26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 3e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4af,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Mint.ZitirezC.Generic Sample 66e164f2a4ea… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 66e164f2a4ea…. Malware family: Mint.ZitirezC.Generic. Threat score 100/100. 16/27 AV engines flagged this file. 5 malicious and 11 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a","keywords":["Malicious","Mint.ZitirezC.Generic","malware analysis","sandbox report","threat intelligence","66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a"],"about":{"@type":"SoftwareApplication","name":"bounty-10505232347628346","applicationCategory":["peexe","executable"],"identifier":"66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Mint.ZitirezC.Generic","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":11},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5ad,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "KeWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003168.00000001.125250.03354000.00000004.mdmp, 00000000-00003168.00000001.125250.053F8000.00000004.mdmp") Found reference to API "KeWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003168.00000001.125250.03354000.00000004.mdmp, 00000000-00003168.00000001.125250.053F8000.00000004.mdmp") Found reference to API "ZwWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003168.00000001.125250.053F8000.00000004.mdmp")28:T576,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "DefaultLCID`T LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003168.00000001.125250.032F3000.00000040.mdmp")29:Ta2d,Assembly shows XOR instruction xor eax ebp in Stream UID: 46429-1166-00407AB5 Assembly shows XOR instruction xor eax ebp in Stream UID: 46429-1303-00409F77 Assembly shows XOR instruction xor ecx ebp in Stream UID: 46429-1303-00409F77 Assembly shows XOR instruction xor eax ebp in Stream UID: 46429-1305-0040B550 Assembly shows XOR instruction xor ecx ebp in Stream UID: 46429-1305-0040B550 Assembly shows XOR instruction xor eax ebp in Stream UID: 46429-1307-0040A22A Assembly shows XOR instruction xor ecx ebp in Stream UID: 46429-1307-0040A22A Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00003168-47616-68-00401F06 Assembly shows XOR instruction xor dword ptr [eax+esi+0Ah] esi in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor dh byte ptr [eax+04h] in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor dh byte ptr [eax+esi-05h] in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor dword ptr [eax+esi*4-04h] esi in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor dword ptr [eax+esi*8-09h] esi in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor dword ptr [eax+edx-07h] esi in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor dword ptr [eax+eax*4-25h] esi in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor byte ptr [esi+5Eh] dl in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor byte ptr [esi-53h] ah in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor esi dword ptr [edx] in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor byte ptr [ecx] al in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor eax dword ptr [eax] in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor al 00h in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor byte ptr [eax] al in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor eax 32004500h in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor al byte ptr [eax] in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor al AAh in Stream UID: 00000000-00003168-47616-73-0040D13F Assembly shows XOR instruction xor al DDh in Stream UID: 00000000-00003168-47616-73-0040D13F2a:T5f6,Found XOR loop in file "sample.bin" at offset 84503; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 151478; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 224266; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 258434; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 339759; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 355805; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 555211; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 556251; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 18098; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 18719; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 59499; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 195010; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 215289; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 286537; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 306489; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 74706; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 111586; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 248701; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 294187; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 404003; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 555172; code bytes = 80302b:T522,Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "GetLocaleInfoA" (Indicator: "GetLocaleInfo"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp") Found reference to API "GetUserDefaultLCID" (Indicator: "GetUserDefaultLCID"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "EnumSystemLocalesW" (Indicator: "EnumSystemLocales"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetLocaleInfoW" (Indicator: "GetLocaleInfo"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp")2c:T461,Found system information discovery API: "GetEnvironmentStringsW" in file "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin" Found system information discovery API: "GetNativeSystemInfo" in file "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin" Found system information discovery API: "GetUserObjectInformationA" in file "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin" Found system information discovery API: "GetUserObjectInformationA" in "00000000-00003168.00000000.124718.00401000.00000020.mdmp" Found system information discovery API: "GetNativeSystemInfo" in "00000000-00003168.00000000.124718.00401000.00000020.mdmp" Found system information discovery API: "GetEnvironmentStringsW" in "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp" Found system information discovery API: "ZwQuerySystemInformation" in "00000000-00003168.00000001.125250.03354000.00000004.mdmp, 00000000-00003168.00000001.125250.053F8000.00000004.mdmp"2d:Tc6f,"" (Indicator: "GetDC"; Source: "00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp")38:T93a,Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp")39:T444,Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; File: "00000000-00003168.00000001.125250.00400000.00000040.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "GetModuleHandleA" (Indicator: "GetModuleHandle"; Source: "00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp")3a:T43c,Found reference to API "ExitProcess" (Indicator: "ExitProcess"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; File: "66e164f2a4ea3b37586ceb2d699aa89e8a9475e9cd25c51476fd0a7d307df76a.bin") Found reference to API "CorExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp") Found reference to API "ExitProcess" (Indicator: "ExitProcess"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp") Found reference to API "TerminateProcess" (Indicator: "TerminateProcess"; Source: "00000000-00003168.00000000.124718.00401000.00000020.mdmp, 00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp")3b:T946,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00003168.00000001.125250.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003168.00000001.125250.032F3000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003168.00000001.125250.05210000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00003168.00000001.125250.053F8000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - \\\\.\\C:; Source: \"00000000-00003168.00000001.125250.00400000.00000040.mdmp\")\n Found string - \\\\.\\PHYSICALDRIVE0; Source: \"00000000-00003168.00000001.125250.00400000.00000040.mdmp\")\n Found string - \\.\\PHYSICALDRIVE0; Source: \"00000000-00003168.00000001.125250.032D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00003168.00000000.124718.032D0000.00000004.mdmp, 00000000-00003168.00000001.125250.032D0000.00000004.mdmp\")\n Found reference to API \"SendMessageA\" (Indicator: \"sendmessage\"; Source: \"00000000-00003168.00000001.125250.00400000.00000040.mdmp, 00000000-00003168.00000001.125250.05210000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"i.gn\"\n Heuristic match: \"gjl.dm\"\n Heuristic match: \".b.bi\"\n Heuristic match: \"`d.bm\"\n Heuristic match: \"c&`c.sa\"\n Heuristic match: \"k;=p.bz\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$37","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \",3025,,RtlGetNtProductType,N\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00003168.00000001.125250.03354000.00000004.mdmp\")\n Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00003168.00000001.125250.053F8000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"ZwQueryValueKey\" in \"00000000-00003168.00000001.125250.03354000.00000004.mdmp, 00000000-00003168.00000001.125250.053F8000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69b04726c1d915efd509b6ed"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"