24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2e:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Generic Sample 9cda3093ddda… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 9cda3093ddda…. Malware family: Trojan.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2","keywords":["Malicious","Trojan.Generic","malware analysis","sandbox report","threat intelligence","9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2"],"about":{"@type":"SoftwareApplication","name":"69fb73e283630210dcb0e9b400a1ee4c.exe","applicationCategory":["peexe","executable"],"identifier":"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Generic","antivirusDetections":{"malicious":5,"total":28},"behavioralIndicators":{"malicious":3,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T9f6,".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000a720000cd020000000058d6d10254f7b402f2440a7258d6d1020000000060f7b4023de7097258d6d102ccf7b4024fce097258d6d1024000000033fe091f0000000032d7d10270ce097200000000a6f7b40258d6d102a8f7b40258d6d102000000001d000000090000009e293d7710bcd1020000000028000000240000000000cd0268f8b4020700000010fab402100a0b7201000000ecf7b402d0079b0230000000a8f8b4020900000000009b0230d7d102e709b40278f8b402ddf8087238bad102a8adcd0209000000000000002000000000009b02d0019b02740b9b0200000000700b9b020000000060f8b40250f53c7710bcd102c8f8b40214f9b402 (UID: 00000000-00006072) ".exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006072) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f0000020000000000097280e8cd0250000000ebce321d00000000baebd10270ce097200000000eec68f0080e8cd02f0c68f0080e8cd020000000023000000070000009e293d77d87bd1020000000038000000340000000000cd02b0c78f000700000058c98f00100a0b720100000034c78f00d0079b0240000000f0c78f000700000000009b02b8ebd102f4db8f00c0c78f00ddf80872f079d10258adcd0207000000000000002000000000009b02d8019b020c0b9b0200000000080b9b0200000000a8c78f0050f53c77d87bd10210c88f005cc88f000000cd0210aecd0250f53c77d87bd1020000f071feffffff400c9b0248adcd0200000000000000000000f071b0c78f00 (UID: 00000000-00006072) ".exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00006072)26:T6d9,".exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" ".exe" trying to access non-existent file "C:\FLTLIB.DLL" ".exe" trying to access non-existent file "C:\MSIMG32.DLL" ".exe" trying to access non-existent file "C:\msimg32.dll" ".exe" trying to access non-existent file "C:\MSVCR100.DLL" ".exe" trying to access non-existent file "C:\msvcr100.dll" ".exe" trying to access non-existent file "C:\Windows\SysWOW64\RPCSS.DLL" ".exe" trying to access non-existent file "C:\WINDOWS\system32\rpcss.dll" ".exe" trying to access non-existent file "C:\MSCOREE.DLL" ".exe" trying to access non-existent file "C:\mscoree.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\MSCORWKS.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\CLR.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\VCRUNTIME140_CLR0400.dll" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\UCRTBASE_CLR0400.DLL" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ucrtbase_clr0400.dll"27:T7aa,".exe" trying to access non-existent file "C:\Windows\SysWOW64\MSCOREE.DLL.LOCAL" ".exe" trying to access non-existent file "C:\WINDOWS\SYSTEM32\mscoree.dll.local" ".exe" trying to access non-existent file "C:\9CDA3093DDDACBD05E0E9C8CE7320C73320FF2EA4B66CA3578B5B4FD9DC80FE2.EXE.CONFIG" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\FUSION.LOCALGAC" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\fusion.localgac" ".exe" trying to access non-existent file "C:\Users\%OSUSER%\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\9CDA3093DDDACBD05E0E9C8CE7320C73320FF2EA4B66CA3578B5B4FD9DC80FE2.EXE.LOG" ".exe" trying to access non-existent file "C:\9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe.config" ".exe" trying to access non-existent file "C:\Windows\assembly\GAC\PUBLISHERPOLICY.TME" ".exe" trying to access non-existent file "C:\Windows\assembly\NativeImages_v4.0.30319_32\SYSTEM.WINDOWS.FORMS" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.WINDOWS.FORMS.INI" ".exe" trying to access non-existent file "C:\WINDOWS\Microsoft.Net\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.INI" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System\v4.0_4.0.0.0__b77a5c561934e089\SYSTEM.PDB" ".exe" trying to access non-existent file "C:\Windows\SYSTEM.PDB" ".exe" trying to access non-existent file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\MSCORLIB.PDB" ".exe" trying to access non-existent file "C:\Windows\MSCORLIB.PDB"28:T875,Heuristic match: "api.ipify.org" Heuristic match: "checkip.amazonaws.com" Heuristic match: "checkip.dyndns.com" Heuristic match: "checkip.dyndns.org" Heuristic match: "checkip.org" Heuristic match: "checkmyip.com" Heuristic match: "cmyip.com" Heuristic match: "curlmyip.com" Heuristic match: "findmyip.org" Heuristic match: "formyip.com" Heuristic match: "geoip.co.uk" Heuristic match: "geoiptool.com" Heuristic match: "getmyip.co.uk" Heuristic match: "getmyip.org" Heuristic match: "icanhazip.com" Heuristic match: "ifconfig.me" Heuristic match: "ip-addr.es" Heuristic match: "ip-address.domaintools.com" Heuristic match: "ip-api.com" Heuristic match: "ip-score.com" Heuristic match: "ip.jsontest.com" Heuristic match: "ip.xss.ru" Heuristic match: "ip4.telize.com" Heuristic match: "ipchicken.com" Heuristic