24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 31:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4f7,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 5dec6a41e77f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 5dec6a41e77f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/25 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924"],"about":{"@type":"SoftwareApplication","name":"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924","applicationCategory":["peexe","executable"],"identifier":"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":19,"total":25},"behavioralIndicators":{"malicious":3,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T4e6,"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" queried SystemProcessInformation at 00000000-00001540-00000C15-701612038 [PID: 1540] "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" queried SystemProcessInformation at 00000000-00001540-00000C15-701622131 [PID: 1540] "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" queried SystemProcessInformation at 00000000-00001540-00000C15-702442689 [PID: 1540] "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" queried SystemProcessInformation at 00000000-00001540-00000C15-702452014 [PID: 1540] "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" queried SystemProcessInformation at 00000000-00001540-00000C15-702569167 [PID: 1540] "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" queried SystemProcessInformation at 00000000-00001540-00000C15-702579196 [PID: 1540] "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" queried SystemProcessInformation at 00000000-00001540-00000C15-702865011 [PID: 1540] "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" queried SystemProcessInformation at 00000000-00001540-00000C15-702874674 [PID: 1540]26:Tfbd,Found XOR loop in file "sample.bin" at offset 214877; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 248869; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 350833; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 585506; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 798772; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 819600; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 876488; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 949045; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 949055; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 967727; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1123761; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1156741; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1209964; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1328973; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 288678; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 317075; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 453436; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 465097; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 519351; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 522168; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 595404; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 610594; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 640999; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 746093; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 776322; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 810450; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 910214; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 932639; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 933230; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1151348; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1186262; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1233065; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1267749; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1277701; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 184212; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 273343; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 309457; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 330938; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 389476; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 530496; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 563108; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 584700; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 652499; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 676336; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 787208; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 818996; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 873192; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 998059; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1062569; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1174372; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1210124; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1229768; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1268862; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1293910; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1349924; code bytes = 803027:T55e,"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00001540)28:T497,"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "LoadLibrary" with a parameter KERNEL32.DLL (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "LoadLibrary" with a parameter MSVCRT.dll (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "LoadLibrary" with a parameter OLEAUT32.dll (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "LoadLibrary" with a parameter USER32.dll (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "LoadLibrary" with a parameter WS2_32.dll (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "LoadLibrary" with a parameter advapi32.dll (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "LoadLibrary" with a parameter kernel32.dll (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "LoadLibrary" with a parameter wininet.dll (UID: 00000000-00001540)29:T385c,"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetModuleFileNameA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter SetErrorMode (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CreateMutexA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetStartupInfoA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetModuleHandleA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter LocalFree (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetLastError (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter ExitProcess (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetTickCount (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter lstrcmpA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter lstrcpynA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetLogicalDriveStringsA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetDriveTypeA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter lstrlenA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter lstrcatA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter lstrcpyA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter LoadLibraryA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetProcAddress (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetVolumeInformationA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetTempFileNameA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetTempPathA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter MoveFileExA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter Sleep (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CreateProcessA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CloseHandle (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter Process32Next (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter Process32First (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CreateToolhelp32Snapshot (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CreateThread (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GlobalAlloc (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter SetFileAttributesA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter __p__fmode (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter __set_app_type (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter ??1type_info@@UAE@XZ (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _controlfp (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _strdup (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _unlink (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter fread (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter __p__commode (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _adjust_fdiv (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter __setusermatherr (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter sprintf (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter atoi (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter fclose (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter ftell (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter fseek (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter fopen (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter toupper (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _strcmpi (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter strcpy (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter calloc (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _except_handler3 (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter malloc (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter fwrite (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter fputs (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter strlen (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter strcat (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter rand (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter strstr (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter strrchr (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter strcmp (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter memset (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter strtok (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter free (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter __CxxFrameHandler (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _EH_prolog (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter srand (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter __argv (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter __argc (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _CxxThrowException (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter ??3@YAXPAX@Z (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _exit (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _XcptFilter (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter exit (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _acmdln (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter __getmainargs (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter _initterm (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter wsprintfA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter IsCharAlphaNumericA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter GetEnvironmentVariableA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter WinExec (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter CopyFileA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter RegSetValueExA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter RegOpenKeyA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter RegCloseKey (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter InternetOpenA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter InternetOpenUrlA (UID: 00000000-00001540) "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" called "GetProcAddress" with a parameter InternetReadFile (UID: 00000000-00001540)2a:T29fb,Found reference to API (Indicator: "VirtualAlloc"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "VirtualProtect"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "VirtualFree"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "ExitProcess"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "LoadLibraryA"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "GetProcAddress"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "GetErrorInfo"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "wsprintfA"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "WSACleanup"; File: "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924") Found reference to API (Indicator: "GetEnvironmentVariableA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "WinExec"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CopyFileA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "RegSetValueExA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "SetErrorMode"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrcpynA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrcatA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrcpyA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "MoveFileExA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "Process32Next"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "Process32First"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericA"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "WinExec"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CopyFileA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "SetFileAttributesA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "RegSetValueExA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "RegOpenKeyA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "RegCloseKey"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "InternetOpenUrlA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "InternetReadFile"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleFileNameA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "SetErrorMode"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetStartupInfoA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTickCount"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrcmpA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrcpynA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetLogicalDriveStringsA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetDriveTypeA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrlenA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrcatA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "lstrcpyA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetVolumeInformationA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempFileNameA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GetTempPathA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "MoveFileExA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateProcessA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "Process32Next"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "Process32First"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "GlobalAlloc"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "wsprintfA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API (Indicator: "IsCharAlphaNumericA"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp")2b:T7a9,"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "")2c:Te5c,"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "5DEC6A41E77F4DA16892AE7BF1B05C661A3B44B3750C243B057E761AA7CC1924.EXE"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "")2d:T4a1,"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\WINDOWS\system32\wow64log.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\WINDOWS\SysWOW64\apphelp.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb"2e:T505,"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\WINDOWS\system32\wow64log.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\FLTLIB.DLL" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\MSVCP140.DLL" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\MSVCP140.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\VCRUNTIME140.DLL" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\VCRUNTIME140.dll" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\WININET.DLL" "5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe" trying to access non-existent file "C:\wininet.dll"2f:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001540.00000000.137037.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001540.00000000.137037.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001540.00000000.137037.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001540.00000000.137037.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001540.00000000.137037.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001540.00000000.137037.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001540.00000000.137037.02D00000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001540.00000000.137037.02D00000.00000004.mdmp")30:T478,Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; File: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API "Process32Next" (Indicator: "Process32Next"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API "Process32First" (Indicator: "Process32First"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00001540.00000000.137037.00401000.00000040.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1792433169907,"unified_at":"2026-10-19T18:06:09.907Z","metadata":{"hashes":{"sha256":"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924","sha1":"df898bb17281b70c4d1e66169b5bc080b52dcef5","md5":"1074a9bc4af713caa6c35349d0507128","sha512":"e985ad0f8bd56eb9263bf2e8a4f8a6f6043baa422d7f60f82b6996b91580a126ddb1f7db7efa0ad3dc71433d4c5b91495605a28589382575e6bff70c2d1319cc","ssdeep":"24576:XJujSgOZL7nY/F8mPl8JFFZW01WwZs7zKUW0q4NxMj5bu7yMHAW9c9i4m0wid6dF:ZujM3nY2Eul801WwMzKUxqn5bey0+9iz","ssdeep_chunks":["24576:XJujSgO","24576:JujSgOZ","24576:ujSgOZL","24576:jSgOZL7","24576:SgOZL7n","24576:gOZL7nY","24576:OZL7nY/","24576:ZL7nY/F","24576:L7nY/F8","24576:7nY/F8m","24576:nY/F8mP","24576:Y/F8mPl","24576:/F8mPl8","24576:F8mPl8J","24576:8mPl8JF","24576:mPl8JFF","24576:Pl8JFFZ","24576:l8JFFZW","24576:8JFFZW0","24576:JFFZW01","24576:FFZW01W","24576:FZW01Ww","24576:ZW01WwZ","24576:W01WwZs","24576:01WwZs7","24576:1WwZs7z","24576:WwZs7zK","24576:wZs7zKU","24576:Zs7zKUW","24576:s7zKUW0","24576:7zKUW0q","24576:zKUW0q4","24576:KUW0q4N","24576:UW0q4Nx","24576:W0q4NxM","24576:0q4NxMj","24576:q4NxMj5","24576:4NxMj5b","24576:NxMj5bu","24576:xMj5bu7","24576:Mj5bu7y","24576:j5bu7yM","24576:5bu7yMH","24576:bu7yMHA","24576:u7yMHAW","24576:7yMHAW9","24576:yMHAW9c","24576:MHAW9c9","24576:HAW9c9i","24576:AW9c9i4","24576:W9c9i4m","24576:9c9i4m0","24576:c9i4m0w","24576:9i4m0wi","24576:i4m0wid","24576:4m0wid6","24576:m0wid6d","24576:0wid6dF","49152:XJujSgO","49152:JujSgOZ","49152:ujSgOZL","49152:jSgOZL7","49152:SgOZL7n","49152:gOZL7nY","49152:OZL7nY/","49152:ZL7nY/F","49152:L7nY/F8","49152:7nY/F8m","49152:nY/F8mP","49152:Y/F8mPl","49152:/F8mPl8","49152:F8mPl8J","49152:8mPl8JF","49152:mPl8JFF","49152:Pl8JFFZ","49152:l8JFFZW","49152:8JFFZW0","49152:JFFZW01","49152:FFZW01W","49152:FZW01Ww","49152:ZW01WwZ","49152:W01WwZs","49152:01WwZs7","49152:1WwZs7z","49152:WwZs7zK","49152:wZs7zKU","49152:Zs7zKUW","