26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4d4,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Win64/GenKryptik.GGLH trojan Sample 897e53b64802… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 897e53b64802…. Malware family: Win64/GenKryptik.GGLH trojan. Threat score 100/100. 1/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832","keywords":["Malicious","Win64/GenKryptik.GGLH trojan","malware analysis","sandbox report","threat intelligence","897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832"],"about":{"@type":"SoftwareApplication","name":"Contract_02_21_Copy#32.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Win64/GenKryptik.GGLH trojan","antivirusDetections":{"malicious":1,"total":28},"behavioralIndicators":{"malicious":7,"suspicious":10},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T5b8,The input sample is signed with a certificate issued by "CN=DigiCert Assured ID Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: A9:9D:5B:79:E9:F1:CD:A5:9C:DA:B6:37:31:69:D5:35:3F:58:74:C6; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com EV Code Signing Intermediate CA RSA R3, O=SSL Corp, L=Houston, ST=Texas, C=US" (SHA1: C4:82:CE:18:FB:74:60:B5:5A:25:C1:0B:25:83:C2:FA:16:01:9A:5B; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com EV Root Certification Authority RSA R2, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: 74:3A:F0:52:9B:D0:32:A0:F4:4A:83:CD:D4:BA:A9:7B:7C:2E:C4:9A; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted Root G4, OU=www.digicert.com, O=DigiCert Inc, C=US" (SHA1: B6:C8:AF:83:4D:4E:53:B6:73:C7:68:72:AA:8C:95:0C:7C:54:DF:5F; see report for more information) The input sample is signed with a certificate issued by "CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA, O="DigiCert Inc.", C=US" (SHA1: F3:87:22:4D:86:33:82:92:35:A9:94:BC:BD:8F:96:E9:FE:1C:7C:73; see report for more information) The input sample is signed with a certificate issued by "CN=SSL.com EV Root Certification Authority RSA R2, O=SSL Corporation, L=Houston, ST=Texas, C=US" (SHA1: D2:95:3D:BA:95:08:6F:EB:58:05:BE:FC:41:28:3C:A6:4C:39:7D:F5; see report for more information)28:T4b0,".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\D3D10WARP.DLL" ".exe" trying to access non-existent file "C:\d3d10warp.dll" ".exe" trying to access non-existent file "C:\SECUR32.DLL" ".exe" trying to access non-existent file "C:\Secur32.dll" ".exe" trying to access non-existent file "C:\MPR.DLL" ".exe" trying to access non-existent file "C:\IPHLPAPI.DLL" ".exe" trying to access non-existent file "C:\WTSAPI32.DLL" ".exe" trying to access non-existent file "C:\WTSAPI32.dll" ".exe" trying to access non-existent file "C:\SSPICLI.DLL" ".exe" trying to access non-existent file "C:\Windows\System32\wbem\WBEMCOMN.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\wbemcomn.dll" ".exe" trying to access non-existent file "C:\Windows\System32\wbem\BCRYPT.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\wbem\bcrypt.dll" ".exe" trying to access non-existent file "C:\CRYPTBASE.DLL"29:T41c,Pattern match: "www.digicert.com1$0" Pattern match: "www.digicert.com1!0" Pattern match: "http://ocsp.digicert.com0C" Pattern match: "cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E" Pattern match: "crl3.digicert.com/DigiCertAssuredIDRootCA.crl0" Pattern match: "http://cert.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.cer0_" Pattern match: "https://www.ssl.com/repository0" Pattern match: "http://crls.ssl.com/SSLcom-SubCA-EV-CodeSigning-RSA-4096-R3.crl0" Pattern match: "http://ocsp.digicert.com0A" Pattern match: "cacerts.digicert.com/DigiCertTrustedRootG4.crt0C" Pattern match: "crl3.digicert.com/DigiCertTrustedRootG4.crl0" Pattern match: "crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0" Pattern match: "http://ocsp.digicert.com0X" Pattern match: "cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0" Pattern match: "http://www.ssl.com/repository/SSLcom-RootCA-EV-RSA-4096-R2.crt0" Pattern match: "http://ocsps.ssl.com0" Pattern match: "crls.ssl.com/SSLcom-RootCA-EV-RSA-4096-R2.crl0"2a:T66e,Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49733 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49737 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49738 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49742 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49743 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49745 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49746 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49747 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49748 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49751 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49752 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49753 