeHeIf4h3d3dwAAd3d3eHiHh3iHh3d3d3cAAHd3d3iIh4iId4d3d3d3AAB3d3d4iHeIh3eIh3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAD//////////////////wAA//////////////////8AAP/////4////////////AAD/////h4///////////wAA////+Hh4//////////8AAP////+HeP//////////AAD/////+HeI///4/////wAA//////+Id4iId4////8AAP//////+HiHd3d4////AAD///////94+HiIj////wAA////////iIeP//////8AAP///////4eH////////AAD////////3eP///////wAA////////+H////////8AAP///////4d/////////AAD///////+HeP/4iIiIiAAA////////h3j/+IiIiIgAAP///////4eP//iIiIiAAAD////////4///4iIiIAAAA////////////+IiIgAAAAP////////////iIiAAAAAD////////////4iIAAAADgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAA/gAAAf4AAAP+AAAH/gAAD/4AAB/w==23:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAHd3d3d3d3d3d3d3d3d3AAB3d3d3d3eId3d3d3d3dwAAd3d3eHd3+Ih3h3d3d3cAAHd3d3iHd4d4d4d3d3d3AAB3d3d/iHeHeIf4h3d3dwAAd3d3eHiHh3iHh3d3d3cAAHd3d3iIh4iId4d3d3d3AAB3d3d4iHeIh3eIh3d3dwAAd3d3d3d3d3d3d3d3d3cAAHd3d3d3d3d3d3d3d3d3AAD//////////////////wAA//////////////////8AAP/////4////////////AAD/////h4///////////wAA////+Hh4//////////8AAP////+HeP//////////AAD/////+HeI///4/////wAA//////+Id4iId4////8AAP//////+HiHd3d4////AAD///////94+HiIj////wAA////////iIeP//////8AAP///////4eH////////AAD////////3eP///////wAA////////+H////////8AAP///////4d/////////AAD///////+HeP/4iIiIiAAA////////h3j/+IiIiIgAAP///////4eP//iIiIiAAAD////////4///4iIiIAAAA////////////+IiIgAAAAP////////////iIiAAAAAD////////////4iIAAAADgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAAfgAAAH4AAAB+AAAA/gAAAf4AAAP+AAAH/gAAD/4AAB/w==24:T875,Found reference to "forHKDF" (Indicator: "HKDF"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "*hmac.HMAC" (Indicator: "HMAC"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "HMAC"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Sum" (Indicator: "HMAC"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Write" (Indicator: "HMAC"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).BlockSize" (Indicator: "HMAC"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "crypto/internal/fips140/hmac.(*HMAC).Reset" (Indicator: "HMAC"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "HMACSHA256" (Indicator: "HMAC"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "AesManaged" (Indicator: "Aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "AesManaged" (Indicator: "AesManaged"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "CryptoStream" (Indicator: "CryptoStream"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")25:T927,"ed negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximumGODEBUG=execwait=2 detected a leaked exec.Cmd created by:tried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-ma" in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin "System\CurrentControlSet\Control\MediaCategories" in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin "ed negative count from Readinternal error: negative process handle reference countmheap.freeSpanLocked - invalid free of user arena chunkcasfrom_Gscanstatus:top gp->status is not in scan state is currently not supported for use in system callbacksSOFTWARE\Microsoft\Windows NT\CurrentVersion\Time Zonesstrings: illegal use of non-zero Builder copied by valuefailed to allocate aligned heap memory; too many retriesprofilealloc called without a P or outside bootstrappingdetected possible issues with cleanups and/or finalizersin gcMark expecting to see gcphase as _GCmarkterminationruntime: NtAssociateWaitCompletionPacket failed; errno= cannot run executable found relative to current directory (set GODEBUG=execwait=2 to capture stacks for debugging)runtime: checkmarks found unexpected unmarked object obj=crypto/drbg: internal error: request size exceeds maximumGODEBUG=execwait=2 detected a leaked exec.Cmd created by:tried to trace goroutine with invalid or unsupported statusmanual span allocation called with non-m" in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin26:T44b,file/memory contains long string with (Indicator: "WaitForSingleObject"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "GetSystemTimeAsFileTime"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "SetWaitableTimer"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "syscall.WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "SetWaitableTimer" (Indicator: "SetWaitableTimer"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")27:T8b2,Found string - ep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base hangupkilledlistensocketSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13rdtscppopcntuint16uint32uint64stringstructcmd/gonetdnsAES-NIsha256SHA-NIsha512CommonconsolePATHEXT\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type abortedCopySidWSARecvWSASendconnectsignal TuesdayJanuaryOctoberMUI_StdMUI_Dltfips140avx512finvaliduintptrfloat32float64runtimeos/exectls3destlssha1net/urlAES-CBCfile+netFullPathscavengepollDescsynctesttraceBufdeadlockraceFinipanicnilcgocheckrunnablerax rbx rcx rdx rdi rsi rbp rsp r8 r9 r10 r11 r12 r13 r14 r15 rip rflags cs fs gs i; Source: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string - ep B -> % util alloc free span= prev= list= i = code= addr= m->p= p->m=SCHED curg= ctxt: min= max= bad ts(...) m=nil base hangupkilledlistensocketSundayMondayFridayAugustUTC-11UTC-02UTC-08UTC-09UTC+12UTC+13rdtscppopcntuint16uint32uint64stringstructcmd/gonetdnsAES-NIsha256SHA-NIsha512CommonconsolePATHEXT\\.\UNCforcegcallocmWcpuprofallocmRunknowngctraceIO waitrunningsyscallwaitingforevernetworkUNKNOWNcleanup:events goid= mark s=nil (scan MB in pacer: % CPU ( zombiegc bits, j0 = head = panic: GODEBUG nmsys= locks= dying= allocs m->g0= pad1= pad2= text= minpc= value= (scan)types : type abortedCopySidWSARecvWSASendconnectsignal TuesdayJanuaryOctoberMUI_StdMUI_Dltfips140avx512finvaliduintptrfloat32float64runtimeos/exectls3destlssha1net/urlAES-CBCfile+netFullPathscavengepollDescsynctesttraceBufdeadlockraceFinipanicnilcgocheckrunnablerax rbx rcx rdx rdi rsi rbp rsp r8 r9 r10 r11 r12 r13 r14 r15 rip rflags cs fs gs; Source: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")28:Tb38,Found XOR loop in file "sample.bin" at offset 86514; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 279852; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1488085; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1594508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1600940; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1947754; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1884909; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1885137; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1929499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2442834; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 2181626; code bytes = 30040e Found XOR loop in file "sample.bin" at offset 185142; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 223721; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224081; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 224481; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 226643; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 249969; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 270096; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 419877; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 420573; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 421214; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 431593; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1150160; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1325592; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1595904; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1716984; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1819575; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1919660; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2198266; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2228628; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2397848; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2400062; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2400350; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2400938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2405456; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2551451; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2551667; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 2647717; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 3017624; code bytes = 803029:T2ab6,Found reference to API (Indicator: "WSAIoctl"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetFileType"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetFileInformationByHandle"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "CoCreateInstance"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetProcAddress"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetDesktopWindow"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "LoadLibrary"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "FreeLibrary"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetProcessId"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetLength"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "Sleep"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "QueueUserWorkItem"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetWindowThreadProcessId"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetProcessById"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "ExitThread"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "PostMessage"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetEnvironmentVariable"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "IsWindowVisible"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetTempPath"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetWindowTextLength"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "ExtractAssociatedIcon"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SystemParametersInfo"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetConsoleCtrlHandler"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetCursorPos"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "NtSetInformationProcess"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "EnumWindows"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetObject"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SendInput"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetWindowText"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetWindowText"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetForegroundWindow"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetForegroundWindow"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "ShowWindow"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "MessageBox"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "CreateDirectory"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "WriteFile"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "WriteConsoleW"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "WerSetFlags"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "WerGetFlags"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "WaitForMultipleObjects"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "WaitForSingleObject"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "VirtualQuery"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "VirtualFree"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "VirtualAlloc"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "TlsAlloc"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SwitchToThread"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SuspendThread"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetWaitableTimer"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetProcessPriorityBoost"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetEvent"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetErrorMode"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "RtlVirtualUnwind"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "RtlLookupFunctionEntry"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "ResumeThread"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "RaiseFailFastException"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "PostQueuedCompletionStatus"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "LoadLibraryW"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "LoadLibraryExW"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "SetThreadContext"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetThreadContext"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetSystemDirectoryA"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetStdHandle"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetQueuedCompletionStatusEx"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetErrorMode"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetEnvironmentStringsW"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetCurrentThreadId"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "GetConsoleMode"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "FreeEnvironmentStringsW"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "ExitProcess"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "CreateWaitableTimerExW"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "CreateThread"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "CreateIoCompletionPort"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "CreateEventA"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "CloseHandle"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "AddVectoredExceptionHandler"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "AddVectoredContinueHandler"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API (Indicator: "VirtualProtect"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")2a:T400,Found string "C:\Users\markh\code\mygithub\NAudio\NAudio\obj\Release\net472\NAudio.pdb" (Indicator: "github\"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "C:\Users\markh\code\mygithub\NAudio\NAudio.Asio\obj\Release\netstandard2.0\NAudio.Asio.pdb" (Indicator: "github\"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "C:\Users\markh\code\mygithub\NAudio\NAudio.Core\obj\Release\netstandard2.0\NAudio.Core.pdb" (Indicator: "github\"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "C:\Users\markh\code\mygithub\NAudio\NAudio.Midi\obj\Release\netstandard2.0\NAudio.Midi.pdb" (Indicator: "github\"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "C:\Users\markh\code\mygithub\NAudio\NAudio.Wasapi\obj\Release\netstandard2.0\NAudio.Wasapi.pdb" (Indicator: "github\"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")2b:T66d,Heuristic match: "*abi.name" Heuristic match: "*godebugs.info" Pattern match: "https://go.dev/issue/66821" Heuristic match: "internal/abi.name.name" Heuristic match: "type:.eq.internal/godebugs.info" Heuristic match: "runtime.(*bucket).mp" Heuristic match: "runtime.(*polldesc).info" Heuristic match: "runtime.srcfunc.name" Heuristic match: "errors.is" Pattern match: "eq.sync/atomic.bool" Pattern match: "eq.sync/atomic.int32" Pattern match: "eq.sync/atomic.uint32" Pattern match: "eq.sync/atomic.uint64" Heuristic match: "sync.(*once).do" Pattern match: "eq.sync/atomic.pointer[sync.poolchainelt" Pattern match: "eq.sync/atomic.pointer[internal/sync.indirect[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.node[interface" Pattern match: "eq.sync/atomic.pointer[internal/sync.entry[go.shape.interface" Pattern match: "eq.sync/atomic.pointer[go.shape.struct" Pattern match: "eq.sync/atomic.pointer[internal/bisect.dedup" Heuristic match: "internal/godebug.(*setting).name" Pattern match: "eq.sync/atomic.pointer[internal/godebug.value" Heuristic match: "syscall.errno.is" Heuristic match: "syscall.(*errno).is" Pattern match: "eq.io/fs.patherror" Pattern match: "eq.sync/atomic.pointer[os.dirinfo" Heuristic match: "unicode.to" Pattern match: "eq.os/exec.error" Pattern match: "eq.os/exec.wrappederror" Pattern match: "eq.os/exec.ctxresult" Heuristic match: "os.(*file).name" Heuristic match: "!naudio, an audio library for .net" Pattern match: "https://github.com/naudio/naudio" Heuristic match: "an audio library for .net"2c:T49b,Found reference to API "SetsockoptInt" (Indicator: "setsockopt"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "SetsockoptIPMreq" (Indicator: "setsockopt"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "SetsockoptLinger" (Indicator: "setsockopt"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "SetsockoptIPv6Mreq" (Indicator: "setsockopt"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "SetsockoptInet4Addr" (Indicator: "setsockopt"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "setsockopt"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "syscall.Setsockopt" (Indicator: "setsockopt"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "syscall.SetsockoptInt" (Indicator: "setsockopt"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")2d:Te5e,Found string "chacha8" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "*aes.CTR" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "*aes.Block" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "*aes.block" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "*aes.KeySizeError" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "*chacha8rand.State" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "*aes.blockExpanded" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "internal/chacha8rand" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "crypto/internal/fips140/aes" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "3des"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "internal/chacha8rand.(*State).Init" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "internal/chacha8rand.(*State).Init64" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "internal/chacha8rand.(*State).Refill" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "internal/chacha8rand.(*State).Reseed" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "internal/chacha8rand.(*State).Next" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "internal/chacha8rand.block" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "type:.eq.internal/chacha8rand.State" (Indicator: "chacha"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "runtime.initAlgAES" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "aeshashbody" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "crypto/internal/fips140/aes.init" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "crypto/internal/fips140/aes.KeySizeError.Error" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "crypto/internal/fips140/aes.newOutlined" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "crypto/internal/fips140/aes.newOutlined" (Indicator: "aes.new"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "crypto/internal/fips140/aes.