49152:s7zKUW0","49152:7zKUW0q","49152:zKUW0q4","49152:KUW0q4N","49152:UW0q4Nx","49152:W0q4NxM","49152:0q4NxMj","49152:q4NxMj5","49152:4NxMj5b","49152:NxMj5bu","49152:xMj5bu7","49152:Mj5bu7y","49152:j5bu7yM","49152:5bu7yMH","49152:bu7yMHA","49152:u7yMHAW","49152:7yMHAW9","49152:yMHAW9c","49152:MHAW9c9","49152:HAW9c9i","49152:AW9c9i4","49152:W9c9i4m","49152:9c9i4m0","49152:c9i4m0w","49152:9i4m0wi","49152:i4m0wid","49152:4m0wid6","49152:m0wid6d","49152:0wid6dF","24576:ZujM3nY","24576:ujM3nY2","24576:jM3nY2E","24576:M3nY2Eu","24576:3nY2Eul","24576:nY2Eul8","24576:Y2Eul80","24576:2Eul801","24576:Eul801W","24576:ul801Ww","24576:l801WwM","24576:801WwMz","24576:01WwMzK","24576:1WwMzKU","24576:WwMzKUx","24576:wMzKUxq","24576:MzKUxqn","24576:zKUxqn5","24576:KUxqn5b","24576:Uxqn5be","24576:xqn5bey","24576:qn5bey0","24576:n5bey0+","24576:5bey0+9","24576:bey0+9i","24576:ey0+9iz"],"imphash":"08b656407b8d307979dc72c3fcc683a8"},"file_info":{"file_name":"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1371626,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1792432930000,"last_seen":1792433037000,"last_multi_scan":1792433037000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":19,"suspicious_count":0,"total_engines":25},"attributions":{"malware_families_count":2,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":43},"sandbox_signatures":{"informative_count":79,"suspicious_count":22,"malicious_count":3,"total":104},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Worm/Win.Socks","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Worm/Win32.Autorun","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_100.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Dropper.Gen","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Trojan.Stealer.556","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"malicious","threat_name":"Win.Malware.Genpack-10015161-0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Trojan.Stealer.556 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/PSW.Agent.NHG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"malicious","threat_name":"Suspicious:TrojanSpy.Ser.a.eypr.mg","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent.oa!s2","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 004bcce41 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Socks.lgLL","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"malicious","threat_name":"Confidence_95","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.DAN.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Agent.JBK","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"TrojWare.Win32.PSW.Agent.NHG","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Worm.Socks.Win32.11","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win/malicious_confidence_100%","sources":[{"report_type":"quickscan","report_id":""}]},{"value":"Trojan.Stealer","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to execute an application (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"suspicious","value":"Contains ability to execute program"},{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Execution","technique":"Malicious File","attack_id":"T1204.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1204/002","identifiers":[{"type":"malicious","value":"Sample was identified as malicious by a trusted antivirus engine"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Persistence","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"informative","value":"Contains ability to modify registry key/value (API string)"},{"type":"informative","value":"Contains ability to disable/close registry key (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Reference explorer.exe process"},{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Credential Access","technique":"Network Sniffing","attack_id":"T1040","attack_id_wiki":"https://attack.mitre.org/techniques/T1040","identifiers":[{"type":"suspicious","value":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Able to retrieve logical drive information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"suspicious","value":"Contains ability to read the host's architecture"},{"type":"suspicious","value":"Contains ability to retrieve volume information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve volume information (API string)"},{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Contains ability to enumerate processes/modules/threads"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to check debugger is running (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the time elapsed since the system was started (API string)"},{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"Local Storage Discovery","attack_id":"T1680","attack_id_wiki":"https://attack.mitre.org/techniques/T1680","identifiers":[{"type":"informative","value":"Able to enumerate disk drives (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Able to determine the valid logical drives on the computer"},{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Contains ability to enumerates all mounted drives"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Queries the user identity associated with the current process token"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Contains ability to detect virtual environment (API)"},{"type":"suspicious","value":"The input sample contains a known anti-VM trick"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains references to network communication API (string)"},{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Contains ability to communicate with network (API string)"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"suspicious","value":"References HTTP requests in memory"},{"type":"informative","value":"Found string related to HTTP headers"},{"type":"informative","value":"Contains reference to Windows internet services (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Contains ability to download a file from a URL (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"suspicious","value":"Contains ability to open a port and listen for incoming connection"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Exfiltration","technique":"Exfiltration Over C2 Channel","attack_id":"T1041","attack_id_wiki":"https://attack.mitre.org/techniques/T1041","identifiers":[{"type":"suspicious","value":"Found POST request with headers in memory"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"suspicious","value":"Contains ability