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49754 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49755 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 49756 Process "C:\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe" binds to port 497572b:T993,".exe" wrote bytes "e92ecd8a02" to virtual address "0x71A63FE0" ("CreateCompatibleBitmap@GDI32.DLL") ".exe" wrote bytes "e9829ed2fd" to virtual address "0xFB877140" ".exe" wrote bytes "e905191800" to virtual address "0x7418F250" ("EnumWindows@USER32.DLL") ".exe" wrote bytes "e97fd21600" to virtual address "0x741A3A10" ("GetKeyState@USER32.DLL") ".exe" wrote bytes "e9fe6b1600" to virtual address "0x741AA010" ("GetActiveWindow@USER32.DLL") ".exe" wrote bytes "e9cef8cffd" to virtual address "0xFB8A1640" ".exe" wrote bytes "f0ef3274fb7f0000d0c23274fb7f000030733274fb7f0000d0e93274fb7f000020e23274fb7f0000d0ad3374fb7f000010073474fb7f0000d0bf3274fb7f0000e0063874fb7f000000c03274fb7f000080cd3274fb7f000080eb3274fb7f0000" to virtual address "0x713B43A8" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "a09d4e71fb7f0000608e4e71fb7f000090b74c71fb7f0000a0904e71fb7f0000508d4c71fb7f0000502e4c71fb7f000020c44e71fb7f000070bb4e71fb7f000080bc4e71fb7f000040784f71fb7f0000a0ba4e71fb7f000000884e71fb7f0000" to virtual address "0x71A84030" (part of module "GDI32.DLL") ".exe" wrote bytes "e9ce731800" to virtual address "0x741897C0" ("GetWindowTextW@USER32.DLL") ".exe" wrote bytes "e93e35d0fd" to virtual address "0xFB89D850" ".exe" wrote bytes "e9be33d0fd" to virtual address "0xFB89D950" ".exe" wrote bytes "e98ebb1600" to virtual address "0x741A5140" ("GetAsyncKeyState@USER32.DLL") ".exe" wrote bytes "c0ce3274fb7f000000503574fb7f0000c07c3574fb7f0000c0f23274fb7f0000" to virtual address "0x713B4320" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "90133474fb7f000000493374fb7f000050713374fb7f0000f0013474fb7f0000" to virtual address "0x713B42E0" (part of module "KERNELBASE.DLL") ".exe" wrote bytes "e9aeb0d2fd" to virtual address "0xFB875E20" ".exe" wrote bytes "e96e74d2fd" to virtual address "0xFB8798E0" ".exe" wrote bytes "e99ea51800" to virtual address "0x74186630" ("GetWindowTextA@USER32.DLL") ".exe" wrote bytes "e92257d1fd" to virtual address "0xFB88B860" ".exe" wrote bytes "e9f0fccffd" to virtual address "0xFB8A11A0" ".exe" wrote bytes "50583374fb7f000000573374fb7f0000" to virtual address "0x713B4390" (part of module "KERNELBASE.DLL")2c:T18ba,Found malicious artifacts related to "40.193.27.226": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: 9ac43d78e0f592fbb3cac1221bf3d91c9c652e046ec692d62502e4bdee229b61 (Date: 02/22/2023 00:45:55) File SHA256: 53cd0a5fe8dbd0eb2eb7e64d011986201a9475df63e1bd662a63a0b664840f54 (Date: 02/22/2023 01:17:10) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: 379ce0969fab8e82a224c8cf3978a27bc495a0a7 (Date: 02/22/2023 01:31:20) File SHA256: 7c1fff6835212b1122050a67bc9bd1ee (Date: 02/22/2023 00:45:55) Found malicious artifacts related to "197.170.198.152": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: aed5d4b4e729febd1787dc56a02b19ee (Date: 02/22/2023 03:16:29) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: a8b02b1d4f21437e96b8a62cbbcfff7083e032b4 (Date: 02/22/2023 03:16:29) File SHA256: 8dd7c8e2e85fefedc9aa95fa620b7773c8df9709a7f4773636548f415d75e858 (Date: 02/22/2023 01:31:20) File SHA256: 379ce0969fab8e82a224c8cf3978a27bc495a0a7 (Date: 02/22/2023 01:31:20) File SHA256: 8b7ca8696f727e0750e3705533e89340f3ec9cc9f2aab179bfd450af9f6ae9d3 (Date: 08/06/2022 16:22:13) File SHA256: f8adb355017d866787649b798deab14c49f9410b1affc2991b6b023ce163d358 (Date: 07/28/2020 14:16:40) Found malicious artifacts related to "163.223.67.191": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: 8bb69912e51c6181b7a22dd6881aea0717eddda4 (Date: 02/22/2023 00:45:55) File SHA256: 8303174a96c2b500d5608413678041122f335ec17d11da908f5ba6100c43d295 (Date: 02/22/2023 03:16:29) File SHA256: 1ee7bcbc034688d621e848e4b448cede18c6852a (Date: 02/22/2023 03:16:29) File SHA256: ecc58dfe969871498e396233bba2d87e769946b1f5ceba660b9c7e793f1135d0 (Date: 02/22/2023 01:16:04) File SHA256: 5b739abe30593840aaf76f7c933ead913765cafd (Date: 02/22/2023 01:16:04) Found malicious artifacts related to "73.237.181.95": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: 1ee7bcbc034688d621e848e4b448cede18c6852a (Date: 02/22/2023 03:16:29) File SHA256: 5b739abe30593840aaf76f7c933ead913765cafd (Date: 02/22/2023 01:16:04) File SHA256: 8dd7c8e2e85fefedc9aa95fa620b7773c8df9709a7f4773636548f415d75e858 (Date: 02/22/2023 01:31:20) File SHA256: 8303174a96c2b500d5608413678041122f335ec17d11da908f5ba6100c43d295 (Date: 02/22/2023 03:16:29) File SHA256: e46d0873c2862f2e37e3c2e42a3d7fd7 (Date: 02/22/2023 01:16:04) Found malicious artifacts related