(*Block).BlockSize" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found string "crypto/internal/fips140/aes.init.0" (Indicator: "aes"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")2e:T866,file/memory contains long string with (Indicator: "Module32Next"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "Module32First"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "Process32Next"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "Process32First"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "GetModuleHandle"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "GetCurrentProcess"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "GetEnvironmentStrings"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") file/memory contains long string with (Indicator: "CreateToolhelp32Snapshot"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "syscall.GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "syscall.GetEnvironmentStrings" (Indicator: "GetEnvironmentStrings"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")2f:T488," work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreEaster Island Standard Timehttpservecontentkeepheadersos: process already finishedGetFileInformationByHandleExGC ma" (Indicator: "CertEnumCertificatesInStore"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin"), Found api reference "rk assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largefile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time zone "crypto/aes: counter overflowfips140: verified cod" (Indicator: "CertCreateCertificateContext"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyuse of closed network connection" not supported for cpu option "initial table capacity too largesubtle.XORBytes: invalid overlapbytes.Buffer.Grow: negative countskip everything and stop the walkGetVolumeNameForVolumeMountPointWslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap" (Indicator: "CertAddCertificateContextToStore"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyuse of closed network connection" not supported for cpu option "initial table capacity too largesubtle.XORBytes: invalid overlapbytes.Buffer.Grow: negative countskip everything and stop the walkGetVolumeNameForVolumeMountPointWslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/heap" (Indicator: "CertVerifyCertificateChainPolicy"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largelevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unreachable: unsafe.Pointercrypto/fips140mime/multipartx509sha256skidRegSetValueExWGetProcessTimesDuplicateHandleImpersonateSelfOpenThreadTokencomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecove" (Indicator: "CertCloseStore"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "no deferreturnbad restart PC-thread limitstopm spinning nmidlelocked= needspinning= schedticks=[ randinit twicestore64 failedsemaRoot queuebad allocCountbad span statestack overflow untyped args out of range no module data in goroutine runtime: seq1=runtime: goid=file too largelevel 2 haltedlevel 3 haltedtoo many linksno such deviceprotocol errortext file busytoo many usersCryptGenRandomCertCloseStoreCreateProcessWFindFirstFileWFormatMessageWGetConsoleModeGetProcAddressProcess32NextWSetFilePointerNetUserGetInfoGetUserNameExWTranslateNameWgetprotobyname procedure in winapi error #unreachable: unsafe.Pointercrypto/fips140mime/multipartx509sha256skidRegSetValueExWGetProcessTimesDuplicateHandleImpersonateSelfOpenThreadTokencomputeMaxProcsupdateMaxProcsGallocmRInternalGC (fractional)write heap dumpasyncpreemptoffcheckfinalizersforce gc (idle)sync.Mutex.Lockruntime.Goschedmalloc deadlockruntime error: scan missed a gmisaligned maskruntime: min = runtime: inUse=runtime: max = requested skip=bad panic stackrecove" (Indicator: "CryptGenRandom"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "mstartm not found in allmstopm holding lockssemaRoot rotateLeftbad notifyList sizeruntime: preempt g0runtime: pcdata is bad ABI descriptionillegal instructionbad file descriptordisk quota exceededtoo many open filesdevice not a streamdirectory not emptyCryptReleaseContextGetTokenInformationCreateSymbolicLinkWGetCurrentProcessIdEgypt Standard TimeSudan Standard TimeLibya Standard TimeBahia Standard TimeHaiti Standard TimeYukon Standard TimeAltai Standard TimeIndia Standard TimeSyria Standard TimeRussia Time Zone 11Nepal Standard TimeKorea Standard TimeChina Standard TimeRussia Time Zone 10Tokyo Standard TimeTomsk Standard TimeSamoa Standard TimeTonga Standard Timefile already existsfile does not existfile already closedembedfollowsymlinksgotestjsonbuildtextmultipartmaxheadersinvalid write resultGetAdaptersAddressesNtSetInformationFileRtlIsDosDeviceName_UGetProcessMemoryInfobcryptprimitives.dllfloating point errorGC sweep terminationResetDebugLog (test)chan send (nil chan)flushing proc cachesclose of nil chann" (Indicator: "CryptReleaseContext"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "linconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timehttplaxcontentlengthx509usefallbackrootssha3: Sum after Readexec: already startedAdjustTokenPrivilegesLookupPrivilegeValueWNetUserGetLocalGroupsGetProfilesDirecto" (Indicator: "CertOpenSystemStoreW"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "linconsistent lockedmnotetsleep not on g0bad system page size to unallocated span/gc/scan/stack:bytes/gc/scan/total:bytes/gc/heap/frees:bytes/gc/gomemlimit:bytesp mcache not flushed markroot jobs donepacer: assist ratio=workbuf is not emptybad use of bucket.mpbad use of bucket.bpruntime: double waitpreempt off reason: forcegc: phase errorgopark: bad g statusgo of nil func valueselectgo: bad wakeupsemaRoot rotateRightreflect.makeFuncStubtrace: out of memorywirep: already in goinvalid request codebad font file formatis a named type filekey has been revokedconnection timed outCreateProcessAsUserWCryptAcquireContextWCertOpenSystemStoreWGetCurrentDirectoryWGetFileAttributesExWSetCurrentDirectoryWSetHandleInformationGetAcceptExSockaddrsJordan Standard TimeArabic Standard TimeIsrael Standard TimeTaipei Standard TimeAzores Standard TimeTurkey Standard Timehttplaxcontentlengthx509usefallbackrootssha3: Sum after Readexec: already startedAdjustTokenPrivilegesLookupPrivilegeValueWNetUserGetLocalGroupsGetProfilesDirecto" (Indicator: "CryptAcquireContextW"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "not g0schedule: holding locksprocresize: invalid argspan has no free stacksstack growth after forkshrinkstack at bad timereflect.methodValueCalldevice or resource busyinterrupted system callno space left on deviceoperation not supportedoperation not permittedCertGetCertificateChainFreeEnvironmentStringsWGetEnvironmentVariableWGetSystemTimeAsFileTimeSetEnvironmentVariableWE. Africa Standard TimeTocantins Standard TimeArgentina Standard TimeVenezuela Standard TimeGreenland Standard TimeSri Lanka Standard TimeWest Bank Standard TimeQyzylorda Standard TimeSingapore Standard TimeWest Asia Standard TimeGreenwich Standard TimeLord Howe Standard TimeAstrakhan Standard TimeW. Europe Standard TimeE. Europe Standard TimeVolgograd Standard TimeMauritius Standard TimeMarquesas Standard Time" not found in registrybytes.Buffer: too large", missing CPU supportexit hook invoked panicpattern bits too long: exec: Stdout already settracecheckstackownershiphash of unhashable type span has no free objectsruntime: found obj at *(" (Indicator: "CertGetCertificateChain"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "untime: VirtualFree of /cgo/go-to-c-calls:calls/gc/heap/objects:objects/sched/latencies:secondsqueuefinalizer during GCcheckfinalizers: queue: update during transitionruntime: markroot index can't scan our own stackgcDrainN phase incorrectpageAlloc: out of memoryruntime: p.searchAddr = range partially overlaps [recovered, repanicked]stack trace unavailablebindm in unexpected GOOSruntime: mp.lockedInt = runqsteal: runq overflowgoroutine stack (system)unexpected syncgroup setdouble traceGCSweepStartbad use of trace.seqlockfloating point exceptionconnection reset by peerlevel 2 not synchronizedlink number out of rangeout of streams resourcesfunction not implementedstructure needs cleaningnot supported by windowsCertFreeCertificateChainCreateToolhelp32SnapshotGetUserProfileDirectoryWSA Pacific Standard TimeSA Eastern Standard TimeUS Eastern Standard TimeSA Western Standard TimeMontevideo Standard TimeMagallanes Standard TimePacific SA Standard TimeAzerbaijan Standard TimeBangladesh Standard TimeNorth Asia Stand" (Indicator: "CertFreeCertificateChain"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "ral Standard TimeAUS Eastern Standard TimeKaliningrad Standard TimeNew Zealand Standard Time2006-01-02T15:04:05Z07:00testing simulated failureGODEBUG: can not enable "hash of unhashable type: unexpected key value typeExpandEnvironmentStringsWGetFileInformationByHandleSetFileInformationByHandleRtlNtStatusToDosErrorNoTeball goroutines stack traceGC background sweeper waitcall from unknown functionnotewakeup - double wakeuppersistentalloc: size == 0/gc/cycles/total:gc-cyclesbad type kind in finalizernegative idle mark workersuse of invalid sweepLockerruntime: bad span s.state=forEachP: P did not run fnwakep: negative nmspinningstartlockedm: locked to meinittask with no functionscorrupted semaphore ticketout of memory (stackalloc)shrinking stack in libcallruntime: pcHeader: magic= traceRegion: out of memoryinvalid request descriptorno CSI structure availablerequired key not availableno message of desired typename not unique on networkCertFreeCertificateContextPostQueuedCompletionStatusSouth Africa Standard TimeS" (Indicator: "CertFreeCertificateContext"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin"), Found api reference "unlock: lock countprogToPointerMask: overflow/gc/cycles/forced:gc-cycles/memory/classes/other:bytes/memory/classes/total:bytesfailed to set sweep barrierwork.nwait was > work.nproc not in stack roots range [allocated pages below zero?address not a stack addressmspan.sweep: bad span stateinvalid profile bucket typeruntime: corrupted polldescruntime: netpollinit failedruntime: asyncPreemptStack=runtime: thread ID overflowstopTheWorld: holding locksgcstopm: not waiting for gcruntime: checkdead: nmidle=runtime: checkdead: find g runlock of unlocked rwmutexsigsend: inconsistent statemakeslice: len out of rangemakeslice: cap out of rangegrowslice: len out of rangestack size not a power of 2too many callback functionstimer when must be positive: unexpected return pc for channel number out of rangecommunication error on sendkey was rejected by servicenot a XENIX named type fileCertEnumCertificatesInStoreEaster Island Standard Timehttpservecontentkeepheadersos: process already finishedGetFileInformationByHandleExGC m" (Indicator: "CertEnumCertificatesInStore"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin"), Found api reference "rk assist wait for workcomparing uncomparable type region exceeds uintptr range/gc/heap/frees-by-size:bytes/gc/heap/tiny/allocs:objects/sched/goroutines:goroutinesgcBgMarkWorker: mode not setmspan.sweep: m is not lockedfound pointer to free objectmheap.freeSpanLocked - span runtime.semasleep unexpectedfatal: morestack on gsignalruntime: casgstatus: oldval=gcstopm: negative nmspinningfindrunnable: netpoll with psave on system g not allowednewproc1: newg missing stacknewproc1: new g is not GdeadFixedStack is not power-of-2missing stack in shrinkstack args stack map entries for invalid runtime symbol tableruntime: no module data for mismatched isSending updates[originating from goroutine traceRegion: alloc too largefile descriptor in bad statedestination address requiredprotocol driver not attachedCertCreateCertificateContextCanada Central Standard TimeCen. Australia Standard TimeAus Central W. Standard TimeCentral Europe Standard TimeEnglish name for time zone "crypto/aes: counter overflowfips140: verified co" (Indicator: "CertCreateCertificateContext"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyuse of closed network connection" not supported for cpu option "initial table capacity too largesubtle.XORBytes: invalid overlapbytes.Buffer.Grow: negative countskip everything and stop the walkGetVolumeNameForVolumeMountPointWslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/hea" (Indicator: "CertAddCertificateContextToStore"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin") Found api reference "_cgo_pthread_key_created missingruntime: sudog with non-nil elemruntime: sudog with non-nil nextruntime: sudog with non-nil prevruntime: mcall function returnedruntime: newstack called from g=runtime: stack split at bad timepanic while printing panic valueruntime: setevent failed; errno=runtime.semasleep wait_abandonedresource temporarily unavailablesoftware caused connection abortnumerical argument out of domainCertAddCertificateContextToStoreCertVerifyCertificateChainPolicyuse of closed network connection" not supported for cpu option "initial table capacity too largesubtle.XORBytes: invalid overlapbytes.Buffer.Grow: negative countskip everything and stop the walkGetVolumeNameForVolumeMountPointWslice bounds out of range [%x:%y]base outside usable address spaceruntime: memory allocated by OS [misrounded allocation in sysAllocruntime: failed to decommit pages/cpu/classes/gc/pause:cpu-seconds/cpu/classes/gc/total:cpu-seconds/gc/limiter/last-enabled:gc-cycle/memory/classes/heap/stacks:bytes/memory/classes/hea" (Indicator: "CertVerifyCertificateChainPolicy"; File: "5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin")34:T115b,Observed string: "crypto/rand" (Indicator: "crypto/rand") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/impl" (Indicator: "crypto/internal/impl") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/fips140/aes" (Indicator: "crypto/internal/fips140/aes") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/fips140/drbg" (Indicator: "crypto/internal/fips140/drbg") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/fips140/sha3" (Indicator: "crypto/internal/fips140/sha3") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/fips140/hmac" (Indicator: "crypto/internal/fips140/hmac") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/fips140/sha256" (Indicator: "crypto/internal/fips140/sha256") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/fips140/sha512" (Indicator: "crypto/internal/fips140/sha512") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/rand.fatal" (Indicator: "crypto/rand.fatal") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/sysrand.fatal" (Indicator: "crypto/internal/sysrand.fatal") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/fips140deps/cpu.init" (Indicator: "crypto/internal/fips140deps/cpu.init") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/impl.Register" (Indicator: "crypto/internal/impl.Register") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "type:.eq.crypto/internal/impl.implementation" (Indicator: "type:.eq.crypto/internal/impl.implementation") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "type:.eq.crypto/internal/fips140/sha256.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha256.Digest") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "type:.eq.crypto/internal/fips140/sha3.Digest" (Indicator: "type:.eq.crypto/internal/fips140/sha3.Digest") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/sysrand.warnBlocked" (Indicator: "crypto/internal/sysrand.warnBlocked") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/sysrand.Read" (Indicator: "crypto/internal/sysrand.Read") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/sysrand.read" (Indicator: "crypto/internal/sysrand.read") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/sysrand.Read.deferwrap1" (Indicator: "crypto/internal/sysrand.Read.deferwrap1") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/entropy.Depleted" (Indicator: "crypto/internal/entropy.Depleted") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/fips140only.init" (Indicator: "crypto/internal/fips140only.init") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/internal/boring/sig.StandardCrypto" (Indicator: "crypto/internal/boring/sig.StandardCrypto") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/rand.init.0" (Indicator: "crypto/rand.init.0") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin Observed string: "crypto/rand.(*reader).Read" (Indicator: "crypto/rand.(*reader).Read") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin, Observed string: "crypto/internal/boring.Unreachable" (Indicator: "crypto/internal/boring.Unreachable") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":["rat","njrat"],"file_activity":{"dropped_files":[],"extracted_files":[],"files_deleted":[],"files_written":[]},"mutex_activity":{"mutex_created":[]},"network_activity":{"contacted_hosts":[],"dns_resolutions":[],"http_requests":[]},"process_activity":{"all_imported_dlls":["KernelBase.dll","apphelp.dll","ntdll.dll","kernel32.dll"],"processes":[{"command_line":"","icon":"$22","name":"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin.exe","normalized_path":"C:\\5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin.exe","pid":6064,"ppid":0,"sha256":"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a","uid":"00000000-00006064"},{"command_line":"-u -p 6064 -s 132","name":"WerFault.exe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","parent_uid":"00000000-00006064","pid":2604,"ppid":6064,"sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","uid":"00000000-00002604"},{"command_line":"-pss -s 464 -p 6064 -ip 6064","icon":"$23","name":"WerFault.exe","normalized_path":"%WINDIR%\\system32\\WerFault.exe","pid":2260,"ppid":0,"sha256":"0476d175606aac098363c328166a33f85b7efc2d0be82c0d80ba406113affbfe","uid":"00000000-00002260"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[],"keys_modified":[]},"sample_flags":["Sample Crashed"],"sandbox_reports":[{"analysis_start_time":"2026-02-14T23:54:17+00:00","environment_description":"Windows 10 64 bit","environment_id":160,"id":"69910b2802b6acff0a0a66fc","indicators_count":{"informative":130,"malicious":2,"suspicious":11},"is_in_unified_schema":true,"malware_family":"Trojan_Win32_Wacatac_B_ml","state":"SUCCESS","submit_name":"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin","tags":["Sample Crashed"],"threat_score":100,"verdict":"malicious"}],"stats":{"contacted_hosts_count":0,"contacted_urls_count":0,"dns_resolutions_count":0,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":0,"files_deleted_count":0,"files_written_count":0,"http_requests_count":0,"imported_dlls_count":4,"injected_processes_count":0,"mutex_created_count":0,"process_count":3,"registry_keys_created_count":0,"registry_keys_deleted_count":0,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"script_calls_count":0,"spawned_processes_count":3}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{"malware_families":[{"sources":[{"report_id":"","report_type":"quickscan"}],"value":"Win/malicious_confidence_90%"}]},"av_detections":{"engines":{"ahnlab":{"data_source":"MetaDefender","name":"AhnLab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"antiy":{"data_source":"MetaDefender","name":"Antiy","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"aurora":{"data_source":"MetaDefender","name":"Aurora","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_-10","verdict":"malicious"},"avira":{"data_source":"MetaDefender","name":"Avira","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"bitdefender":{"data_source":"MetaDefender","name":"Bitdefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"clamav":{"data_source":"MetaDefender","name":"ClamAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"cmc":{"data_source":"MetaDefender","name":"CMC","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Trojan_Win32_Wacatac_B_ml","verdict":"malicious"},"emsisoft":{"data_source":"MetaDefender","name":"Emsisoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"eset":{"data_source":"MetaDefender