to terminate a process"},{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"Shows ability to obfuscate file or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file is packed with UPX"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Junk Code Insertion","attack_id":"T1027.016","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/016","identifiers":[{"type":"suspicious","value":"File exhibits characteristics of junk code obfuscation"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – Anomalous PE file structure"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Stealth","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Defense Impairment","technique":"File and Directory Permissions Modification","attack_id":"T1222","attack_id_wiki":"https://attack.mitre.org/techniques/T1222","identifiers":[{"type":"informative","value":"Contains ability to modify file attributes (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"VirtualAlloc\" (Indicator: \"VirtualAlloc\"; File: \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\")\n Found reference to API \"VirtualFree\" (Indicator: \"VirtualFree\"; File: \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001540.00000000.137037.02D00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$25","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API GetProcAddress@KERNEL32.DLL at 00000000-00001540-31919-59-0042882F\n Found reference to API GetEnvironmentVariableA@KERNEL32.DLL at 00000000-00001540-31919-61-0042885F\n Found reference to API WinExec@KERNEL32.DLL at 00000000-00001540-31919-63-0042888F\n Found reference to API CopyFileA@KERNEL32.DLL at 00000000-00001540-31919-65-004288BF\n Found reference to API SetFileAttributesA@KERNEL32.DLL at 00000000-00001540-31919-67-004288EF\n Found reference to API RegSetValueExA@KERNEL32.DLL at 00000000-00001540-31919-69-0042891F\n Found reference to API RegCloseKey@KERNEL32.DLL at 00000000-00001540-31919-73-0042897F","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"Assembly shows XOR instruction xor al\n 59h in Stream UID: 00000000-00001540-31919-15-0042B7B0\n Assembly shows XOR instruction xor byte ptr [ebx+ebp*4-547B3F89h]\n cl in Stream UID: 00000000-00001540-31919-15-0042B7B0\n Assembly shows XOR instruction xor byte ptr [ebx-32h]\n dl in Stream UID: 00000000-00001540-31919-15-0042B7B0\n Assembly shows XOR instruction xor eax\n dword ptr [ebp+0Ch] in Stream UID: 00000000-00001540-31919-49-00428653","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00001540.00000000.137037.02D00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.50019","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$26","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStringsA\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveTypeA\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00001540.00000000.137037.02D00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00001540-31919-144-0042B19D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerates all mounted drives","description":"GetLogicalDriveStringsA@KERNEL32.DLL at 00000000-00001540-31919-124-0042A20C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-66","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Found reference to API \"GetStartupInfoA\" (Indicator: \"GetStartupInfo\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve volume information (API string)","description":"Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetVolumeInformationA\" (Indicator: \"GetVolumeInformation\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-162","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Environment Awareness","name":"Queries the user identity associated with the current process token","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" queried token user identity (UID: 00000000-00001540)","origin":"API Call","mitre_attack_id":"T1033","relevance":2,"id":"api-328","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found string \"MoveFileExA\" (Indicator: \"MoveFileExA\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"$28","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$29","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"CreateProcessA\" (Indicator: \"CreateProcess\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00001540-31919-92-00429112\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-104-0042946E\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-105-0042964E\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-106-004297F8\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-116-00429ABB\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-123-0042A13C\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-124-0042A20C\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-142-0042ACEB\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-143-0042B16D\n Sleep@KERNEL32.DLL at 00000000-00001540-31919-144-0042B19D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to disable/close registry key (API string)","description":"Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"RegCloseKey\" (Indicator: \"RegCloseKey\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-345","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00001540-31919-55-004287DB\n LoadLibraryA@KERNEL32.DLL at 00000000-00001540-31919-57-00428805\n LoadLibraryA@KERNEL32.DLL at 00000000-00001540-31919-92-00429112\n LoadLibraryA@KERNEL32.DLL at 00000000-00001540-31919-97-004293C2\n LoadLibraryA@KERNEL32.DLL at 00000000-00001540-31919-128-0042A4D4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to execute an application (API string)","description":"Found reference to API \"WinExec\" (Indicator: \"WinExec\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"WinExec\" (Indicator: \"WinExec\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-240","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"MoveFileExA\" (Indicator: \"MoveFile\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 742e0000\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"KERNEL32.DLL\" at base 76540000\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"MSVCRT.DLL\" at base 77a30000\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"OLEAUT32.DLL\" at base 76410000\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"USER32.DLL\" at base 748d0000\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"WS2_32.DLL\" at base 74cd0000\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"ADVAPI32.DLL\" at base 