24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 3f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T507,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Shellcode.Loader.Marte.X.Generic Sample 69f28a96c3b1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 69f28a96c3b1…. Malware family: Shellcode.Loader.Marte.X.Generic. Threat score 100/100. 19/27 AV engines flagged this file. 3 malicious and 15 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa","keywords":["Malicious","Shellcode.Loader.Marte.X.Generic","malware analysis","sandbox report","threat intelligence","69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa"],"about":{"@type":"SoftwareApplication","name":"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin","applicationCategory":["peexe","executable"],"identifier":"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Shellcode.Loader.Marte.X.Generic","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":15},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T5d8,Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "NtAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "NtWriteVirtualMemory" (Indicator: "NtWriteVirtualMemory"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00004064.00000000.143150.00EDF000.00000004.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00004064.00000000.143150.00EDF000.00000004.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00004064.00000000.143150.00EDF000.00000004.mdmp")26:T540,Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp, 00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp")27:T492,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp, 00000000-00004064.00000000.143150.00EDF000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp")28:T418,Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp, 00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found string "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/" (Indicator: "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp, 00000000-00004064.00000000.143150.00EA3000.00000002.mdmp")29:T502,"" (Indicator: "GetDC"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "CreateCompatibleBitmap" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "CreateCompatibleDC" (Indicator: "CreateCompatibleDC"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "BitBlt" (Indicator: "BitBlt"; Source: "00000000-00004064.00000000.143150.00EDF000.00000004.mdmp") Found reference to API "GetDC" (Indicator: "GetDC"; Source: "00000000-00004064.00000000.143150.00EDF000.00000004.mdmp")3a:T7d7,Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "CreateToolhelp32Snapshot" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp, 00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "GetEnvironmentStringsW" (Indicator: "GetEnvironmentStrings"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "Process32NextW" (Indicator: "Process32Next"; Source: "00000000-00004064.00000000.143150.00EDF000.00000004.mdmp") Found reference to API "Process32FirstW" (Indicator: "Process32First"; Source: "00000000-00004064.00000000.143150.00EDF000.00000004.mdmp")3b:T416,Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; File: "69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin") Found reference to API "ReadDirectoryChangesW" (Indicator: "ReadDirectoryChange"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "GetFileAttributesA" (Indicator: "GetFileAttributes"; Source: "00000000-00004064.00000000.143150.00BC0000.00000004.mdmp") Found reference to API "GetTempPath2W" (Indicator: "GetTempPath"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00004064.00000000.143150.00EA3000.00000002.mdmp, 00000000-00004064.00000000.143150.00EDF000.00000004.mdmp") Found reference to API "GetFileSize" (Indicator: "GetFileSize"; Source: "00000000-00004064.00000000.143150.00EDF000.00000004.mdmp")3c:T691,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"$28","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$29","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Spawns Windows crash diagnostic and reporting process","description":"Process \"WerFault.exe\" [UID: 00000000-00002468]\n Process \"WerFault.exe\" [UID: 00000000-00003428]","origin":"Monitored Target","mitre_attack_id":"T1564","relevance":1,"id":"target-585","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 615-5389-004198EC\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004064-2146-5-00E68DD0\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004064-2146-45-00E6D3F3\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004064-2146-1364-00E69760\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00004064-2146-1910-00E698DF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found strings in conjunction with a procedure lookup that resolve to a known API export symbol","description":"Found reference to API RegEnumKeyExA@KERNEL32.DLL at 00000000-00004064-2146-1698-00E9F996\n Found reference to API LoadLibraryA@KERNEL32.DLL at 00000000-00004064-2146-1708-00EA08D4\n Found reference to API GetSystemTimePreciseAsFileTime@KERNEL32.DLL at 00000000-00004064-2146-2813-00E685E9","origin":"Hybrid Analysis Technology","relevance":10,"id":"stream-41","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004064-00000C2C-1207466216\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found api reference \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")\n Found api reference \"CryptBinaryToStringA\" (Indicator: \"CryptBinaryToStringA\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")\n Found api reference \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinaryA\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$2a","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"$2b","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to encrypt/encode message (API string)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform decryption (API string)\n Matched sigs: HTTP requests contain Base64 strings\n Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Contains key cryptographic functions of the CryptoAPI","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$2c","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"GetUserNameW\" (Source: \"00000000-00004064.00000000.143150.00EDF000.00000004.mdmp\")\n Found string \"- UserName:\" (Source: \"00000000-00004064.00000000.143150.00EDF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004064.00000000.143150.00EA3000.00000002.mdmp\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00004064.00000000.143150.00EA3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"places.sqlite\" (File: \"00000000-00004064.00000000.143150.00E51000.00000020.mdmp\")\n Found string \"formhistory.sqlite\" (Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")\n Found string \"places.sqlite\" (Source: \"00000000-00004064.00000000.143150.00EDF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatus\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")\n Found reference to API \"GlobalMemoryStatusEx\" (Indicator: \"GlobalMemoryStatusEx\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; File: \"00000000-00004064.00000000.143150.00E51000.00000020.mdmp\")\n Found string \"cookies.sqlite\" (Indicator: \"cookies.sqlite\"; Source: \"00000000-00004064.00000000.143150.00EDF000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve date formats supported by the local system (API string)","description":"Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; File: \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\")\n Found reference to API \"GetDateFormatEx\" (Indicator: \"GetDateFormat\"; Source: \"00000000-00004064.00000000.143150.00EA3000.00000002.mdmp\")\n Found reference to API \"GetTimeFormatEx\" (Indicator: \"GetTimeFormat\"; Source: \"00000000-00004064.00000000.143150.00EA3000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-901","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetEnvironmentStringsW\" in file \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\"\n Found system information discovery API: \"GetUserObjectInformationW\" in file \"69f28a96c3b1f6636691345e01de8ddc54569c5fd479db676b457dc8da1b06aa.bin\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00004064.00000000.143150.00EA3000.00000002.mdmp\"\n Found system information discovery API: \"GetEnvironmentStringsW\" in \"00000000-00004064.00000000.143150.00EA3000.00000002.mdmp\"\n Found system information discovery API: \"GetSystemInfo\" in \"00000000-00004064.00000000.143150.00EDF000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetUserDefaultLangID\" (Indicator: \"GetUserDefaultLangID\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")\n Found reference to API \"GetKeyboardLayoutList\" (Indicator: \"GetKeyboardLayoutList\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00004064.00000000.143150.00BC0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\" Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\" \"jJWFuYwPzTDwufcGS3csuP/4BF1bdrCQqklZ27KksMHiOPRM1LlXBD5VrzgJmjKAm+3kp6XMDbUyvl/b4E9JgJYrNGVcln3dT4cBhrHy+4Tx2TeKEOWNNq/qIpYYiPH5cp8=\" HTTP/1.1 404 Not Found\nServer: nginx/1.18.0 (Ubuntu)\nDate: Wed\n 18 Feb 2026 12:48:08 GMT\nContent-Type: text/html\nContent-Length: 0\nConnection: keep-alive\nLast-Modified: Sun\n 15 Feb 2026 07:11:24 GMT\nETag: \"0-64ad78bca9f00\"\nAccept-Ranges: bytes with no response body","origin":"Network Traffic","mitre_attack_id":"T1041","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 185.123.102.253 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"6995b4ec011df8f5eb058519"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"