","name":"ESET","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"filseclab":{"data_source":"MetaDefender","name":"Filseclab","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"gridinsoft":{"data_source":"MetaDefender","name":"Gridinsoft","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"huorong":{"data_source":"MetaDefender","name":"Huorong","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"k7":{"data_source":"MetaDefender","name":"K7","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"lionic":{"data_source":"MetaDefender","name":"Lionic","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"nanoav":{"data_source":"MetaDefender","name":"NANOAV","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"netgate":{"data_source":"MetaDefender","name":"NETGATE","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"rocketcyber":{"data_source":"MetaDefender","name":"RocketCyber","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"scrutiny":{"data_source":"MetaDefender","name":"Scrutiny","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"sophos":{"data_source":"MetaDefender","name":"Sophos","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"tachyon":{"data_source":"MetaDefender","name":"TACHYON","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"trellix":{"data_source":"MetaDefender","name":"Trellix","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"varist":{"data_source":"MetaDefender","name":"Varist","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"viritexplorer":{"data_source":"MetaDefender","name":"Vir.IT eXplorer","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"virusblokada":{"data_source":"MetaDefender","name":"VirusBlokAda","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"webrootsmd":{"data_source":"MetaDefender","name":"Webroot SMD","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"threat_name":"Malware_53.9","verdict":"malicious"},"xcitium":{"data_source":"MetaDefender","name":"Xcitium","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"},"zillya":{"data_source":"MetaDefender","name":"Zillya!","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA","progress":100,"success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"PE file has a section name known to be used by a packer/protector"}],"details_count":1,"name":"Evasive","sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Able to decrypt/decode data"},{"type":"informative","value":"Contains ability to decode base64 data"},{"type":"informative","value":"Contains ability to perform AES decryption (Dotnet String)"},{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information"},{"attack_id":"T1213.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1213/003","identifiers":[{"type":"informative","value":"Able to access code repositories"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Collection","technique":"Code Repositories"},{"attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains possible references to Golang crypto modules"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Impact","technique":"Data Encrypted for Impact"},{"attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Execution","technique":"Native API"},{"attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Persistence","technique":"Create or Modify System Process"},{"attack_id":"T1087","attack_id_wiki":"https://attack.mitre.org/techniques/T1087","identifiers":[{"type":"informative","value":"Contains ability to retrieve SID for the specified name (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"Account Discovery"},{"attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential IP address in binary/memory"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Application Layer Protocol"},{"attack_id":"T1029","attack_id_wiki":"https://attack.mitre.org/techniques/T1029","identifiers":[{"type":"informative","value":"Contains ability to perform scheduled transfer (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Exfiltration","technique":"Scheduled Transfer"},{"attack_id":"T1529","attack_id_wiki":"https://attack.mitre.org/techniques/T1529","identifiers":[{"type":"informative","value":"Contains ability to shutdown system"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Impact","technique":"System Shutdown/Reboot"},{"attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to create/connect to a named pipe (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Execution","technique":"Inter-Process Communication"},{"attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File and Directory Permissions Modification"},{"attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Indicator Removal from Tools"},{"attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"informative","value":"Contains ability to open a port and listen for incoming connection (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Standard Port"},{"attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to write files (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Ingress Tool Transfer"},{"attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to disable/close registry key (API string)"},{"type":"informative","value":"Able to delete registry key/value (API string)"},{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Able to create/load registry keys (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Persistence","technique":"Modify Registry"},{"attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Contains ability to enumerate multimedia device resources (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Persistence","technique":"Component Object Model Hijacking"},{"attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to set file time (API string)"},{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Timestomp"},{"attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Able to modify thread functionality – possible hijack (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking"},{"attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"},{"type":"informative","value":"Contains ability to retrieve user privileges (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Owner/User Discovery"},{"attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to retrieve machine timezone (API string)"},{"type":"informative","value":"Contains ability to retrieve machine time (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Time Discovery"},{"attack_id":"T1590","attack_id_wiki":"https://attack.mitre.org/techniques/T1590","identifiers":[{"type":"informative","value":"Able to access user sensitive domain"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Reconnaissance","technique":"Gather Victim Network Information"},{"attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate another user on the local machine (API string)"},{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"},{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft"},{"attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection"},{"attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Access Token Manipulation"},{"attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Create Process with Token"},{"attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Collection","technique":"Screen Capture"},{"attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Persistence","technique":"Windows Service"},{"attack_id":"T1564","attack_id_wiki":"https://attack.mitre.org/techniques/T1564","identifiers":[{"type":"informative","value":"Found virtual disk drive like strings"},{"type":"informative","value":"Spawns Windows crash diagnostic and reporting process"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hide Artifacts"},{"attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Time Based Evasion"},{"attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"informative","value":"YARA signature match – Embedded PE executable"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Embedded Payloads"},{"attack_id":"T1562.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1562/001","identifiers":[{"type":"informative","value":"Contains ability to modify process attributes (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Disable or Modify Tools"},{"attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"informative","value":"Contains ability to retrieve the local name for a socket (API string)"},{"type":"informative","value":"Contains ability to query network adapter information (API string)"},{"type":"informative","value":"Contains ability to free the memory used by network management functions (API string)"},{"type":"informative","value":"Able to determine NetBIOS or DNS name associated with the local computer"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Network Configuration Discovery"},{"attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Collection","technique":"Local Data Staging"},{"attack_id":"T1119","attack_id_wiki":"https://attack.mitre.org/techniques/T1119","identifiers":[{"type":"informative","value":"Shows ability to send encrypted data to the internet"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Collection","technique":"Automated Collection"},{"attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"Process Injection"},{"attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"File and Directory Discovery"},{"attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Opens registry keys"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"Query Registry"},{"attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Lateral Movement","technique":"Lateral Tool Transfer"},{"attack_id":"T1136.