26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4a8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win32_HackTool_Agent_NGX Sample 724b24082b06… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 724b24082b06…. Malware family: Win32_HackTool_Agent_NGX. Threat score 100/100. 7/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/724b24082b064c4857039e906a643153aa4099e35c0d72dd9afcd2eaf574a137","keywords":["Malicious","Win32_HackTool_Agent_NGX","malware analysis","sandbox report","threat intelligence","724b24082b064c4857039e906a643153aa4099e35c0d72dd9afcd2eaf574a137"],"about":{"@type":"SoftwareApplication","name":"mport.exe","applicationCategory":["peexe","executable"],"identifier":"724b24082b064c4857039e906a643153aa4099e35c0d72dd9afcd2eaf574a137","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win32_HackTool_Agent_NGX","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":3,"suspicious":5},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T9f6,".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001800000043f1441f (UID: 00000000-00002712) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b0020003100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002712) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b00200031000000120030546e6de70d2672feffffffa0fc12002b616d6d50fc1200fc594000fc59400044616d6dd4fc120000000000000000000000000000000000000000000000000001000000000000000000e17500000000c0fc1200000000000000000000000000d4fc1200000000000000000000000000000000002bf0441fc8fc1200186d8175373630312a6d81750000e175ffb8581ffcfc1200d1fa4276dcfc1200d45540000000000010fd120067fd12002c584000485a400059fe1200bd00000018fe12004200000008fd1200cd91e475060000000100000024000000140a6f0018fe1200 (UID: 00000000-00002712) ".exe" called "RtlGetVersion" with parameter 1c0100000600000001000000b11d000002000000530065007200760069006300650020005000610063006b002000310000000000ff07000000001a00000000007f070000c4001a00902d1a0080250000f4ef0e0067e58f7700001a00e0531d000000000000001a0000000000e0531d00000000007e24005a7e240000f85b1d00c4001a00a0f11c00003b000000001a0000000000e0531d00ecf00e000464927738011a00e06392776dda9b770000000000001a00e8531d0000000000000000000000000000000000ff07000000000000802500a5c4001a000100000000001a00902d1a0008000000e8531d00e8531d00e3531d00000000000000000000001a00e3fc5801b0ef0e000300000040f10e0095e18e77 (UID: 00000000-00002712)28:T46f,".exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter GetModuleFileNameExA (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter GetProcessImageFileNameA (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter GetNativeSystemInfo (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter GetProductInfo (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter GetExtendedTcpTable (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter GetExtendedUdpTable (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter WSACleanup (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter htons (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter WSAStartup (UID: 00000000-00002712) ".exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00002712)29:T27b0,Found reference to API (Indicator: "GetProcAddress"; File: "mport.bin") Found reference to API (Indicator: "GetModuleHandleA"; File: "mport.bin") Found reference to API (Indicator: "UnmapViewOfFile"; File: "mport.bin") Found reference to API (Indicator: "DeviceIoControl"; File: "mport.bin") Found reference to API (Indicator: "DuplicateHandle"; File: "mport.bin") Found reference to API (Indicator: "OpenProcess"; File: "mport.bin") Found reference to API (Indicator: "CreateEventA"; File: "mport.bin") Found reference to API (Indicator: "GetCurrentProcessId"; File: "mport.bin") Found reference to API (Indicator: "CloseHandle"; File: "mport.bin") Found reference to API (Indicator: "MapViewOfFile"; File: "mport.bin") Found reference to API (Indicator: "GetCurrentProcess"; File: "mport.bin") Found reference to API (Indicator: "LoadLibraryA"; File: "mport.bin") Found reference to API (Indicator: "QueryDosDeviceA"; File: "mport.bin") Found reference to API (Indicator: "GetVersionExA"; File: "mport.bin") Found reference to API (Indicator: "GetLastError"; File: "mport.bin") Found reference to API (Indicator: "LocalFree"; File: "mport.bin") Found