to "210.251.33.116": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: afbd270cd2b77dda0bec3358cda04aa8 (Date: 02/22/2023 00:45:55) File SHA256: 5791a7f45ee0e65371051d12d830060f (Date: 02/22/2023 01:17:10) File SHA256: 13220baecd66e9d5eec1e774000ce5f3 (Date: 02/22/2023 01:17:10) File SHA256: 8bb69912e51c6181b7a22dd6881aea0717eddda4 (Date: 02/22/2023 00:45:55) Found malicious artifacts related to "84.35.30.131": ... File SHA256: 1121bdb33923ebacaaf18f8ff59bb3ca50fb6568cf45da7b4c44298851a9fa7b (Date: 02/22/2023 03:16:29) File SHA256: 8bb69912e51c6181b7a22dd6881aea0717eddda4 (Date: 02/22/2023 00:45:55) File SHA256: dba5906e300a8ceb0f51cf4bb0c9260d (Date: 02/22/2023 03:16:29) File SHA256: 1ee7bcbc034688d621e848e4b448cede18c6852a (Date: 02/22/2023 03:16:29) File SHA256: fd298ec467a95e15bc8709561ad4276a (Date: 02/22/2023 01:31:20) Found malicious artifacts related to "112.55.152.187": ... File SHA256: 1121bdb33923ebacaaf18f8ff59bb3ca50fb6568cf45da7b4c44298851a9fa7b (Date: 02/22/2023 03:16:29) File SHA256: fd298ec467a95e15bc8709561ad4276a (Date: 02/22/2023 01:31:20) File SHA256: 379ce0969fab8e82a224c8cf3978a27bc495a0a7 (Date: 02/22/2023 01:31:20) File SHA256: 26e208e81de7a3d5442900afdcee0337e311f787 (Date: 02/22/2023 01:17:10) File SHA256: a8b02b1d4f21437e96b8a62cbbcfff7083e032b4 (Date: 02/22/2023 03:16:29) Found malicious artifacts related to "48.32.104.202": ... File SHA256: 5e4efcace95c0839d0e2aa80e72e650cc3ade426 (Date: 02/22/2023 01:16:04) File SHA256: 7c1fff6835212b1122050a67bc9bd1ee (Date: 02/22/2023 00:45:55) File SHA256: 8bb69912e51c6181b7a22dd6881aea0717eddda4 (Date: 02/22/2023 00:45:55) File SHA256: bb9f8b4e763f727a4505011e7a510341eb91c6c789ba73c27b460aaafac72a23 (Date: 02/22/2023 01:16:04) File SHA256: 30e11919d31e53dcb8c88229b4950b5e9ba0ee7cd556648f988f25b4acd32a39 (Date: 02/22/2023 01:31:20) Found malicious artifacts related to "108.62.141.20": ... File SHA256: daca27a8069a4018e69ab41ec94b7550e515abc0 (Date: 02/22/2023 00:45:55) File SHA256: 1ee7bcbc034688d621e848e4b448cede18c6852a (Date: 02/22/2023 03:16:29) File SHA256: 5e4efcace95c0839d0e2aa80e72e650cc3ade426 (Date: 02/22/2023 01:16:04) File SHA256: 1dce008e4a2f25fca05b78ec98b45768b8deab6915d86ca514a43e039321fce8 (Date: 02/22/2023 01:17:10) File SHA256: 5f5e86a82782ff503e5c203ef38d415a (Date: 02/22/2023 01:16:04) Found malicious artifacts related to "104.168.140.145": ... File SHA256: ecc58dfe969871498e396233bba2d87e769946b1f5ceba660b9c7e793f1135d0 (Date: 02/22/2023 01:16:04) File SHA256: dba5906e300a8ceb0f51cf4bb0c9260d (Date: 02/22/2023 03:16:29) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: fd298ec467a95e15bc8709561ad4276a (Date: 02/22/2023 01:31:20) File SHA256: bb9f8b4e763f727a4505011e7a510341eb91c6c789ba73c27b460aaafac72a23 (Date: 02/22/2023 01:16:04) Found malicious artifacts related to "51.68.145.171": ... File SHA256: 30e11919d31e53dcb8c88229b4950b5e9ba0ee7cd556648f988f25b4acd32a39 (Date: 02/22/2023 01:31:20) File SHA256: aed5d4b4e729febd1787dc56a02b19ee (Date: 02/22/2023 03:16:29) File SHA256: 7c1fff6835212b1122050a67bc9bd1ee (Date: 02/22/2023 00:45:55) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: dba5906e300a8ceb0f51cf4bb0c9260d (Date: 02/22/2023 03:16:29)2d:T18ba,Found malicious artifacts related to "40.193.27.226": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: 9ac43d78e0f592fbb3cac1221bf3d91c9c652e046ec692d62502e4bdee229b61 (Date: 02/22/2023 00:45:55) File SHA256: 53cd0a5fe8dbd0eb2eb7e64d011986201a9475df63e1bd662a63a0b664840f54 (Date: 02/22/2023 01:17:10) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: 379ce0969fab8e82a224c8cf3978a27bc495a0a7 (Date: 02/22/2023 01:31:20) File SHA256: 7c1fff6835212b1122050a67bc9bd1ee (Date: 02/22/2023 00:45:55) Found malicious artifacts related to "197.170.198.152": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: aed5d4b4e729febd1787dc56a02b19ee (Date: 02/22/2023 03:16:29) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: a8b02b1d4f21437e96b8a62cbbcfff7083e032b4 (Date: 02/22/2023 03:16:29) File SHA256: 8dd7c8e2e85fefedc9aa95fa620b7773c8df9709a7f4773636548f415d75e858 (Date: 02/22/2023 01:31:20) File SHA256: 379ce0969fab8e82a224c8cf3978a27bc495a0a7 (Date: 02/22/2023 01:31:20) File SHA256: 8b7ca8696f727e0750e3705533e89340f3ec9cc9f2aab179bfd450af9f6ae9d3 (Date: 08/06/2022 16:22:13) File SHA256: f8adb355017d866787649b798deab14c49f9410b1affc2991b6b023ce163d358 (Date: 07/28/2020 14:16:40) Found malicious artifacts related to "163.223.67.191": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: 8bb69912e51c6181b7a22dd6881aea0717eddda4 (Date: 02/22/2023 00:45:55) File SHA256: 8303174a96c2b500d5608413678041122f335ec17d11da908f5ba6100c43d295 (Date: 02/22/2023 03:16:29) File SHA256: 1ee7bcbc034688d621e848e4b448cede18c6852a (Date: 02/22/2023 03:16:29) File