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1136/001","identifiers":[{"type":"informative","value":"Contains ability to create a new user account (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Persistence","technique":"Local Account"},{"attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Privilege Escalation","technique":"ListPlanting"},{"attack_id":"T1069.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1069/002","identifiers":[{"type":"informative","value":"Able to enumerate permission groups in the domain"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"Domain Groups"},{"attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Execution","technique":"Service Execution"},{"attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Software Packing"},{"attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Found strings related to keylogger"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Credential Access","technique":"Keylogging"},{"attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Able to retrieve geographical location information"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Found system command-related strings"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"informative","value":"Contains ability to retrieve operating system version"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Information Discovery"},{"attack_id":"T1531","attack_id_wiki":"https://attack.mitre.org/techniques/T1531","identifiers":[{"type":"informative","value":"Contains ability to delete a user account from a server (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Impact","technique":"Account Access Removal"},{"attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Execution","technique":"Windows Command Shell"},{"attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to show a graphical window (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Hidden Window"},{"attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve process ID (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"Process Discovery"},{"attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"File Deletion"},{"attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"User Activity Based Checks"},{"attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Symmetric Cryptography"},{"attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Impact","technique":"Service Stop"},{"attack_id":"T1087.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1087/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve information about user accounts on a server (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"Local Account"},{"attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"suspicious","value":"Timestamp in PE header is very old or in the future"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"},{"type":"informative","value":"Contains CRYPTO related strings"},{"type":"informative","value":"Contains ability to use Cryptographic classes"},{"type":"informative","value":"Possibly references Golang binary related string"},{"type":"informative","value":"Contains ability to perform AES/RC4 encryption (API string)"},{"type":"informative","value":"Contains ability to perform AES encryption (Dotnet String)"},{"type":"informative","value":"YARA signature match - RSA algorithm (keys)"},{"type":"informative","value":"YARA signature match - AES encryption"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Obfuscated Files or Information"},{"attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Encrypted/Encoded File"},{"attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Non-Application Layer Protocol"},{"attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Able to use Microsoft's Enhanced Cryptographic Provider"},{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Encrypted Channel"},{"attack_id":"T1559.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1559/001","identifiers":[{"type":"informative","value":"Contains ability to retrieve type of COM object"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Execution","technique":"Component Object Model"},{"attack_id":"T1098","attack_id_wiki":"https://attack.mitre.org/techniques/T1098","identifiers":[{"type":"informative","value":"Contains ability to modify the user configuration/privilege (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Persistence","technique":"Account Manipulation"},{"attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Execution Guardrails"},{"attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"The input sample contains the RDTSCP instruction"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion"},{"attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Able to query service configuration on system (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"System Service Discovery"},{"attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Discovery","technique":"Application Window Discovery"},{"attack_id":"T1561.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1561/001","identifiers":[{"type":"informative","value":"Contains ability to format disks"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Impact","technique":"Disk Content Wipe"},{"attack_id":"T1205.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1205/002","identifiers":[{"type":"informative","value":"Able to monitor socket connection"}],"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}],"tactic":"Persistence","technique":"Socket Filters"}],"rule_matches":{},"sandbox_signatures":[{"category":"Cryptographic Related","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - AES encryption","id":"summary-31","level":"informative","mitre_attack_id":"T1573.001","name":"Shows ability to use encryption for command and control traffic","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetDesktopWindow\" (Indicator: \"GetDesktopWindow\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"CopyFromScreen\" (Indicator: \"CopyFromScreen\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-78","level":"informative","mitre_attack_id":"T1113","name":"Contains ability to capture screen (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"External Systems","description":"3/27 Antivirus vendors marked sample as malicious (11% detection rate)","id":"avtest-0","level":"suspicious","name":"Sample was identified as malicious by at least one Antivirus engine","origin":"External System","sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature for AES encryption matched on file \"sample.bin\"","id":"yara-103","level":"informative","mitre_attack_id":"T1027","name":"YARA signature match - AES encryption","origin":"YARA Signature","relevance":5,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"OpenService\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-544","level":"informative","mitre_attack_id":"T1569.002","name":"Contains ability to open a service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"System Security","description":"Found registry deletion API: \"RegDeleteKey (in long string)\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found registry deletion API: \"RegDeleteValue (in long string)\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"","id":"string-230","level":"informative","mitre_attack_id":"T1112","name":"Able to delete registry key/value (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"OpenThread\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-309","level":"informative","mitre_attack_id":"T1055.003","name":"Able to modify thread functionality – possible hijack (API string)","origin":"File/Memory","relevance":3,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"crypto/internal/fips140/aes.decryptBlock\" (Indicator: \".decrypt\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockGeneric\" (Indicator: \".decrypt\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"crypto/internal/fips140/aes.decryptBlockAsm\" (Indicator: \".decrypt\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-356","level":"informative","mitre_attack_id":"T1140","name":"Able to decrypt/decode data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"MoveFileW\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"MoveFileExW\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-884","level":"informative","mitre_attack_id":"T1083","name":"Able to rename or move file/directory (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"RegCloseKey\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-345","level":"informative","mitre_attack_id":"T1112","name":"Contains ability to disable/close registry key (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"\"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" has high imagebase \"0x7ff77e880000\"","id":"static-93","level":"informative","name":"PE file has a high image base","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found registry query API: \"RegOpenKey (in long string)\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found registry query API: \"RegQueryValue (in long string)\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found registry query API: \"syscall.RegOpenKeyEx\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found registry query API: \"syscall.RegQueryValueEx\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found registry query API: \"syscall.RegEnumKeyEx\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"","id":"string-229","level":"informative","mitre_attack_id":"T1012","name":"Able to query registry keys (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Observed string: \"System.Security.Cryptography.AesManaged.CreateDecryptor\" in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin","id":"string-445","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to perform AES decryption (Dotnet String)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"OpenSCManager\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"QueryServiceStatus\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-191","level":"informative","mitre_attack_id":"T1007","name":"Able to enumerate service (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"LogonUser\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-225","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate another user on the local machine (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"GetLastError\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-319","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to set/get the last-error code for a calling thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"netusergetlocalgroups\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-981","level":"informative","mitre_attack_id":"T1069.002","name":"Able to enumerate permission groups in the domain","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"GetVersion\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"internal/syscall/windows.rtlGetVersion\" (Indicator: \"GetVersion\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-171","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the OS information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"CreateFile\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"NtOpenFile\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"NtCreateFile\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.CreateFile\" (Indicator: \"CreateFile\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-315","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create/open files (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"Virtual size of \"UPX0\" is \"0x203000\" greater than 0x100000","id":"static-124","level":"informative","name":"PE file has a big virtual size section","origin":"Static Parser","relevance":3,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"Found VM detection artifact \"RDTSCP trick\" in \"sample.bin\" (Offset: 471817)","id":"binary-26","level":"informative","mitre_attack_id":"T1497","name":"The input sample contains the RDTSCP instruction","origin":"Binary File","relevance":5,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-310","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to load modules (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"System Security","description":"Found reference to API \"SystemParametersInfo\" (Indicator: \"SystemParametersInfo\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-132","level":"informative","mitre_attack_id":"T1098","name":"Contains ability to modify the user configuration/privilege (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"Found string \"GetFileType\" (Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin, API is part of module: KERNELBASE.DLL)\n Found string \"GetFileInformationByHandle\" (Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin, API is part of module: KERNELBASE.DLL)\n Found string \"timeEndPeriod\" (Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin, API is part of module: KERNEL32.DLL)\n Found string \"NtCancelWaitCompletionPacket\" (Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin, API is part of module: NTDLL.DLL)","id":"string-64","level":"informative","mitre_attack_id":"T1106","name":"Input file contains API references not part of its Import Address Table (IAT)","origin":"File/Memory","relevance":10,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"GetModuleHandle\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-427","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve a module handle (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"System Security","description":"Observed string: \"Shutdown\" (Indicator: \"shutdown\") in Source: 5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin","id":"string-406","level":"informative","mitre_attack_id":"T1529","name":"Contains ability to shutdown system","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" was detected as \"tElock v1.0 (private) -> tE!\"","id":"static-18","level":"informative","mitre_attack_id":"T1027.002","name":"Matched Compiler/Packer signature","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"VirtualFree\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"VirtualAlloc\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-92","level":"informative","mitre_attack_id":"T1055","name":"Able to inject code into another process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"Process \"WerFault.exe\" [UID: 00000000-00002260]\n Process \"WerFault.exe\" [UID: 00000000-00002604]","id":"target-585","level":"informative","mitre_attack_id":"T1564","name":"Spawns Windows crash diagnostic and reporting process","origin":"Monitored Target","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-247","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"DeviceIoControl\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-220","level":"informative","mitre_attack_id":"T1543.003","name":"Contains ability to create/control drivers (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"FindFirstFile\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"FindNextFile\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.FindFirstFile\" (Indicator: \"FindFirstFile\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-83","level":"informative","mitre_attack_id":"T1083","name":"Contains ability to enumerate files on disk (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" claimed CRC 1014257 while the actual is CRC 3113955","id":"static-0","level":"suspicious","mitre_attack_id":"T1027","name":"CRC value set in PE header does not match actual value","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"SetFileTime\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-409","level":"informative","mitre_attack_id":"T1070.006","name":"Contains ability to set file time (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$24","id":"string-138","level":"informative","mitre_attack_id":"T1027","name":"Contains ability to use Cryptographic classes","origin":"File/Memory","relevance":2,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-106","level":"informative","mitre_attack_id":"T1140","name":"Contains ability to decode base64 data","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"GetTimeZoneInformation\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.GetTimeZoneInformation\" (Indicator: \"GetTimeZoneInformation\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-248","level":"informative","mitre_attack_id":"T1124","name":"Contains ability to retrieve machine timezone (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"CreateProcess\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.CreateProcessAsUser\" (Indicator: \"CreateProcess\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.CreateProcess\" (Indicator: \"CreateProcess\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-204","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to create a new process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"$25","id":"string-120","level":"informative","mitre_attack_id":"T1012","name":"Contains registry location strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"WSARecv\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"WSASend\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"WSAStartup\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.WSARecv\" (Indicator: \"WSARecv\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.WSASend\" (Indicator: \"WSASend\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"WSAStartup\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-228","level":"informative","mitre_attack_id":"T1095","name":"Contains ability to communicate with C2 using Sockets (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"NetUserGetInfo\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"NetUserGetLocalGroups\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-112","level":"informative","mitre_attack_id":"T1087.001","name":"Contains ability to retrieve information about user accounts on a server (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"GetTypeFromCLSID\" (Indicator: \"GetTypeFromCLSID\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-569","level":"informative","mitre_attack_id":"T1559.001","name":"Contains ability to retrieve type of COM object","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found string \"k__BackingField\" (Indicator: \"\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found string \"k__BackingField\" (Indicator: \"\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-556","level":"informative","mitre_attack_id":"T1056.001","name":"Found strings related to keylogger","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"OpenThreadToken\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"OpenProcessToken\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-306","level":"informative","mitre_attack_id":"T1134.001","name":"Contains ability to impersonate access tokens (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"file/memory contains long string with (Indicator: \"FreeLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"LoadLibrary\" (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"LoadLibraryW\" (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"LoadLibraryExW\" (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-318","level":"informative","mitre_attack_id":"T1055.001","name":"Contains ability to load/free library (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"Found system information discovery API: \"GetEnvironmentStrings (in long string)\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found system information discovery API: \"ExpandEnvironmentStrings (in long string)\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found system information discovery API: \"syscall.GetEnvironmentStrings\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found system information discovery API: \"GetSystemInfo\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in file \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\"","id":"string-89","level":"informative","mitre_attack_id":"T1082","name":"Able to retrieve information about the current system (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"OpenThread\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"SuspendThread\" (Indicator: \"SuspendThread\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"ResumeThread\" (Indicator: \"ResumeThread\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"SetThreadContext\" (Indicator: \"SetThreadContext\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"GetThreadContext\" (Indicator: \"GetThreadContext\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-161","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to retrieve/modify process thread (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-478","level":"informative","mitre_attack_id":"T1057","name":"Contains ability to retrieve process ID (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"System Security","description":"file/memory contains long string with (Indicator: \"ExitProcess\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"TerminateProcess\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-316","level":"informative","mitre_attack_id":"T1489","name":"Contains ability to terminate a process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$26","id":"string-226","level":"informative","mitre_attack_id":"T1497.003","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Detection/Stealthiness","description":"$27","id":"string-145","level":"informative","mitre_attack_id":"T1564","name":"Found virtual disk drive like strings","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains possible references to Golang crypto modules\n Matched sigs: Contains ability to perform AES/RC4 encryption (API string)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to decrypt/decode data\n Matched sigs: Contains ability to perform AES encryption (Dotnet String)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform AES decryption (Dotnet String)\n Matched sigs: YARA signature match – cryptographic algorithms\n Matched sigs: YARA signature match - ChaCha20 encryption algorithm\n Matched sigs: YARA signature match - AES encryption","id":"summary-28","level":"informative","mitre_attack_id":"T1027","name":"Shows ability to obfuscate file or information","origin":"Indicator Combinations","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Cryptographic Related","description":"$28","id":"binary-92","level":"informative","mitre_attack_id":"T1027.005","name":"XOR operations in executable file detected","origin":"Binary File","sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"System Destruction","description":"file/memory contains long string with (Indicator: \"NetUserDel\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-216","level":"informative","mitre_attack_id":"T1531","name":"Contains ability to delete a user account from a server (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Anti-Reverse Engineering","description":"\"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" has a section named \"UPX0\"\n \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" has a section named \"UPX1\"\n \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" has a section named \"UPX2\"","id":"static-7","level":"suspicious","mitre_attack_id":"T1027.002","name":"PE file is packed with UPX","origin":"Static Parser","relevance":10,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"$29","id":"string-101","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute Windows APIs","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Network Related","description":"file/memory contains long string with (Indicator: \"wsastartup\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"wsacleanup\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"gethostbyname\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \" send \"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \" socket \"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.WSAStartup\" (Indicator: \"wsastartup\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-899","level":"informative","mitre_attack_id":"T1071","name":"Contains references to network communication API (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Pattern Matching","description":"YARA signature matched on embedded PE in file \"sample.bin\"","id":"yara-140","level":"informative","mitre_attack_id":"T1027.009","name":"YARA signature match – Embedded PE executable","origin":"YARA Signature","relevance":2,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"$2a","id":"string-774","level":"informative","mitre_attack_id":"T1213.003","name":"Able to access code repositories","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"GetSystemTime\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-365","level":"informative","mitre_attack_id":"T1029","name":"Contains ability to perform scheduled transfer (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"\"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" has flags like IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA\n IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","id":"static-154","level":"informative","name":"File contains dynamic base/NX flags","origin":"Static Parser","sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"\"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" has an executable section named \"UPX0\"\n \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\" has an executable section named \"UPX1\"","id":"static-80","level":"informative","name":"PE file contains executable sections","origin":"Static Parser","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"RtlGetVersion\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-86","level":"informative","mitre_attack_id":"T1082","name":"Able to discover operating system information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"Report process \"WerFault.exe\" was created by \"svchost.exe\"\n Report process \"WerFault.exe\" was created by \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin.exe\"","id":"target-2","level":"informative","name":"An application crash occurred","origin":"Monitored Target","sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"\"C:\\Users\\markh\\code\\mygithub\\NAudio\\NAudio\\obj\\Release\\net472\\NAudio.pdb\"\n \"C:\\Users\\markh\\code\\mygithub\\NAudio\\NAudio.Asio\\obj\\Release\\netstandard2.0\\NAudio.Asio.pdb\"\n \"C:\\Users\\markh\\code\\mygithub\\NAudio\\NAudio.Core\\obj\\Release\\netstandard2.0\\NAudio.Core.pdb\"\n \"C:\\Users\\markh\\code\\mygithub\\NAudio\\NAudio.Midi\\obj\\Release\\netstandard2.0\\NAudio.Midi.pdb\"\n \"C:\\Users\\markh\\code\\mygithub\\NAudio\\NAudio.Wasapi\\obj\\Release\\netstandard2.0\\NAudio.Wasapi.pdb\"","id":"string-7","level":"informative","name":"Contains PDB pathways","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"LookupAccountName\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-452","level":"informative","mitre_attack_id":"T1087","name":"Contains ability to retrieve SID for the specified name (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"file/memory contains long string with (Indicator: \"GetEnvironmentVariable\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"GetEnvironmentVariable\" (Indicator: \"GetEnvironmentVariable\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-107","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve the host's architecture (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Environment Awareness","description":"file/memory contains long string with (Indicator: \"GetVolumeInformation\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"GetVolumeNameForVolumeMountPoint\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-162","level":"informative","mitre_attack_id":"T1082","name":"Contains ability to retrieve volume information (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"Found reference to API \"set_UseShellExecute\" (Indicator: \"ShellExecute\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-240","level":"informative","mitre_attack_id":"T1106","name":"Contains ability to execute an application (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"file/memory contains long string with (Indicator: \"GetCommandLine\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n file/memory contains long string with (Indicator: \"CommandLineToArgv\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")\n Found reference to API \"syscall.GetCommandLine\" (Indicator: \"GetCommandLine\"; File: \"5a4ae73d9deab5225bf225fec5f1a1bd92d1e7cded7384e17d4a38528e44389a.bin\")","id":"string-206","level":"informative","mitre_attack_id":"T1059.003","name":"Contains ability to retrieve the command-line string for the current process (API string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"General","description":"\"RepositoryUrl https://github.com/naudio/NAudio\" (Indicator: \"github.com\")","id":"string-135","level":"informative","name":"Found well known domains (string)","origin":"File/Memory","relevance":1,"sources":[{"report_id":"69910b2802b6acff0a0a66fc","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"