reference to API (Indicator: "FreeLibrary"; File: "mport.bin") Found reference to API (Indicator: "GetProcessHeap"; File: "mport.bin") Found reference to API (Indicator: "Sleep"; File: "mport.bin") Found reference to API (Indicator: "IsBadReadPtr"; File: "mport.bin") Found reference to API (Indicator: "GetSystemInfo"; File: "mport.bin") Found reference to API (Indicator: "GetSystemMetrics"; File: "mport.bin") Found reference to API (Indicator: "AdjustTokenPrivileges"; File: "mport.bin") Found reference to API (Indicator: "OpenProcessToken"; File: "mport.bin") Found reference to API (Indicator: "LookupPrivilegeValueA"; File: "mport.bin") Found reference to API (Indicator: "GetProcessImageFileNameA"; File: "mport.bin") Found reference to API (Indicator: "ZwOpenFile"; File: "mport.bin") Found reference to API (Indicator: "ZwOpenSection"; File: "mport.bin") Found reference to API (Indicator: "RtlInitUnicodeString"; File: "mport.bin") Found reference to API (Indicator: "NtQuerySystemInformation"; File: "mport.bin") Found reference to API (Indicator: "AllocateAndGetUdpExTableFromStack"; File: "mport.bin") Found reference to API (Indicator: "AllocateAndGetTcpExTableFromStack"; File: "mport.bin") Found reference to API (Indicator: "GetExtendedUdpTable"; File: "mport.bin") Found reference to API (Indicator: "GetExtendedTcpTable"; File: "mport.bin") Found reference to API (Indicator: "WSAStartup"; File: "mport.bin") Found reference to API (Indicator: "htons"; File: "mport.bin") Found reference to API (Indicator: "WSACleanup"; File: "mport.bin") Found reference to API (Indicator: "GetModuleFileNameExA"; File: "mport.bin") Found reference to API (Indicator: "GetProductInfo"; File: "mport.bin") Found reference to API (Indicator: "GetNativeSystemInfo"; File: "mport.bin") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "UnmapViewOfFile"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "DeviceIoControl"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "DuplicateHandle"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "CreateEventA"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "MapViewOfFile"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "QueryDosDeviceA"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetVersionExA"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "LocalFree"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "IsBadReadPtr"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetSystemInfo"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetSystemMetrics"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "OpenProcessToken"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "LookupPrivilegeValueA"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API (Indicator: "GetProcessImageFileNameA"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "ZwOpenFile"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "ZwOpenSection"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "RtlInitUnicodeString"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "NtQuerySystemInformation"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndGetUdpExTableFromStack"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "AllocateAndGetTcpExTableFromStack"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "GetExtendedUdpTable"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "GetExtendedTcpTable"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "WSAStartup"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "htons"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "WSACleanup"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "GetModuleFileNameExA"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "GetProductInfo"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API (Indicator: "GetNativeSystemInfo"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp")2a:T6f8,".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED\MACHINELANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\MUI\SETTINGS"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\LANGUAGECONFIGURATION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE\TRACING"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\OLEAUT"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") ".exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "")2b:Tb70,".