24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 46:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4ac,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 7c1edf69f6a8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 7c1edf69f6a8…. Malware family: Trojan.Generic. Threat score 100/100. 21/28 AV engines flagged this file. 8 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/7c1edf69f6a8d72fd30fd41b68f1b5d27162b61212e1e7d82ced75de5ad8b6a5","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","7c1edf69f6a8d72fd30fd41b68f1b5d27162b61212e1e7d82ced75de5ad8b6a5"],"about":{"@type":"SoftwareApplication","name":"1869f64ef406711b18c5b7988e88b340.exe.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"7c1edf69f6a8d72fd30fd41b68f1b5d27162b61212e1e7d82ced75de5ad8b6a5","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":21,"total":28},"behavioralIndicators":{"malicious":8,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T66e,Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "RegisterWaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "CreateTimerQueueTimer" (Indicator: "CreateTimerQueueTimer"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp")26:T40a,Found reference to API "MpFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00002512.00000000.152720.6EB21000.00000020.mdmp, 00000000-00002512.00000000.152720.6EBC1000.00000020.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "CreateThreadpool" (Indicator: "CreateThread"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "CreateThreadpoolIo" (Indicator: "CreateThread"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "CreateThreadpoolWait" (Indicator: "CreateThread"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "CreateThreadpoolTimer" (Indicator: "CreateThread"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "CreateThreadpoolWork" (Indicator: "CreateThread"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp")27:T41d,Found reference to API "LoadLibrary" (Indicator: "LoadLibrary"; Source: "00000000-00002488.00000002.156882.00400000.00000040.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002488.00000002.156882.00400000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00002512.00000000.152720.09AA0000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp")28:T27ff,Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found reference to "System.Security.Cryptography.RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesCryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.RSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "RSACng"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.DSACng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "DSACng"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "Aes"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.AesManaged, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "AesManaged"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellman"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDiffieHellmanCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDiffieHellmanCng"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsa"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.ECDsaCng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "ECDsaCng"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider, System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "RandomNumberGenerator" (Indicator: "RandomNumberGenerator"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA256CryptoServiceProvider" (Indicator: "SHA256CryptoServiceProvider"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "SHA384" (Indicator: "SHA384"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384" (Indicator: "SHA384"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384Cng" (Indicator: "SHA384"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA384CryptoServiceProvider" (Indicator: "SHA384CryptoServiceProvider"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512" (Indicator: "SHA512"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512Cng" (Indicator: "SHA512"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to "System.Security.Cryptography.SHA512CryptoServiceProvider" (Indicator: "SHA512CryptoServiceProvider"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp")29:T47e,The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings Matched sigs: Contains ability to use Cryptographic classes Matched sigs: Contains ability to perform encryption (API string) Matched sigs: Contains ability to import cryptographic keys (seen in ransomware) Matched sigs: Contains ability to perform Base64 encoding/decoding Matched sigs: Contains ability to perform decryption (API string) Matched sigs: Contains ability to use Microsoft's Enhanced Cryptographic Provider Matched sigs: Tries to steal crypto wallet extension (string) Matched sigs: Contains reference to cryptographic keys Matched sigs: Able to access crypto wallet extension (string) Matched sigs: Found Crypto currency wallets related strings Matched sigs: Contains ability to decode base64 data Matched sigs: Sample file has high entropy (likely encrypted/compressed content) Matched sigs: Reads the cryptographic machine GUID Matched sigs: Contains ability to decode string content at runtime (Dotnet) Matched sigs: Contains ability to perform crypto operations2a:T43a,Found reference to API "PostMessage" (Indicator: "postmessage"; Source: "00000000-00002512-00000C2B-1382810591") Found reference to API "PostMessageW" (Indicator: "postmessage"; Source: "00000000-00002512-00000C2B-1382810618") Found reference to API "sendMessageChannelCache" (Indicator: "sendmessage"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to API "System.ServiceModel.Activities.Configuration.SendMessageChannelCacheElement, System.ServiceModel.Activities, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35" (Indicator: "sendmessage"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found reference to API "" (Indicator: "enumchildwindows"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp")2b:T1b5d,"" - Source: "00000000-00002512.00000000.152720.6EBC1000.00000020.mdmp")3e:T9e4,"" (Indicator: "GetDC"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00002512.00000000.152720.03130000.00000004.mdmp")41:T724,Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found reference to API "664777754,948,3120,,CreateToolhelp32Snapshot,kernel32.dll,"00:39:47.546",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002488.00000000.153040.02F50000.00000004.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00002488.00000002.156882.00400000.00000040.mdmp, 00000000-00002488.00000002.156882.007F2000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002488.00000002.156882.00400000.00000040.mdmp, 00000000-00002488.00000002.156882.007F2000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00002512.00000000.152720.09AA0000.00000004.mdmp") Found reference to API "GetModuleHandleExW" (Indicator: "GetModuleHandle"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp")42:T90c,Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00002488.00000002.156882.00400000.00000040.mdmp") Found reference to API "GetTempPath" (Indicator: "GetTempPath"; Source: "00000000-00002512.00000000.152720.09AA0000.00000004.mdmp") Found reference to API "GetTempFileName" (Indicator: "GetTempFileName"; Source: "00000000-00002512.00000000.152720.09AA0000.00000004.