76670000\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"WININET.DLL\" at base 73ff0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 74A50000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 76F00000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" was detected as \"UPX\" and name: \"Packer\"\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has an executable section named \"UPX0\"\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has an executable section named \"UPX1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has an writable section named \"UPX0\"\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has an writable section named \"UPX1\"\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has an writable section named \"UPX2\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" file has an entrypoint instructions - \"pushal\t,mov\tesi, 0x42b000,lea\tedi, [esi - 0x2a000],push\tedi,or\tebp, 0xffffffff,jmp\t0x42e252,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,mov\tal, byte ptr [esi],inc\tesi,mov\tbyte ptr [edi], al,inc\tedi,add\tebx, ebx,jne\t0x42e259,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jb\t0x42e248,mov\teax, 1,add\tebx, ebx,jne\t0x42e26b,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,adc\teax, eax,add\tebx, ebx,jae\t0x42e260,jne\t0x42e27c,mov\tebx, dword ptr [esi],sub\tesi, -4,adc\tebx, ebx,jae\t0x42e260,xor\tecx, ecx,sub\teax, 3,jb\t0x42e290,shl\teax, 8,mov\tal, byte ptr [esi],inc\tesi,xor\teax, 0xffffffff,je\t0x42e302,mov\tebp, eax,add\tebx, ebx,jne\t0x42e29b,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2c","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to retrieve the time elapsed since the system was started (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: The input sample contains a known anti-VM trick\n Matched sigs: Contains ability to delay the execution of current thread\n Matched sigs: Contains ability to detect virtual environment (API)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$2e","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"t'.mc\"\n Heuristic match: \"\\a.mx\"\n Heuristic match: \"~.tw\"\n Heuristic match: \"bximp.jp\"\n Heuristic match: \".o.ci\"\n Pattern match: \"http://bublikiadministrator.com/\"\n Pattern match: \"http://bublikimanager.com/\"\n Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"http://bublikiadministrator.com/http://bublikimanager.com/old_load________________________________________cftmon.exespools.exeftp33.dllc:\\stopflibwininet.dllinternetopenainternetopenurlainternetreadfilepkillfsocksfflashfminiavfpstorageabcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz0123456789+/%%%02xntuserautoloadui\" - Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; File: \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\")\n Found string \"POST %s HTTP/1.1Host: %sContent-Type: application/x-www-form-urlencodedContent-length: %d%s\" (Indicator: \"HTTP/1.1\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found string \"POST %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyA\" in file \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\"\n Found registry query API: \"RegOpenKeyA\" in \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetLogicalDriveStringsA\" (Indicator: \"GetLogicalDriveStrings\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetDriveTypeA\" (Indicator: \"GetDriveType\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetTempFileNameA\" (Indicator: \"GetTempFileName\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetTempPathA\" (Indicator: \"GetTempPath\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetModuleFileNameA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetEnvironmentVariableA\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"SetFileAttributesA\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" was detected as \"Netopsystems FEAD Optimizer 1\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reference explorer.exe process","description":"Found string \"Explorer.exe\" (Indicator: \"explorer.exe\"; File: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-481","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"File exhibits characteristics of junk code obfuscation","description":"Section \"UPX0\" has very low entropy (0.00)\n indicating potential NOP sled\n Section \"UPX2\" has very low entropy (0.54)\n indicating potential NOP sled","origin":"Static Parser","mitre_attack_id":"T1027.016","relevance":3,"id":"static-9001","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file is packed with UPX","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has a section named \"UPX0\"\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has a section named \"UPX1\"\n \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has a section named \"UPX2\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-7","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00001540-31919-145-0042B818","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.DLL at 00000000-00001540-31919-145-0042B818","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve volume information","description":"GetVolumeInformationA@KERNEL32.DLL at 00000000-00001540-31919-86-00428BEC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-130","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"VMware trick\" in \"sample.bin\" (Offset: 182135)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"18/24 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"General","name":"Contains ability to execute program","description":"WinExec@KERNEL32.DLL at 00000000-00001540-31919-63-0042888F\n WinExec@KERNEL32.DLL at 00000000-00001540-31919-144-0042B19D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":7,"id":"stream-106","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to listen for incoming connections","description":"listen@WS2_32.DLL at 00000000-00001540-31919-123-0042A13C\n listen@WS2_32.DLL at 00000000-00001540-31919-489-0042B64E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1040","relevance":5,"id":"stream-33","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection","description":"socket@WS2_32.DLL at 00000000-00001540-31919-105-0042964E\n closesocket@WS2_32.DLL at 00000000-00001540-31919-116-00429ABB\n socket@WS2_32.DLL at 00000000-00001540-31919-118-00429C5B\n closesocket@WS2_32.DLL at 00000000-00001540-31919-122-0042A007\n socket@WS2_32.DLL at 00000000-00001540-31919-123-0042A13C\n listen@WS2_32.DLL at 00000000-00001540-31919-489-0042B64E","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1571","relevance":5,"id":"stream-85","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Network Related","name":"Found POST request with headers in memory","description":"Found HTTP POST request \"('POST %s HTTP/1.1\\nHost: %s\\nContent-Type: application/x-www-form-urlencoded\\nContent-length: %d\\ncwvmpwl,gzg\\ncwvmpwl,kld\\nYcwvmpwl_\\nQjgnnGzgawvg?cwvmpwl,gzg\\npge\"fgngvg\" JINO^QMDVUCPG^Okapmqmdv^Uklfmuq^AwppglvTgpqkml^Gzrnmpgp^@pmuqgp\"Jgnrgp\"M`hgavq \"-d\\nExplorer.exe\\nShell\\nQMDVUCPG^Okapmqmdv^Uklfmuq\"LV^AwppglvTgpqkml^Uklnmeml^\\nlogonui.exe\\nUIHost\\nQMDVUCPG^Okapmqmdv^Uklfmuq\"LV^AwppglvTgpqkml^Uklnmeml^\\n\\\\userinit.exe\n\\nUserInit\\nQMDVUCPG^Okapmqmdv^Uklfmuq\"LV^AwppglvTgpqkml^Uklnmeml^\\npge\"f.............