match: "ipecho.net" Heuristic match: "ipinfo.info" Heuristic match: "ipinfo.io" Heuristic match: "ipleak.net" Heuristic match: "ipligence.com" Heuristic match: "knowmyip.com" Heuristic match: "maxmind.com" Heuristic match: "meineipadresse.de" Heuristic match: "myexternalip.com" Heuristic match: "myip.dnsomatic.com" Heuristic match: "myip.ht" Heuristic match: "myip.nl" Heuristic match: "myip.opendns.com" Heuristic match: "myipaddress.com" Heuristic match: "queryip.net" Heuristic match: "showmyip.com" Heuristic match: "showmyipaddress.com" Heuristic match: "tracemyip.org" Heuristic match: "whatismyip.akamai.com" Heuristic match: "whatismyip.ca" Heuristic match: "whatismyip.com" Heuristic match: "whatismyip.everdot.org" Heuristic match: "whatismyipaddress.com" Heuristic match: "whatsmyip.net" Heuristic match: "whatsmyip.org" Heuristic match: "whatsmyipaddress.org" Heuristic match: "whatsmypublicip.com" Heuristic match: "wtfismyip.com" Heuristic match: "hispeed.ch" Heuristic match: "2$.se" Pattern match: "http://www.w3.org/2001/XMLSchema-instance" Pattern match: "Microsoft.NET/Framework/v4.0.30319/" Pattern match: "Microsoft.Net/assembly/GAC_MSIL/System/v4.0_4.0.0.0__b77a5c561934e089/System.dll" Heuristic match: "ileStream.IO" Pattern match: "api.ip.sb/ip" Heuristic match: "a.Com"29:T865,".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\v4.0.30319\mscoreei.dll (UID: 00000000-00006072) ".exe" called "FindFirstFileW" with parameter %WINDIR%\Microsoft.NET\Framework\\* (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter .. (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter NETFXSBS10.exe (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter netfxsbs12.hkf (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbscmp10.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbscmp20_mscorwks.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbscmp20_perfcounter.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbs_diasymreader.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbs_iehost.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbs_microsoft.jscript.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbs_mscordbi.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbs_mscorsec.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbs_system.configuration.install.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbs_system.data.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter sbs_wminet_utils.dll (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter v1.0.3705 (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter v2.0.50727 (UID: 00000000-00006072) ".exe" called "FindNextFileW" with parameter v4.0.30319 (UID: 00000000-00006072) ".exe" called "FindFirstFileW" with parameter %WINDIR%\assembly\NativeImages_v4.0.30319_32\mscorlib\* (UID: 00000000-00006072)2a:Tc1c,Observed api string:"CoRevertToSelf which can Terminates the impersonation of a client application"[Source: 00000000-00006072.00000000.79151.74481000.00000020.mdmp] Observed api string:"GetTokenInformation which can Retrieves a specified type of information about an access token"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"GetLengthSid which can Returns the length in bytes of a valid security identifier (SID)"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"SetSecurityDescriptorGroup which can Sets the primary group information of an absolute-format security descriptor replacing any primary group information already present in the security descriptor"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"AddAccessAllowedAce which can Adds an access-allowed access control entry (ACE) to an access control list (ACL)"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"InitializeAcl which can Initializes a new ACL structure"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"InitializeSecurityDescriptor which can Initializes a new security descriptor"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"AddAccessDeniedAce which can Adds an access-denied access control entry (ACE) to an access control list (ACL)"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"SetSecurityDescriptorOwner which can Sets the owner information of an absolute-format security descriptor"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"SetSecurityDescriptorDacl which can Sets information in a discretionary access control list (DACL)"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"MakeAbsoluteSD2 which can Creates a security descriptor in absolute format by using a security descriptor in self-relative format as a template"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"GetSecurityDescriptorLength which can Returns the length in bytes of a structurally valid security descriptor"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"GetAclInformation which can Retrieves information about an access control list (ACL)"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"GetSecurityDescriptorDacl which can Retrieves a pointer to the discretionary access control list (DACL) in a specified security descriptor"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"DuplicateTokenEx which can Creates a new access token that duplicates one already in existence"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp] Observed api string:"DuplicateTokenEx which can Creates a new access token