SHA256: ecc58dfe969871498e396233bba2d87e769946b1f5ceba660b9c7e793f1135d0 (Date: 02/22/2023 01:16:04) File SHA256: 5b739abe30593840aaf76f7c933ead913765cafd (Date: 02/22/2023 01:16:04) Found malicious artifacts related to "73.237.181.95": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: 1ee7bcbc034688d621e848e4b448cede18c6852a (Date: 02/22/2023 03:16:29) File SHA256: 5b739abe30593840aaf76f7c933ead913765cafd (Date: 02/22/2023 01:16:04) File SHA256: 8dd7c8e2e85fefedc9aa95fa620b7773c8df9709a7f4773636548f415d75e858 (Date: 02/22/2023 01:31:20) File SHA256: 8303174a96c2b500d5608413678041122f335ec17d11da908f5ba6100c43d295 (Date: 02/22/2023 03:16:29) File SHA256: e46d0873c2862f2e37e3c2e42a3d7fd7 (Date: 02/22/2023 01:16:04) Found malicious artifacts related to "210.251.33.116": ... File SHA256: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832 (Date: 02/22/2023 01:45:47) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: afbd270cd2b77dda0bec3358cda04aa8 (Date: 02/22/2023 00:45:55) File SHA256: 5791a7f45ee0e65371051d12d830060f (Date: 02/22/2023 01:17:10) File SHA256: 13220baecd66e9d5eec1e774000ce5f3 (Date: 02/22/2023 01:17:10) File SHA256: 8bb69912e51c6181b7a22dd6881aea0717eddda4 (Date: 02/22/2023 00:45:55) Found malicious artifacts related to "84.35.30.131": ... File SHA256: 1121bdb33923ebacaaf18f8ff59bb3ca50fb6568cf45da7b4c44298851a9fa7b (Date: 02/22/2023 03:16:29) File SHA256: 8bb69912e51c6181b7a22dd6881aea0717eddda4 (Date: 02/22/2023 00:45:55) File SHA256: dba5906e300a8ceb0f51cf4bb0c9260d (Date: 02/22/2023 03:16:29) File SHA256: 1ee7bcbc034688d621e848e4b448cede18c6852a (Date: 02/22/2023 03:16:29) File SHA256: fd298ec467a95e15bc8709561ad4276a (Date: 02/22/2023 01:31:20) Found malicious artifacts related to "112.55.152.187": ... File SHA256: 1121bdb33923ebacaaf18f8ff59bb3ca50fb6568cf45da7b4c44298851a9fa7b (Date: 02/22/2023 03:16:29) File SHA256: fd298ec467a95e15bc8709561ad4276a (Date: 02/22/2023 01:31:20) File SHA256: 379ce0969fab8e82a224c8cf3978a27bc495a0a7 (Date: 02/22/2023 01:31:20) File SHA256: 26e208e81de7a3d5442900afdcee0337e311f787 (Date: 02/22/2023 01:17:10) File SHA256: a8b02b1d4f21437e96b8a62cbbcfff7083e032b4 (Date: 02/22/2023 03:16:29) Found malicious artifacts related to "48.32.104.202": ... File SHA256: 5e4efcace95c0839d0e2aa80e72e650cc3ade426 (Date: 02/22/2023 01:16:04) File SHA256: 7c1fff6835212b1122050a67bc9bd1ee (Date: 02/22/2023 00:45:55) File SHA256: 8bb69912e51c6181b7a22dd6881aea0717eddda4 (Date: 02/22/2023 00:45:55) File SHA256: bb9f8b4e763f727a4505011e7a510341eb91c6c789ba73c27b460aaafac72a23 (Date: 02/22/2023 01:16:04) File SHA256: 30e11919d31e53dcb8c88229b4950b5e9ba0ee7cd556648f988f25b4acd32a39 (Date: 02/22/2023 01:31:20) Found malicious artifacts related to "108.62.141.20": ... File SHA256: daca27a8069a4018e69ab41ec94b7550e515abc0 (Date: 02/22/2023 00:45:55) File SHA256: 1ee7bcbc034688d621e848e4b448cede18c6852a (Date: 02/22/2023 03:16:29) File SHA256: 5e4efcace95c0839d0e2aa80e72e650cc3ade426 (Date: 02/22/2023 01:16:04) File SHA256: 1dce008e4a2f25fca05b78ec98b45768b8deab6915d86ca514a43e039321fce8 (Date: 02/22/2023 01:17:10) File SHA256: 5f5e86a82782ff503e5c203ef38d415a (Date: 02/22/2023 01:16:04) Found malicious artifacts related to "104.168.140.145": ... File SHA256: ecc58dfe969871498e396233bba2d87e769946b1f5ceba660b9c7e793f1135d0 (Date: 02/22/2023 01:16:04) File SHA256: dba5906e300a8ceb0f51cf4bb0c9260d (Date: 02/22/2023 03:16:29) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: fd298ec467a95e15bc8709561ad4276a (Date: 02/22/2023 01:31:20) File SHA256: bb9f8b4e763f727a4505011e7a510341eb91c6c789ba73c27b460aaafac72a23 (Date: 02/22/2023 01:16:04) Found malicious artifacts related to "51.68.145.171": ... File SHA256: 30e11919d31e53dcb8c88229b4950b5e9ba0ee7cd556648f988f25b4acd32a39 (Date: 02/22/2023 01:31:20) File SHA256: aed5d4b4e729febd1787dc56a02b19ee (Date: 02/22/2023 03:16:29) File SHA256: 7c1fff6835212b1122050a67bc9bd1ee (Date: 02/22/2023 00:45:55) File SHA256: 1cdb053cc24d16662266b26470c71a45bf2bc4ad40f804fd3560ace02edc7632 (Date: 02/22/2023 00:45:55) File SHA256: dba5906e300a8ceb0f51cf4bb0c9260d (Date: 02/22/2023 