\" in memory - Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1041","relevance":5,"id":"memorydump-7","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Network Related","name":"References HTTP requests in memory","description":"Found HTTP requests \"POST %s HTTP/1.1\" in memory - Source: \"00000000-00001540.00000000.137037.00401000.00000040.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071.001","relevance":3,"id":"memorydump-6","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – Anomalous PE file structure","description":"YARA signature for null IAT Directory of PE file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-153","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes/modules/threads","description":"CreateToolhelp32Snapshot@KERNEL32.DLL at 00000000-00001540-31919-106-004297F8\n Process32Next@KERNEL32.DLL at 00000000-00001540-31919-107-0042B65A\n Process32First@KERNEL32.DLL at 00000000-00001540-31919-108-0042B660\n CreateToolhelp32Snapshot@KERNEL32.DLL at 00000000-00001540-31919-109-0042B666","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":5,"id":"stream-20","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to read the host's architecture","description":"GetEnvironmentVariableA@KERNEL32.DLL at 00000000-00001540-31919-61-0042885F\n GetEnvironmentVariableA@KERNEL32.DLL at 00000000-00001540-31919-86-00428BEC\n GetEnvironmentVariableA@KERNEL32.DLL at 00000000-00001540-31919-91-00428DEC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":3,"id":"stream-111","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00001540-31919-91-00428DEC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to terminate a process","description":"ExitProcess@KERNEL32.DLL at 00000000-00001540-31919-143-0042B16D\n ExitProcess@KERNEL32.DLL at 00000000-00001540-31919-144-0042B19D","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1489","relevance":1,"id":"stream-88","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924\" has an entrypoint in section \"UPX1\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"VirtualAlloc\n VirtualProtect\n LoadLibraryA\n GetProcAddress","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"18/24 Antivirus vendors marked sample as malicious (75% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted antivirus engine","description":"Trusted antivirus vendors count marked sample as malicious (count = 2)","origin":"External System","mitre_attack_id":"T1204.002","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Contains ability to listen for incoming connections"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"The input sample contains a known anti-VM trick"},{"detail":"PE file has a section name known to be used by a packer/protector"},{"detail":"Contains ability to terminate a process"}],"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]}],"intel_graph":{"map":{},"chains":[]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":32,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"6ad65b8d819eb2218d0401db","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Worm.Socks","submit_name":"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924","analysis_start_time":"2026-10-19T18:03:58+00:00","indicators_count":{"informative":79,"suspicious":27,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}],"processes":[{"pid":1540,"ppid":0,"name":"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe","command_line":"","sha256":"5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924","normalized_path":"C:\\5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924.exe","uid":"00000000-00001540","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABH0lEQVR4Xu2UXWrCQBCAA6UgIhRBPKvFtlTUB8HnwoKnkdIr1OQAOUD+k5eREdYuQ2YzWZJQMAMfvuX7Zgf0vHHG+S+zPxxhSKi/t4Dz90/tL/XfAsIwHAQ2oKqqXijL8k5RFHwALUXwA97qV0yTvDHgS53umAHLXQCLbQDzTQAvnz7MPnyYvvswebvA8/oCT69/AUopljzP7QEUHSCRmy9QtznKnQMk8k5egDuBRI7YNkeyLLMHUHSARK4D6NYmzgESuQ7gNtdYA7gTSOQIiunWJmma2gMoOkAi1wHc5ih3DpDIEZTSrVu9AHcCKbbNkSRJ7AEUl4C6rbW89wDb5oMGcPI4jtsHNP23N93clDsFdCmPoogPGBLqH2ecx50refsbU/OstCIAAAAASUVORK5CYII="}],"all_imported_dlls":["fltLib.dll","advapi32.dll","ole32.dll","msvcrt.dll","bcryptprimitives.dll","sechost.dll","VxSSL32.dll","msvcp_win.dll","wow64win.dll","kernel32.dll","user32.dll","gdi32.dll","wininet.dll","combase.dll","rpcrt4.dll","gdi32full.dll","vcruntime140.dll","msvcp140.dll","imm32.dll","ntdll.dll","wow64.dll","wow64cpu.dll","sspicli.dll","win32u.dll","ws2_32.dll","shlwapi.dll","apphelp.dll","oleaut32.dll","cryptsp.dll","ucrtbase.dll","KernelBase.dll","cryptbase.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ad65b8d819eb2218d0401db"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["6ad65b8d819eb2218d0401db"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Win/malicious_confidence_100% Sample 5dec6a41e77f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 5dec6a41e77f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/25 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924"}],["$","meta","4",{"property":"og:title","content":"Malicious Win/malicious_confidence_100% Sample 5dec6a41e77f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 5dec6a41e77f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/25 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/5dec6a41e77f4da16892ae7bf1b05c661a3b44b3750c243b057e761aa7cc1924"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win/malicious_confidence_100% Sample 5dec6a41e77f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 5dec6a41e77f…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 19/25 AV engines flagged this file. 3 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L31","11",{}]]