21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 4e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T4e0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan[Backdoor]/MSIL.Bladabindi Sample 6106f3f8d2d2… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 6106f3f8d2d2…. Malware family: Trojan[Backdoor]/MSIL.Bladabindi. Threat score 100/100. 19/27 AV engines flagged this file. 6 malicious and 17 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f","keywords":["Malicious","Trojan[Backdoor]/MSIL.Bladabindi","malware analysis","sandbox report","threat intelligence","6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f"],"about":{"@type":"SoftwareApplication","name":"NemezidaLoader.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan[Backdoor]/MSIL.Bladabindi","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":17},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T790,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe"23:Ta71,"", "192.168.0.2", Potential IP "2.0.0.0" found in string "ystem.Drawing 2.0.0.0 b03f5f7f11d50a3a", Potential IP "2.0.0.0" found in string "ystem.Windows.Forms 2.0.0.0 b77a5c561934e089", Potential IP "2.0.0.0" found in string "n=2.0.0.0 Culture=neutral PublicKeyToken=b77a5c561934e089"/>" Potential IP "2.0.0.0" found in string "rsion=2.0.0.0, Culture=neutral, PublicKe" Potential IP "2.0.0.0" found in string "ion=2.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"41:T1224,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found reference to API "11545898274,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11546390530,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11547252558,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11547210360,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11547004918,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11547085220,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11547045422,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11546209552,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11547124196,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11545552200,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11546250862,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11546430352,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11544269926,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.671",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "11547167322,584,103,,GetAsyncKeyState,user32.dll,"00:48:12.687",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp") Found reference to API "19483774596,584,104,,GetKeyState,user32.dll,"00:" (Indicator: "GetKeyState"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp"), Found reference to API "83556571852 584 103 GetAsyncKeyState user32.dll "00:48:42.687" RX=0 PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp"), Found reference to API "83556530268 584 103 GetAsyncKeyState user32.dll "00:48:42.687" RX=0 PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp"), Found reference to API "83556300238 584 103 GetAsyncKeyState user32.dll "00:48:42.687" RX=0 PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp"), Found reference to API "83556222028 584 103 GetAsyncKeyState user32.dll "00:48:42.687" RX=0 PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp"), Found reference to API "83556377686 584 103 GetAsyncKeyState user32.dll "00:48:42.687" RX=0 PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp"), Found reference to API "83556609274 584 104 GetKeyState user32.dll "00:48:42.687" RX=0 PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp"), Found reference to API "83556647068 584 104 GetKeyState user32.dll "00:48:42.687" RX=0 PX=0" (Indicator: "GetKeyState"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp")42:T9e4,"" (Indicator: "GetDC"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp")45:T652,Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; File: "00000000-00007164.00000000.185302.01741000.00000020.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00007164.00000000.185302.01741000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00007164.00000000.185302.01759000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007164.00000000.185302.01759000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00007164.00000000.185302.01759000.00000002.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp")46:T476,"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin "Software\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin "ARE\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007924.00000000.185132.00182000.00000002.mdmp "OFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007924.00000000.185132.00182000.00000002.mdmp "KEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007924.00000000.185132.00182000.00000002.mdmp "oftware\Microsoft\Windows\CurrentVersion\Uninstall" (Indicator: "microsoft\windows\currentversion\uninstall") in Source: 00000000-00007924.00000000.185132.00182000.00000002.mdmp47:T832,Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found string "C:\\WINDOWS\\system32\\drivers\\etc\\hosts" (Indicator: "\drivers\"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found string "INDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; File: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found string "INDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; File: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007164.00000000.185302.013C0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00007164.00000000.185302.013C0000.00000004.mdmp") Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp, 00000000-00007924.00000001.187052.0270A000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00007924.00000001.187052.02692000.00000004.mdmp, 00000000-00007924.00000001.187052.0270A000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00007924.00000001.187052.0270A000.00000004.mdmp")48:T442,Found reference to API "_SystemParametersInfo" (Indicator: "SystemParametersInfo"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found reference to API "SystemParametersInfo" (Indicator: "SystemParametersInfo"; File: "6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00007164.00000000.185302.013C0000.00000004.mdmp") Found reference to API "_SystemParametersInfo" (Indicator: "SystemParametersInfo"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp") Found reference to API "SystemParametersInfo" (Indicator: "SystemParametersInfo"; Source: "00000000-00007924.00000000.185132.00182000.00000002.mdmp")49:Ta00,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007924.00000000.185132.02620000.00000004.mdmp, 00000000-00007924.00000001.187052.02620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n file/memory contains long string with (Indicator: \"HashAlgorithm\"; File: \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\")\n file/memory contains long string with (Indicator: \"MD5CryptoServiceProvider\"; File: \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"\n Observed function \"System.Reflection.Load\" in \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - winmgmts:\\\\.