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\SIDEBYSIDE"; Key: "PREFEREXTERNALMANIFEST"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORSYSTEMHEAPISPRIVATE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "CWDILLEGALINDLLSEARCH"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "COMPATDLL"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: "00060101.00060101"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\GRE_INITIALIZE"; Key: "DISABLEMETAFILES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\COMPATIBILITY32"; Key: "MPORT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\WINDOWS"; Key: "LOADAPPINIT_DLLS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\RPC"; Key: "MAXRPCSIZE"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\COMPUTERNAME\ACTIVECOMPUTERNAME"; Key: "COMPUTERNAME"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "OOBEINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\SQMCLIENT\WINDOWS"; Key: "CEIPENABLE"; Value: "")2c:T4c2,".exe" trying to touch file "C:\Windows\SYSTEM32\sechost.dll" ".exe" trying to touch file "C:\Windows\system32\IMM32.DLL" ".exe" trying to touch file "C:\Windows\Temp\VxOle32.dll" ".exe" trying to touch file "C:\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\FLTLIB.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-synch-l1-2-0.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-fibers-l1-1-1.DLL" ".exe" trying to touch file "C:\Windows\system32\api-ms-win-core-localization-l1-2-1.DLL" ".exe" trying to touch file "\FileSystem\Filters\FltMgrMsg" ".exe" trying to touch file "C:\iphlpapi.dll" ".exe" trying to touch file "C:\Windows\system32\iphlpapi.dll" ".exe" trying to touch file "C:\WINNSI.DLL" ".exe" trying to touch file "C:\Windows\system32\WINNSI.DLL" ".exe" trying to touch file "\Device\Nsi" ".exe" trying to touch file "C:\Windows\System32\sechost.dll" ".exe" trying to touch file "C:\Windows\System32\imm32.dll"2d:Tcc3,Found string "\Device\HarddiskVolume" (Indicator: "\Device\"; File: "mport.bin") Found string "\Device\Udp" (Indicator: "\Device\"; File: "mport.bin") Found string "\Device\Tcp" (Indicator: "\Device\"; File: "mport.bin") Found string "\Device\PhysicalMemory" (Indicator: "\Device\"; File: "mport.bin") Found string "\Device\Udp" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found string "\Device\Tcp" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found string "\Device\PhysicalMemory" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found string "\Device\HarddiskVolume" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 0" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 0" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] SEQPACKET 3" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{FC9EBB92-F38F-4C0F-9BB2-4E5E64704E72}] DATAGRAM 3" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] SEQPACKET 1" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}] DATAGRAM 1" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] SEQPACKET 2" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9644B684FBA5}] DATAGRAM 2" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp") Found string "MSAFD NetBIOS [\Device\NetBT_Tcpip6_{90A066FE-591C-47F3-850D-9" (Indicator: "\Device\"; Source: "00000000-00002712.00000000.66043.015C0000.00000004.mdmp, 00000000-00002712.00000000.66050.015C0000.00000004.mdmp")2e:T405,Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "mport.bin") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "mport.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; File: "mport.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00002712.00000000.66043.001A0000.00000004.mdmp, 00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.001A0000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp")2f:Ta0e,".