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002512.00000000.152720.6EB21000.00000020.mdmp") Found reference to API "0GetFileVersionInfoSizeExW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002512.00000000.152720.6EB21000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002512.00000000.152720.6EB21000.00000020.mdmp, 00000000-00002512.00000000.152720.6EBC1000.00000020.mdmp") Found reference to API "GetFileVersionInfoSizeW" (Indicator: "GetFileVersionInfoSize"; Source: "00000000-00002512.00000000.152720.6EB21000.00000020.mdmp, 00000000-00002512.00000000.152720.6EBC1000.00000020.mdmp") Found reference to API "GetFileVersionInfoW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002512.00000000.152720.6EB21000.00000020.mdmp, 00000000-00002512.00000000.152720.6EBC1000.00000020.mdmp") Found reference to API "GetFileVersionInfoExW" (Indicator: "GetFileVersionInfo"; Source: "00000000-00002512.00000000.152720.6EB21000.00000020.mdmp, 00000000-00002512.00000000.152720.6EBC1000.00000020.mdmp") Found reference to API "GetFileAttributesExW" (Indicator: "GetFileAttributes"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "GetFileAttributesW" (Indicator: "GetFileAttributes"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "GetFileSizeEx" (Indicator: "GetFileSize"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp") Found reference to API "GetSystemDirectoryW" (Indicator: "GetSystemDirectory"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp, 00000000-00002512.00000000.152720.6EBD5000.00000002.mdmp")43:Tb10,Found string "secret_id" (Indicator: "secret"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found string "app_secret" (Indicator: "secret"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found string "client_secret" (Indicator: "secret"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found string "secret_key" (Indicator: "secret"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found string "&client_secret=" (Indicator: "secret"; File: "1869f64ef406711b18c5b7988e88b340.exe.bin") Found string "passwordFormat" (Indicator: "password"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found string "passwordAttemptWindow" (Indicator: "password"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found string "passwordStrengthRegularExpression" (Indicator: "password"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found string "passwordFormat="Hashed"" (Indicator: "password"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found string "passwordAttemptWindow="10"" (Indicator: "password"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found string "passwordStrengthRegularExpression="" />" (Indicator: "password"; Source: "00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp") Found string "client_secret=" (Indicator: "secret"; Source: "00000000-00002488.00000002.156882.007F2000.00000002.mdmp") Found string "lient_secret" (Indicator: "secret"; Source: "00000000-00002488.00000002.156882.007F2000.00000002.mdmp") Found string "pp_secret" (Indicator: "secret"; Source: "00000000-00002488.00000002.156882.007F2000.00000002.mdmp") Found string "secret_id" (Indicator: "secret"; Source: "00000000-00002488.00000002.156882.007F2000.00000002.mdmp") Found string "app_secret" (Indicator: "secret"; Source: "00000000-00002488.00000002.156882.007F2000.00000002.mdmp") Found string "client_secret" (Indicator: "secret"; Source: "00000000-00002488.00000002.156882.007F2000.00000002.mdmp") Found string "secret_key" (Indicator: "secret"; Source: "00000000-00002488.00000002.156882.007F2000.00000002.mdmp")44:T4e9,Found reference to API "GetLengthSid" (Indicator: "GetLengthSid"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "CopySid" (Indicator: "CopySid"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "InitializeAcl" (Indicator: "InitializeAcl"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "DuplicateToken" (Indicator: "DuplicateToken"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp") Found reference to API "SetEntriesInAclW" (Indicator: "SetEntriesInAcl"; Source: "00000000-00002512.00000000.152720.6EBB1000.00000002.mdmp")45:Tae1,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00002512.00000000.152720.03130000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"$28","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \":\\WINDOWS\\SYSTEM32\\amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00002512.00000000.152720.03130000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"1869f64ef406711b18c5b7988e88b340.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"System\" and MemberReference \"GetMethods\" in \"1869f64ef406711b18c5b7988e88b340.exe.bin\"\n Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"1869f64ef406711b18c5b7988e88b340.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found PE header in memory","description":"Found PE header \"MZ\" - Source: \"00000000-00002488.00000002.156882.00400000.00000040.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002512.00000000.152720.09830000.00000004.mdmp\")\n Found PE header \"MZ\" - Source: \"00000000-00002512.00000000.152720.09AA0000.00000004.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1055","relevance":1,"id":"memorydump-8","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002488.00000002.156882.00400000.00000040.mdmp\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00002512.00000000.152720.09AA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode string content at runtime (Dotnet)","description":"Observed function \"ToBase64String\" in \"1869f64ef406711b18c5b7988e88b340.exe.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"1869f64ef406711b18c5b7988e88b340.exe.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002488.00000001.154962.02F50000.00000004.mdmp, 00000000-00002488.00000002.156882.02F50000.00000004.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00002488.00000002.156882.00400000.00000040.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00002488.00000002.156882.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp\")\n Found reference to API \"description=\"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\"\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to cryptographic keys","description":"Found string \"http://www.w3.org/2001/04/xmlenc# EncryptedKey\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp\")\n Found string \"System.Security.Cryptography.Xml.KeyInfoEncryptedKey, System.Security, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a\" (Indicator: \"encryptedkey\"; Source: \"00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-280","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.564675522795173","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains ability to decode base64 data","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$29","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \"https://github.com/NPCDW/WindowsFormsOCR\" (Indicator: \"github.com\"; File: \"1869f64ef406711b18c5b7988e88b340.exe.bin\")\n Found string \"ttps://github.com/NPCDW/WindowsFormsOCR\" (Indicator: \"github.com\"; Source: \"00000000-00002488.00000002.156882.007F2000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002512-00000C2B-1379573806\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"file/memory contains long string with (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00002488.00000002.156882.00400000.00000040.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00002488.00000000.153040.04B00000.00000004.mdmp, 00000000-00002488.00000001.154962.04B00000.00000004.mdmp, 00000000-00002488.00000002.156882.04B00000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$3e","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6856d34ddd15e834970ac75a"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"