03:16:29)1d:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$25"}}],["$","$L26",null,{"initialData":{"schema_version":"1.0.15","sha256":"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790854109767,"unified_at":"2026-10-01T11:28:29.767Z","metadata":{"hashes":{"sha256":"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832","sha1":"f78efb588be3ca19966f3b46dbdb2d98b44de408","md5":"6e4e21b15f5c27ca82b7934fa6544c5d","sha512":"d435d67585d2a0f4448aaa0fd8d9aede26a81cf8fe8bbf4c97ded550f3eb676366adc07cd4dec9be90d6d28f51ae28ceac46b13c3b229fcdcbec5325d21edc43","ssdeep":"24576:XrmJ8nj4+I2lkxeUHhb7o8728eU44yDjQNBmTW7MKfMhk:iJ0hEeuxu2zfX","ssdeep_chunks":["24576:XrmJ8nj","24576:rmJ8nj4","24576:mJ8nj4+","24576:J8nj4+I","24576:8nj4+I2","24576:nj4+I2l","24576:j4+I2lk","24576:4+I2lkx","24576:+I2lkxe","24576:I2lkxeU","24576:2lkxeUH","24576:lkxeUHh","24576:kxeUHhb","24576:xeUHhb7","24576:eUHhb7o","24576:UHhb7o8","24576:Hhb7o87","24576:hb7o872","24576:b7o8728","24576:7o8728e","24576:o8728eU","24576:8728eU4","24576:728eU44","24576:28eU44y","24576:8eU44yD","24576:eU44yDj","24576:U44yDjQ","24576:44yDjQN","24576:4yDjQNB","24576:yDjQNBm","24576:DjQNBmT","24576:jQNBmTW","24576:QNBmTW7","24576:NBmTW7M","24576:BmTW7MK","24576:mTW7MKf","24576:TW7MKfM","24576:W7MKfMh","24576:7MKfMhk","49152:XrmJ8nj","49152:rmJ8nj4","49152:mJ8nj4+","49152:J8nj4+I","49152:8nj4+I2","49152:nj4+I2l","49152:j4+I2lk","49152:4+I2lkx","49152:+I2lkxe","49152:I2lkxeU","49152:2lkxeUH","49152:lkxeUHh","49152:kxeUHhb","49152:xeUHhb7","49152:eUHhb7o","49152:UHhb7o8","49152:Hhb7o87","49152:hb7o872","49152:b7o8728","49152:7o8728e","49152:o8728eU","49152:8728eU4","49152:728eU44","49152:28eU44y","49152:8eU44yD","49152:eU44yDj","49152:U44yDjQ","49152:44yDjQN","49152:4yDjQNB","49152:yDjQNBm","49152:DjQNBmT","49152:jQNBmTW","49152:QNBmTW7","49152:NBmTW7M","49152:BmTW7MK","49152:mTW7MKf","49152:TW7MKfM","49152:W7MKfMh","49152:7MKfMhk","24576:iJ0hEeu","24576:J0hEeux","24576:0hEeuxu","24576:hEeuxu2","24576:Eeuxu2z","24576:euxu2zf","24576:uxu2zfX"],"imphash":"d896fbd44874f6dc349fa19cf7d92573"},"file_info":{"file_name":"Contract_02_21_Copy#32.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":1502360,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1677018005000,"last_seen":1677051276000,"last_multi_scan":1677051276000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["commodity","criminal","downloader","informationstealer","shindig","evasive"]},"stats":{"av":{"malicious_count":1,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":18},"sandbox_signatures":{"informative_count":34,"suspicious_count":10,"malicious_count":7,"total":51},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"undetected","status":"clean","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win64/GenKryptik.GGLH trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Win64/GenKryptik.GGLH trojan","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Executes WMI queries known to be used for VM detection"},{"type":"informative","value":"Executes WMI queries"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Imports GetCommandLine API"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"malicious","value":"The input sample contains a known anti-VM trick"},{"type":"informative","value":"The input sample possibly contains the RDTSCP instruction"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file has unusual entropy sections"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Found debugger evasion api strings"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a valid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to query CPU information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Calls an API typically used to get system version information"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Monitors specific registry key for changes"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to enumerate files inside a directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Command and Control","technique":"Non-Standard Port","attack_id":"T1571","attack_id_wiki":"https://attack.mitre.org/techniques/T1571","identifiers":[{"type":"malicious","value":"Uses network protocols on unusual ports"},{"type":"suspicious","value":"Process binds to unusual ports"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"UnhandledExceptionFilter\" [Source: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin]\n Observed api string:\"SetUnhandledExceptionFilter\" [Source: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 28972-7341-00000001400043CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"IsDebuggerPresent\" [Source: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" with parameter (UID: 00000000-00000644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00000644)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00000644)\n \".exe\" called \"RtlGetVersion\" with parameter (UID: 00000000-00000644)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to enumerate files inside a directory","description":"FindNextFileW@KERNEL32.dll at 28972-1928-000000014000BAAF","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1083","relevance":3,"id":"stream-89","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Environment Awareness","name":"Executes WMI queries","description":"\".exe\" issued a query \"SELECT * FROM Win32_ComputerSystemProduct\"\n \".exe\" issued a query \"SELECT * FROM Win32_OperatingSystem \"\n \".exe\" issued a query \"SELECT * FROM Win32_ComputerSystem \"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-56","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\".exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\c09b9e62821de9806b80f14a324f62dd\" - (UID: 00000000-00000644)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"40.193.27.226:49733\"\n \"197.170.198.152:49737\"\n \"163.223.67.191:49738\"\n \"73.237.181.95:49742\"\n \"210.251.33.116:49743\"\n \"84.35.30.131:49745\"\n \"112.55.152.187:49746\"\n \"48.32.104.202:49747\"\n \"108.62.141.20:49748\"\n \"104.168.140.145:49751\"\n \"51.68.145.171:49752\"","origin":"Network Traffic","mitre_attack_id":"T1071","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:644:304:WilStaging_02\"\n \"Local\\SM0:644:304:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"WBEM Locator\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{4590F811-1D3A-11D0-891F-00AA004B2E24}\\INPROCSERVER32\")\n \".exe\" touched \"Windows Management and Instrumentation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{8BC3F05E-D86B-11D0-A075-00C04FB68820}\\TREATAS\")\n \".exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{7C857801-7381-11CF-884D-00AA004B2E24}\\TREATAS\")\n \".exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IWbemServices\" (Path: \"HKCU\\CLSID\\{D68AF00A-29CB-43FA-8504-CE99A996D9EA}\\TREATAS\")\n \".exe\" touched \"Microsoft WBEM (non)Standard Marshaling for IEnumWbemClassObject\" (Path: \"HKCU\\CLSID\\{1B1CAD8C-2DAB-11D2-B604-00104B703EFD}\\INPROCSERVER32\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"PE file contains data exceeding the last FAT sector (overlay)","description":"Pe file has overlay in 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin","origin":"Static Parser","relevance":1,"id":"static-131","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin\" file has an entrypoint instructions - \"subrsp, 0x28,call0x1400040d0,addrsp, 0x28,jmp0x140003ca8,int3,int3,subrsp, 0x28,call0x14000467c,testeax, eax,je0x140003e56,movrax, qword ptr gs:[0x30],movrcx, qword ptr [rax + 8],jmp0x140003e49,cmprcx, rax,je0x140003e5d,xoreax, eax,lock cmpxchgqword ptr [rip + 0x167a84], rcx,jne0x140003e44,xoral, al,addrsp, 0x28,ret,moval, 1,jmp0x140003e58,int3,int3,int3,pushrbx,subrsp, 0x20,movzxeax, byte ptr [rip + 0x167a9f],testecx, ecx,movebx, 1,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".rdata\" is \"0x102e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".rdata\" is \"0x102c44\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"PE file has a high image base","description":"\"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin\" has high imagebase \"0x140000000\"","origin":"Static Parser","relevance":1,"id":"static-93","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"$27","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"The input sample is signed with a valid certificate","description":"The entire certificate chain of the input sample was validated successfully.","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-2","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"General","name":"The input sample possibly contains the RDTSCP instruction","description":"Found VM detection artifact \"RDTSCP trick\" in \"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin\" (Offset: 1306142)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-26","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$28","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$29","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"\"https://www.ssl.com/repository0\" (Indicator: \"https://\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on file \"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00000644)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindNextFileW\" [Source: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed api string:\"GetComputerNameA\" [Source: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"Retrieves the command-line string for the current process\" [Source: 897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries process information","description":"\".exe\" queried SystemProcessInformation at 00000000-00000644-00000036-813743\n \".exe\" queried SystemProcessInformation at 00000000-00000644-00000036-815144\n \".exe\" queried SystemProcessInformation at 00000000-00000644-00000036-4737912\n \".exe\" queried SystemProcessInformation at 00000000-00000644-00000036-4739210","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".data with unusual entropies 7.2384961832","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to query CPU information","description":"cpuid at 