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "WINSOCK_REGISTRY_VERSION"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS"; Key: "NAMESPACE_CALLOUT"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "SERIAL_ACCESS_NUM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NEXT_CATALOG_ENTRY_ID"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9"; Key: "NUM_CATALOG_ENTRIES"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000001"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000002"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000003"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000004"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000005"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000006"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000007"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000008"; Key: "PACKEDCATALOGITEM"; Value: "") ".exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK2\PARAMETERS\PROTOCOL_CATALOG9\CATALOG_ENTRIES\000000000009"; Key: "PACKEDCATALOGITEM"; Value: "")30:T477,Found string "GetProcessImageFileNameA" (Source: mport.bin, API is part of module: PSAPI.DLL) Found string "ZwOpenFile" (Source: mport.bin, API is part of module: NTDLL.DLL) Found string "ZwOpenSection" (Source: mport.bin, API is part of module: NTDLL.DLL) Found string "RtlInitUnicodeString" (Source: mport.bin, API is part of module: NTDLL.DLL) Found string "NtQuerySystemInformation" (Source: mport.bin, API is part of module: NTDLL.DLL) Found string "GetExtendedUdpTable" (Source: mport.bin, API is part of module: IPHLPAPI.DLL) Found string "GetExtendedTcpTable" (Source: mport.bin, API is part of module: IPHLPAPI.DLL) Found string "WSAStartup" (Source: mport.bin, API is part of module: WS2_32.DLL) Found string "htons" (Source: mport.bin, API is part of module: WS2_32.DLL) Found string "WSACleanup" (Source: mport.bin, API is part of module: WS2_32.DLL) Found string "GetModuleFileNameExA" (Source: mport.bin, API is part of module: PSAPI.DLL) Found string "GetProductInfo" (Source: mport.bin, API is part of module: KERNEL32.DLL) Found string "GetNativeSystemInfo" (Source: mport.bin, API is part of module: KERNEL32.DLL)31:T590,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD80lEQVR4Xu2W21cTVxTG/b/6Tq22VuSi4DWiLXYtXAoiIOiChNwDMQawSDCESwiEgNTWVmpfbSH2wSf7ZN/oCyHJZGYyueDXfWZIMkwyQmwXfaiz1rfO5JyZs3/7O/ucyZEjH6//+rI63RgYtB2qBi0OFAEsNgf+eLuJ12/+JL39V/V1t6diyyBKDtiH8et69B9pfeMVNqK/Y+OVonW6/436mLTPMu0BMJkdSAlpZDMSMlL6A6S8J1WQ9lkWQ8zktAB2ufMwVQaQy+flgbW1l3jxy+sDae3nl8jnsrKi0WhFFTL/5NqULHZfESC/C8AmrutbQv3dMBr6F9FoXMBpcwhnrCE0O4NoHprDOc8Mznun5Wf/2txEJi2UWa1VVQCXbKswOJ7A4FxBy/AyrngiuOpdwldji2gdX8A1Xwjf+OdVAHxZ5lU5wH7sqADavD+gbfR7XH/4FDcekXyraPc/QUdgBbdml9EZjKBrIVwEyBIAm1iSRKVNK63WgRrTqD4ALyoDbNKuyefo8f+EnsCP6J19hpsU/Lo/jNbJIC5P+GHwTaJlylcCEIWyzLUOsOAnHzr1ATheLAIYgy9wb+45WkZCOGGbwKeWEXzmeIDjQx58ft+NE94hnBxzqgB2HaDM5e3HWo0LLHjzXP/BANoff4fj5nHUDI7iqM2LY04KPnwfXzwYxpejLnmyU4/sKoBUWeZaB1jw1mdt+gApFUCNcUzJ2k7Bi1lT8DEXar914NSEDfWPLXtqQKLDKC3q7wYW/P0AQgngqHXXcpa1h4KPDMlZ147bUeezosFvxumAqbQLxP13wQEASkV4zEVZu1WWs6zJ8vpJKxqnBnFm2ogmsrQIIPBVHeP7AqgLrXbcgTqyvIEsbwxQ8JkBWs97OBfqq+ocqApAXWj1BcunTWia7cfZ4F2cX+jFxXD3HoDM7g7QBqukfQHUhSZbPmNUsp7vw4XFO7i41A3DcmcRIE01wApQu/WYWJ9IYxzHIZFIIJmI7w+gLrSm2QHKmlneiwvhHlyKdOHySidaVjuKANJ7tqGUpnkJMJlMIB6PIxHf1gFQnYTqQjs7zyy/I1tuiNym4LdwZbUdV5/eUAFwFbMvOCBQkbLMY7EYtrdjlQEEUfmjMD2zLE98EE0FIsoSCPpFKPA8UlySAm8rADEdgGRKcYB929mk1UhIlRxgLasHnk+BSynrzrLe2tqSpQsQ59LyJxk7GWQlHkAWyFNfRkCOhB2J+t6Rdkh5ZRwZvMspRVY4/9OiCJ4cSVFwjjJP0Nqz9S+IuaELwAYOS3sA2H/0vgGz3PkhMtH7FrsLdpcbVocbZqsTxgrPqXWz43YJ4OP1v7/+BnvlpAT3X7SfAAAAAElFTkSuQmCC1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"724b24082b064c4857039e906a643153aa4099e35c0d72dd9afcd2eaf574a137","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790710946230,"unified_at":"2026-09-29T19:42:26.230Z","metadata":{"hashes":{"sha256":"724b24082b064c4857039e906a643153aa4099e35c0d72dd9afcd2eaf574a137","sha1":"6b9a0538692f839affb7d117afd91306c06e7058","md5":"cc96345a3fd91da5bb6b8d219c5c0c6b","sha512":"1f57fb5c00b1b2f5152b3ee6144834e7b1fa16f0a97519118b3bef5f3a57944c85e65bf70926fa843d1c6093b05434f7fc1dd801ed16a8a22059ef720336a570","ssdeep":"384:Lnxwp7PW+gk7AzrYlv5LJ6vfxHVTY6tc4dCecfYsRs51y2Z7Rfmv2:yJu+57OsMfxHVNdCe","ssdeep_chunks":["384:Lnxwp7P","384:nxwp7PW","384:xwp7PW+","384:wp7PW+g","384:p7PW+gk","384:7PW+gk7","384:PW+gk7A","384:W+gk7Az","384:+gk7Azr","384:gk7AzrY","384:k7AzrYl","384:7AzrYlv","384:AzrYlv5","384:zrYlv5L","384:rYlv5LJ","384:Ylv5LJ6","384:lv5LJ6v","384:v5LJ6vf","384:5LJ6vfx","384:LJ6vfxH","384:J6vfxHV","384:6vfxHVT","384:vfxHVTY","384:fxHVTY6","384:xHVTY6t","384:HVTY6tc","384:VTY6tc4","384:TY6tc4d","384:Y6tc4dC","384:6tc4dCe","384:tc4dCec","384:c4dCecf","384:4dCecfY","384:dCecfYs","384:CecfYsR","384:ecfYsRs","384:cfYsRs5","384:fYsRs51","384:YsRs51y","384:sRs51y2","384:Rs51y2Z","384:s51y2Z7","384:51y2Z7R","384:1y2Z7Rf","384:y2Z7Rfm","384:2Z7Rfmv","384:Z7Rfmv2","768:Lnxwp7P","768:nxwp7PW","768:xwp7PW+","768:wp7PW+g","768:p7PW+gk","768:7PW+gk7","768:PW+gk7A","768:W+gk7Az","768:+gk7Azr","768:gk7AzrY","768:k7AzrYl","768:7AzrYlv","768:AzrYlv5","768:zrYlv5L","768:rYlv5LJ","768:Ylv5LJ6","768:lv5LJ6v","768:v5LJ6vf","768:5LJ6vfx","768:LJ6vfxH","768:J6vfxHV","768:6vfxHVT","768:vfxHVTY","768:fxHVTY6","768:xHVTY6t","768:HVTY6tc","768:VTY6tc4","768:TY6tc4d","768:Y6tc4dC","768:6tc4dCe","768:tc4dCec","768:c4dCecf","768:4dCecfY","768:dCecfYs","768:CecfYsR","768:ecfYsRs","768:cfYsRs5","768:fYsRs51","768:YsRs51y","768:sRs51y2","768:Rs51y2Z","768:s51y2Z7","768:51y2Z7R","768:1y2Z7Rf","768:y2Z7Rfm","768:2Z7Rfmv","768:Z7Rfmv2","384:yJu+57O","384:Ju+57Os","384:u+57OsM","384:+57OsMf","384:57OsMfx","384:7OsMfxH","384:OsMfxHV","384:sMfxHVN","384:MfxHVNd","384:fxHVNdC","384:xHVNdCe"],"imphash":"eade841928b743f149366188e35c96e4"},"file_info":{"file_name":"mport.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":14336,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1617186991000,"last_seen":1691569560000,"last_multi_scan":1691569560000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":7,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":22},"sandbox_signatures":{"informative_count":52,"suspicious_count":5,"malicious_count":3,"total":60},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win.ShadowForce","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"HackTool/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Hacktool.dteto","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"Win32/HackTool.Agent.NGX trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.Agent.Win32.61122","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win32_HackTool_Agent_NGX","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)"},{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to create/control drivers (API string)"},{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1547.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1547/006","identifiers":[{"type":"malicious","value":"Contains ability to start/interact with device drivers"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"informative","value":"Contains ability to modify access token privileges (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to impersonate access tokens (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Privilege Escalation","technique":"Make and Impersonate Token","attack_id":"T1134.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/003","identifiers":[{"type":"suspicious","value":"Contains ability to adjust token privileges"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Found PE header in memory"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the specified system metric or system configuration setting (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to retrieve information about the current system"},{"type":"informative","value":"Calls an API typically used to retrieve OS information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Contains ability to retrieve information about MS-DOS device names (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process (API string)"},{"type":"informative","value":"Contains ability to retrieve/open a process"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Touches files"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"},{"type":"informative","value":"Contains registry location strings"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Discovery","technique":"System Network Connections Discovery","attack_id":"T1049","attack_id_wiki":"https://attack.mitre.org/techniques/T1049","identifiers":[{"type":"informative","value":"Contains ability to retrieve list of TCP/UDP endpoints (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contains ability to communicate with network (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"tactic":"Command and Control","technique":"Non-Application Layer Protocol","attack_id":"T1095","attack_id_wiki":"https://attack.mitre.org/techniques/T1095","identifiers":[{"type":"informative","value":"Contains ability to communicate with C2 using Sockets (API string)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to impersonate access tokens (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"mport.