\\root\\SecurityCenter2; Source: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n Found string - inmgmts:\\\\.\\root\\SecurityCenter2; Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"\"netsh.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\CACHEMGR\\PUBLICATION\")\n \"netsh.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\CACHEMGR\\PUBLICATION\")\n \"netsh.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\CACHEMGR\\PUBLICATION\")\n \"netsh.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\PEERDIST\\HANDLEMGR\")\n \"netsh.exe\" (Access type: \"OPEN\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS NT\\CURRENTVERSION\\PEERDIST\\HANDLEMGR\")","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$23","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput_\" (Indicator: \"BlockInput\"; File: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n Found reference to API \"BlockInput_1\" (Indicator: \"BlockInput\"; File: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n Found reference to API \"BlockInput_\" (Indicator: \"BlockInput\"; Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")\n Found reference to API \"BlockInput_1\" (Indicator: \"BlockInput\"; Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00007164-48872-15-01749AC0\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00007164-48872-18-01749870","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"n=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007924.00000000.185132.02620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"ToBase64String\" in \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"\n Observed function \"FromBase64String\" in \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"\n Observed function \"ToBase64String\" in \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"\n Observed function \"FromBase64String\" in \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$24","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n file/memory contains long string with (Indicator: \"FromBase64String\"; File: \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"]\n Observed namespace \"System.Security.Cryptography\" in [Source: \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"n=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00007924.00000000.185132.02620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption/decryption using RSA algorithm","description":"Found string \"\"Uses RsaCryptoServiceProvider to e\" (Indicator: \"RSACryptoServiceProvider\"; Source: \"00000000-00007924.00000000.185132.02620000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573.002","relevance":1,"id":"string-352","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Detected Suricata alert – Encrypted channel\n Matched sigs: Contains ability to perform encryption/decryption using RSA algorithm\n Matched sigs: Able to decode string content at runtime (.NET)\n Matched sigs: Contains ability to perform crypto operations\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\" at offset 2844; code bytes = 8030\n Found XOR loop in file \"Microsoft Corporation.exe\" at offset 2844; code bytes = 8030\n Found XOR loop in file \"Microsoft Corporation.exe.bin\" at offset 2844; code bytes = 8030\n Found XOR loop in file \"sample.bin\" at offset 2844; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007924-00000C2C-1840966254\")\n Found reference to API \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007924-00000C2C-1840966291\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetDirectories\" in \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"\n Observed dotnet function \"GetFiles\" in \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"\n Observed dotnet function \"GetLogicalDrives\" in \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"\n Observed dotnet function \"GetDirectories\" in \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"\n Observed dotnet function \"GetFiles\" in \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"\n Observed dotnet function \"GetLogicalDrives\" in \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"file/memory contains long string(File: \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\")\n Found string \"CredUIParseUserNameW\" (Source: \"00000000-00007164.00000000.185302.01741000.00000020.mdmp\")\n Found string \"IOSVersion\" (Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")\n Found string \"GetDrives\" (Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp, 00000000-00007924.00000000.185132.02620000.00000004.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007924-00000C2C-1840966254\")\n Found string \"NtQuerySystemInformationW\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007924-00000C2C-1840966291\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\")\n Found string \"KEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007924.00000000.185132.00182000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"6106f3f8d2d2f05b8ae28ac535fde17ac06deba64fc7dd5e0f9168700dd0c97f.bin\"\n Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"b3caa53f7f8dd6c95c387107c7cd22b7Windows Update.exe\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007924-00000C2C-1833851426\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007924-00000C2C-1833851918\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007164.00000000.185302.01759000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007924.00000001.187052.02707000.00000004.mdmp, 00000000-00007924.00000001.187052.0270A000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007924.00000001.187052.02707000.00000004.mdmp, 00000000-00007924.00000001.187052.0270A000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00007924.00000001.187052.0270A000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00007164.00000000.185302.013C0000.00000004.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00007164.00000000.185302.013C0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"699b007eb0d91a3e7b013083"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"