26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 50:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c2,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Dacic.D6DFC400.A.Generic Sample 90d4826fc5e1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 90d4826fc5e1…. Malware family: Dacic.D6DFC400.A.Generic. Threat score 100/100. 18/27 AV engines flagged this file. 11 malicious and 24 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496","keywords":["Malicious","Dacic.D6DFC400.A.Generic","malware analysis","sandbox report","threat intelligence","90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496"],"about":{"@type":"SoftwareApplication","name":"comfortconcept.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Dacic.D6DFC400.A.Generic","antivirusDetections":{"malicious":18,"total":27},"behavioralIndicators":{"malicious":11,"suspicious":24},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T624,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin" Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "9a6cc2f92d6a5b89a62375fb3e9e2582.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "9a6cc2f92d6a5b89a62375fb3e9e2582.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "9a6cc2f92d6a5b89a62375fb3e9e2582.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "9a6cc2f92d6a5b89a62375fb3e9e2582.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "9a6cc2f92d6a5b89a62375fb3e9e2582.exe" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "9a6cc2f92d6a5b89a62375fb3e9e2582.exe"28:Te71,"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00000196.00000000.108934.050D0000.00000004.mdmp")48:T490,Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00000196.00000000.108934.00262000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00000196.00000000.108934.00262000.00000002.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00006296.00000000.109133.6854B000.00000002.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00006296.00000000.109133.6854B000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00006296.00000000.109133.6854B000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00006296.00000000.109133.6854B000.00000002.mdmp")49:T69e,Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00000196.00000000.108934.02790000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorwks.dll" (Indicator: "\Device\"; Source: "00000000-00000196.00000000.108934.02790000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00000196.00000000.108934.050D0000.00000004.mdmp, 00000000-00000196.00000000.108934.1E233000.00000004.mdmp, 00000000-00000196.00000000.108934.1E271000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00000196.00000000.108934.1E233000.00000004.mdmp, 00000000-00000196.00000000.108934.1E271000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00000196.00000000.108934.1E233000.00000004.mdmp, 00000000-00000196.00000000.108934.1E271000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00006296.00000000.109133.B4310000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\System32\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00006296.00000000.109133.B4310000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\Device\"; Source: "00000000-00006296.00000000.109133.B433E000.00000004.mdmp") Found string "\Device\HarddiskVolume2\DosDevices\C:\??\Volume{815ead30-0000-0000-0000-501f00000000}" (Indicator: "\DosDevices\"; Source: "00000000-00006296.00000000.109133.B433E000.00000004.mdmp")4a:Ta14,"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")\n Found string \"System.Data.Odbc\" (Indicator: \"System.Data.Odbc\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00006296.00000000.109133.6854B000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00006296.00000000.109133.6854B000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00006296.00000000.109133.6854B000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00006296.00000000.109133.6854B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; File: \"90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; File: \"90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; File: \"90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin\")\n Found reference to API \"GetKeyboardState\" (Indicator: \"GetKeyboardState\"; Source: \"00000000-00000196.00000000.108934.00262000.00000002.mdmp\")\n Found reference to API \"MapVirtualKey\" (Indicator: \"MapVirtualKey\"; Source: \"00000000-00000196.00000000.108934.00262000.00000002.mdmp\")\n Found reference to API \"GetAsyncKeyState\" (Indicator: \"GetAsyncKeyState\"; Source: \"00000000-00000196.00000000.108934.00262000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve logical drive information (API string)","description":"Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; File: \"90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin\")\n Found reference to API \"GetLogicalDrives\" (Indicator: \"GetLogicalDrives\"; Source: \"00000000-00000196.00000000.108934.00262000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-80","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"file/memory contains long string(File: \"9a6cc2f92d6a5b89a62375fb3e9e2582.exe\")\n Found string \"GetProcessById\" (Source: \"00000000-00000196.00000000.108934.00262000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$46","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"cmd.exe /c ping 0 -n 2 & del \"\" (Indicator: \"ping\"; File: \"90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin\"), Found string \"cmd.exe /c ping 0 -n 2 & del \\\"\" (Indicator: \"ping\"; File: \"90d4826fc5e132f29e7faccd5f86eda124fa1f16fd1c1dffe090c985b369d496.bin\")\n Found string \"md.exe /c ping 0 -n 2 & del \"\" (Indicator: \"ping\"; Source: \"00000000-00000196.00000000.108934.00262000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00000196.00000000.108934.050D0000.00000004.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00006296.00000000.109133.6854B000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00006296.00000000.109133.6854B000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"6a1f2516bfb012d5950309f3"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"