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-306","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"mport.bin\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"mport.bin\")\n Found reference to API \"LoadLibrary( NTDLL.DLL )\" (Indicator: \"LoadLibrary\"; File: \"mport.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"LoadLibrary( NTDLL.DLL )\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002712.00000000.66043.00400000.00000002.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002712.00000000.66050.00400000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00002712)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to retrieve OS information","description":"\".exe\" called \"GetVersionExA\" with parameter 9c0000000600000001000000b11d00000200000053657276696365205061636b2031000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00002712)","origin":"API Call","mitre_attack_id":"T1082","relevance":2,"id":"api-222","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve information about the current system (API string)","description":"Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; File: \"mport.bin\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; File: \"mport.bin\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; File: \"mport.bin\")\n Found reference to API \"GetSystemInfo\" (Indicator: \"GetSystemInfo\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"QuerySystemInformation\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")\n Found reference to API \"GetNativeSystemInfo\" (Indicator: \"GetNativeSystemInfo\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; File: \"mport.bin\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; File: \"mport.bin\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersionExA\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"GetVersionExA\" (Indicator: \"GetVersion\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve/open a process","description":"OpenProcessToken@ADVAPI32.DLL at 00000000-00002712-2962-4-00401130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1057","relevance":1,"id":"stream-31","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\".exe\" called \"LoadLibrary\" with a parameter iphlpapi.dll (UID: 00000000-00002712)\n \".exe\" called \"LoadLibrary\" with a parameter WS2_32.DLL (UID: 00000000-00002712)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Contains ability to create/control drivers (API string)","description":"Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; File: \"mport.bin\")\n Found reference to API \"DeviceIoControl\" (Indicator: \"DeviceIoControl\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-220","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"ZwOpenFile\" (Indicator: \"ZwOpenFile\"; File: \"mport.bin\")\n Found reference to API \"ZwOpenFile\" (Indicator: \"ZwOpenFile\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: mport.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00002712-2962-4-00401130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"mport.bin\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"mport.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; File: \"mport.bin\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcess\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"mport.bin\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Registry\\Machine\\System\\CurrentControlSet\\Control\\Keyboard Layout\" in Source: 00000000-00002712.00000000.66043.7F6F0000.00000002.mdmp\n 00000000-00002712.00000000.66050.7F6F0000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"IPHLPAPI.DLL\" at base 74d30000\n \".exe\" loaded module \"WS2_32.DLL\" at base 764b0000\n \".exe\" loaded module \"KERNEL32.DLL\" at base 75e10000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\".exe\" loaded module \"%WINDIR%\\System32\\rpcrt4.dll\" at 77820000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Looks up procedures from modules (excluding apphelp.dll, kernel32.dll, user32.dll, gdi32.dll, ole32.dll, comctl32.dll, uxtheme.dll, oleaut32.dll, version.dll, msctfime.ime)","description":"\"14001500bc554000@PSAPI.DLL\"\n \"18001900e4504000@PSAPI.DLL\"\n \"0d000e0018d16f6d@iphlpapi.dll\"\n \"0f00100048d16f6d@iphlpapi.dll\"\n \"0c000d0064d16f6d@iphlpapi.dll\"\n \"150016003cca6f6d@ADVAPI32.dll\"\n \"0e000f00b4ca6f6d@ADVAPI32.dll\"\n \"0e000f00e8ca6f6d@ADVAPI32.dll\"\n \"1100120048cf6f6d@ADVAPI32.dll\"\n \"11001200b4cf6f6d@ADVAPI32.dll\"\n \"12001300c8cf6f6d@ADVAPI32.dll\"\n \"12001300f0cf6f6d@ADVAPI32.dll\"\n \"14001500d4e46f6d@ADVAPI32.dll\"\n \"14001500ece46f6d@ADVAPI32.dll\"\n \"1400150004e56f6d@ADVAPI32.dll\"\n \"170018001ce56f6d@ADVAPI32.dll\"\n \"0d000e0034e56f6d@ADVAPI32.dll\"\n \"0f00100060e66f6d@ADVAPI32.dll\"\n \"14001500a0e66f6d@ADVAPI32.dll\"\n \"14001500b8e66f6d@ADVAPI32.dll\"\n \"0c000d0000e76f6d@ADVAPI32.dll\"\n \"0c000d0010e76f6d@ADVAPI32.dll\"\n \"0e000f0020e76f6d@ADVAPI32.dll\"\n \"1800190088e86f6d@RPCRT4.dll\"\n \"13001400b4e86f6d@RPCRT4.dll\"","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-8","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"mport.bin\" was detected as \"EP:Microsoft Visual C/C++\" and name: \"Compiler\"\n \"mport.bin\" was detected as \"Microsoft Visual C/C++\" and name: \"Compiler\"\n \"mport.bin\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"mport.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"mport.bin\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"mport.bin\" file has an entrypoint instructions - \"push\tebp,mov\tebp, esp,push\t-1,push\t0x4040c8,push\t0x4030d0,mov\teax, dword ptr fs:[0],push\teax,mov\tdword ptr fs:[0], esp,sub\tesp, 0x20,push\tebx,push\tesi,push\tedi,mov\tdword ptr [ebp - 0x18], esp,and\tdword ptr [ebp - 4], 0,push\t1,call\tdword ptr [0x4040ac],pop\tecx,or\tdword ptr [0x405b54], 0xffffffff,or\tdword ptr [0x405b58], 0xffffffff,call\tdword ptr [0x4040a8],mov\tecx, dword ptr [0x405b50],mov\tdword ptr [eax], ecx,call\tdword ptr [0x4040a4],mov\tecx, dword ptr [0x405b4c],mov\tdword ptr [eax], ecx,mov\teax, dword ptr [0x4040a0],mov\teax, dword ptr [eax],\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"mport.bin\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"mport.bin\")\n Found reference to API \"LoadLibrary( NTDLL.DLL )\" (Indicator: \"LoadLibrary\"; File: \"mport.bin\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"LoadLibrary( NTDLL.DLL )\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\".exe\" creates a thread in process \"-1\" (Handle: 4294967295)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\".exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-fibers-l1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\system32\\api-ms-win-core-localization-l1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\iphlpapi.dll\"\n \".exe\" trying to access non-existent file \"C:\\WINNSI.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-FIBERS-L1-1-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\Windows\\System32\\API-MS-WIN-CORE-LOCALIZATION-L1-2-1.DLL\"\n \".exe\" trying to access non-existent file \"C:\\IPHLPAPI.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"mport.bin\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"mport.bin\")\n Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; File: \"mport.bin\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"mport.bin\")\n Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" with parameters {\"lpSystemInfo\": \"000000000010000000000100fffffe7f03000000040000004a020000000001000600004f\"}","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"mport.bin\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"mport.bin\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"mport.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"mport.bin\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"mport.bin\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; File: \"mport.bin\")\n Found reference to API \"QueryDosDeviceA\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"Fail To Load GetModuleFileNameEx API\" (Indicator: \"GetModuleFileName\"; File: \"mport.bin\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; File: \"mport.bin\")\n Found reference to API \"Fail To Load GetModuleFileNameEx API\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")\n Found reference to API \"GetModuleFileNameExA\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"mport.