00000000-00000644-52319-134-2F0844B4","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":10,"id":"stream-13","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"Environment Awareness","name":"Executes WMI queries known to be used for VM detection","description":"\".exe\" issued a query \"SELECT * FROM Win32_ComputerSystemProduct\"\n \".exe\" issued a query \"SELECT * FROM Win32_OperatingSystem \"\n \".exe\" issued a query \"SELECT * FROM Win32_ComputerSystem \"","origin":"API Call","mitre_attack_id":"T1047","relevance":10,"id":"api-57","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"19/70 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\".exe\" monitors \"\\REGISTRY\\MACHINE\\SOFTWARE\\Microsoft\\Ole\" (Filter: 268435457; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\\Local Settings\\Software\\Microsoft\" (Filter: 268435457; Subtree: 1)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\HwOrder\" (Filter: 4; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Control\\NetworkProvider\\ProviderOrder\" (Filter: 4; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 3729780736)\n \".exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\Services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)\n \".exe\" monitors \"\\REGISTRY\\USER\\S-1-5-21-735145574-3570218355-1207367261-1001_Classes\" (Filter: 268435461; Subtree: 1)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"Network Related","name":"Process binds to unusual ports","description":"$2a","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":10,"id":"network-36","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"CreateCompatibleBitmap@GDI32.DLL\" in \".exe\"\n \"EnumWindows@USER32.DLL\" in \".exe\"\n \"GetKeyState@USER32.DLL\" in \".exe\"\n \"GetActiveWindow@USER32.DLL\" in \".exe\"\n \"GetWindowTextW@USER32.DLL\" in \".exe\"\n \"GetAsyncKeyState@USER32.DLL\" in \".exe\"\n \"GetWindowTextA@USER32.DLL\" in \".exe\"\n \"GetForegroundWindow@USER32.DLL\" in \".exe\"\n \"ExitWindowsEx@USER32.DLL\" in \".exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetComputerNameA\n GetModuleFileNameW\n IsDebuggerPresent\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n GetCommandLineA\n GetProcAddress\n MapViewOfFile\n FindNextFileW\n CreateFileMappingA\n FindFirstFileExW\n GetModuleHandleW\n TerminateProcess\n ConnectNamedPipe\n GetModuleHandleExW\n WriteFile\n CreateFileW\n CreateFileA\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$2b","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"malicious","category":"Environment Awareness","name":"The input sample contains a known anti-VM trick","description":"Found VM detection artifact \"CPUID trick\" in \"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.bin\" (Offset: 14569)","origin":"Binary File","mitre_attack_id":"T1497","relevance":5,"id":"binary-8","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"19/70 Antivirus vendors marked sample as malicious (27% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a trusted Antivirus engine","description":"No specific details available","origin":"External System","relevance":10,"id":"avtest-5","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"malicious","category":"Network Related","name":"Contacts very many different hosts","description":"Contacted 11 (or more) hosts in at least 7 different countries","origin":"Network Traffic","relevance":9,"id":"network-17","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$2c","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"malicious","category":"Network Related","name":"Multiple malicious artifacts seen in the context of different hosts","description":"$2d","origin":"Network Traffic","relevance":10,"id":"network-27","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"level":"malicious","category":"Network Related","name":"Uses network protocols on unusual ports","description":"TCP traffic to 40.193.27.226 on port 49733\n TCP traffic to 197.170.198.152 on port 49737\n TCP traffic to 163.223.67.191 on port 49738\n TCP traffic to 73.237.181.95 on port 49742\n TCP traffic to 210.251.33.116 on port 49743\n TCP traffic to 84.35.30.131 on port 49745\n TCP traffic to 112.55.152.187 on port 49746\n TCP traffic to 48.32.104.202 on port 49747\n TCP traffic to 108.62.141.20 on port 49748\n TCP traffic to 104.168.140.145 on port 49751\n TCP traffic to 51.68.145.171 on port 49752","origin":"Network Traffic","mitre_attack_id":"T1571","relevance":7,"id":"network-7","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"name":"Evasive","details_count":3,"details":[{"detail":"Executes WMI queries known to be used for VM detection"},{"detail":"The input sample contains a known anti-VM trick"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":49,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":1,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":1,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":11,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["commodity","criminal","downloader","informationstealer","shindig","evasive"],"sample_flags":["Network Traffic"],"sandbox_reports":[{"id":"63f5c58b67323e68230d5140","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Win64:DropperX","contacted_countries":["CHN","FRA","JPN","KOR","NLD","USA","ZAF"],"submit_name":"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe","analysis_start_time":"2023-02-22T07:49:39+00:00","indicators_count":{"informative":34,"suspicious":12,"malicious":7},"tags":["Network Traffic"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"40.193.27.226","port":49733,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"197.170.198.152","port":49737,"protocol":"TCP","country":"South Africa","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"163.223.67.191","port":49738,"protocol":"TCP","country":"Korea, Republic of","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"73.237.181.95","port":49742,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"210.251.33.116","port":49743,"protocol":"TCP","country":"Japan","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"84.35.30.131","port":49745,"protocol":"TCP","country":"Netherlands","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"112.55.152.187","port":49746,"protocol":"TCP","country":"China","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"48.32.104.202","port":49747,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"108.62.141.20","port":49748,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"104.168.140.145","port":49751,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"address":"51.68.145.171","port":49752,"protocol":"TCP","country":"France","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]}],"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}],"processes":[{"pid":644,"ppid":0,"name":"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe","command_line":"","sha256":"897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832","normalized_path":"C:\\897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832.exe","uid":"00000000-00000644","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAABDElEQVR42u2WSwrCMBCGiwgiggjiWRUfoKgLwbVQ8DQiXkHbA/QAfbebkVm0ZpGk07ENgh346a7fN38gxLK66eZX5ng6g8kYE7jdH9KvVMDzPCNRCuR53kqyLCuTpmm9BvAH1vxJThW8UuBiX8uIArODC9O9C5OdC+OtA6ONA8O1A4PVC/rLF/QWHwHbtpVJkoTXAAUuNiDbHOFsAQq8kQZUR0CBY3SbY+I45jVAgRcCugbYAhR4IaDavAjrCChwDIJ1DURRxGuAAi8EVJsjnC1AgWMQ+lUDqiOgRrc5JgzDdq9iWQMivHUB3eZGBVTwIAjqC1Td7VVnLsJZAk3Cfd83+yQjvwm76eZv5w1WzRqWyEpLtgAAAABJRU5ErkJggg=="}],"all_imported_dlls":["apphelp.dll","ws2_32.dll","ucrtbase.dll","gdi32.dll","gdi32full.dll","secur32.dll","clbcatq.dll","wbemsvc.dll","combase.dll","msasn1.dll","shlwapi.dll","wtsapi32.dll","wbemprox.dll","ncrypt.dll","ncryptsslp.dll","msvcp_win.dll","msvcrt.dll","kernel.appcore.dll","ntdll.dll","win32u.dll","bcryptprimitives.dll","crypt32.dll","windows.storage.dll","powrprof.dll","mpr.dll","sspicli.dll","VxSSL64.dll","user32.dll","cfgmgr32.dll","IPHLPAPI.DLL","wbemcomn.dll","schannel.dll","mskeyprotect.dll","ntasn1.dll","rpcrt4.dll","fltLib.dll","SHCore.dll","mswsock.dll","KernelBase.dll","sechost.dll","ole32.dll","imm32.dll","profapi.dll","bcrypt.dll","cryptbase.dll","kernel32.dll","oleaut32.dll","shell32.dll","fastprox.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WBEM\\CIMOM\\","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]}],"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]},{"name":"Local\\SM0:644:304:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"63f5c58b67323e68230d5140"}]}]}},"report_ids":{"sandbox_job_ids":["63f5c58b67323e68230d5140"]}}}]]}] 20:null 24:[["$","title","0",{"children":"Malicious Win64/GenKryptik.GGLH trojan Sample 897e53b64802… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 897e53b64802…. Malware family: Win64/GenKryptik.GGLH trojan. Threat score 100/100. 1/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832"}],["$","meta","4",{"property":"og:title","content":"Malicious Win64/GenKryptik.GGLH trojan Sample 897e53b64802… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 897e53b64802…. Malware family: Win64/GenKryptik.GGLH trojan. Threat score 100/100. 1/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/897e53b648020ab28663240bbbce54546cf6f55b35019fd4aa2a209c4a3b1832"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Win64/GenKryptik.GGLH trojan Sample 897e53b64802… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 897e53b64802…. Malware family: Win64/GenKryptik.GGLH trojan. Threat score 100/100. 1/28 AV engines flagged this file. 7 malicious and 10 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]