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; File: \"mport.bin\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; File: \"mport.bin\")\n Found reference to API \"OpenProcessToken\" (Indicator: \"OpenProcessToken\"; Source: \"00000000-00002712.00000000.66043.00404000.00000002.mdmp, 00000000-00002712.00000000.66050.00404000.00000002.mdmp\")\n Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002712.00000000.66043.00405000.00000004.mdmp, 00000000-00002712.00000000.66050.00405000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$2f","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"mport.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleA@KERNEL32.DLL at 00000000-00002712-2962-2-00401000","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"24/71 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"suspicious","category":"System Security","name":"Contains ability to adjust token privileges","description":"LookupPrivilegeValueA@ADVAPI32.DLL at 00000000-00002712-2962-4-00401130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1134.003","relevance":5,"id":"stream-76","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"OpenProcessToken\n DeviceIoControl\n LoadLibraryA\n MapViewOfFile\n GetModuleHandleA\n OpenProcess\n Sleep\n GetVersionExA\n GetProcAddress\n GetSystemInfo","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"24/71 Antivirus vendors marked sample as malicious (33% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]},{"level":"malicious","category":"General","name":"Contains ability to start/interact with device drivers","description":"DeviceIoControl@KERNEL32.DLL at 00000000-00002712-2962-4-00401130","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1547.006","relevance":8,"id":"stream-21","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]}],"incidents":[{"name":"Evasive","details_count":2,"details":[{"detail":"Contains ability to adjust token privileges"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":23,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sandbox_reports":[{"id":"64d348371a560540ad087158","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Hacktool.dteto","submit_name":"mport.exe","analysis_start_time":"2023-08-09T08:03:04+00:00","indicators_count":{"informative":52,"suspicious":7,"malicious":3},"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}],"processes":[{"pid":2712,"ppid":0,"name":"mport.exe","command_line":"","sha256":"724b24082b064c4857039e906a643153aa4099e35c0d72dd9afcd2eaf574a137","normalized_path":"C:\\mport.exe","uid":"00000000-00002712","icon":"$31"}],"all_imported_dlls":["lpk.dll","sechost.dll","ole32.dll","psapi.dll","nsi.dll","kernel32.dll","ntdll.dll","usp10.dll","msvcrt.dll","advapi32.dll","fltLib.dll","winnsi.dll","KernelBase.dll","user32.dll","imm32.dll","msctf.dll","oleaut32.dll","api-ms-win-core-synch-l1-2-0.dll","IPHLPAPI.DLL","VxSSL32.dll","gdi32.dll","rpcrt4.dll","ws2_32.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"\\FileSystem\\Filters\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"64d348371a560540ad087158"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["64d348371a560540ad087158"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win32_HackTool_Agent_NGX Sample 724b24082b06… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 724b24082b06…. Malware family: Win32_HackTool_Agent_NGX. Threat score 100/100. 7/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/724b24082b064c4857039e906a643153aa4099e35c0d72dd9afcd2eaf574a137"}],["$","meta","4",{"property":"og:title","content":"Malicious Win32_HackTool_Agent_NGX Sample 724b24082b06… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 724b24082b06…. Malware family: Win32_HackTool_Agent_NGX. Threat score 100/100. 7/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/724b24082b064c4857039e906a643153aa4099e35c0d72dd9afcd2eaf574a137"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win32_HackTool_Agent_NGX Sample 724b24082b06… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 724b24082b06…. Malware family: Win32_HackTool_Agent_NGX. Threat score 100/100. 7/27 AV engines flagged this file. 3 malicious and 5 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L32","11",{}]]