that duplicates an existing token"[Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]2b:T49b,Found string "CorExitProcess" (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin, API is part of module: CLR.DLL) Found string "FlsGetValue" (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin, API is part of module: KERNELBASE.DLL) Found string "FlsSetValue" (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin, API is part of module: KERNELBASE.DLL) Found string "GetActiveWindow" (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin, API is part of module: USER32.DLL) Found string "GetLastActivePopup" (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin, API is part of module: USER32.DLL) Found string "GetProcessWindowStation" (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin, API is part of module: USER32.DLL) Found string "GetUserObjectInformationA" (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin, API is part of module: USER32.DLL) Found string "MessageBoxA" (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin, API is part of module: USER32.DLL)2c:T2106,"api.ipify.org" (Indicator: "api.ipify.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "checkip.amazonaws.com" (Indicator: "checkip.amazonaws.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "checkip.dyndns.com" (Indicator: "checkip.dyndns.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "checkip.dyndns.org" (Indicator: "checkip.dyndns.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "checkip.org" (Indicator: "checkip.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "checkmyip.com" (Indicator: "checkmyip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "cmyip.com" (Indicator: "cmyip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "curlmyip.com" (Indicator: "curlmyip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "findmyip.org" (Indicator: "findmyip.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "formyip.com" (Indicator: "formyip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "geoip.co.uk" (Indicator: "geoip.co.uk"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "geoiptool.com" (Indicator: "geoiptool.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "getmyip.co.uk" (Indicator: "getmyip.co.uk"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "getmyip.org" (Indicator: "getmyip.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "icanhazip.com" (Indicator: "icanhazip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ifconfig.me" (Indicator: "ifconfig.me"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ip-addr.es" (Indicator: "ip-addr.es"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ip-address.domaintools.com" (Indicator: "ip-address.domaintools.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ip-api.com" (Indicator: "ip-api.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ip-score.com" (Indicator: "ip-score.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ip.jsontest.com" (Indicator: "ip.jsontest.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ip.xss.ru" (Indicator: "ip.xss.ru"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ip4.telize.com" (Indicator: "ip4.telize.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ipchicken.com" (Indicator: "ipchicken.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ipecho.net" (Indicator: "ipecho.net"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ipinfo.info" (Indicator: "ipinfo.info"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ipinfo.io" (Indicator: "ipinfo.io"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ipleak.net" (Indicator: "ipleak.net"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "ipligence.com" (Indicator: "ipligence.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "knowmyip.com" (Indicator: "knowmyip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "maxmind.com" (Indicator: "maxmind.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "meineipadresse.de" (Indicator: "meineipadresse.de"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "myexternalip.com" (Indicator: "myexternalip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "myip.dnsomatic.com" (Indicator: "myip.dnsomatic.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "myip.ht" (Indicator: "myip.ht"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "myip.nl" (Indicator: "myip.nl"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "myip.opendns.com" (Indicator: "myip.opendns.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "myipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "queryip.net" (Indicator: "queryip.net"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "showmyip.com" (Indicator: "showmyip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "showmyipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "tracemyip.org" (Indicator: "tracemyip.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "whatismyip.akamai.com" (Indicator: "whatismyip.akamai.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "whatismyip.ca" (Indicator: "whatismyip.ca"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "whatismyip.com" (Indicator: "whatismyip.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "whatismyip.everdot.org" (Indicator: "whatismyip.everdot.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "whatismyipaddress.com" (Indicator: "myipaddress.com"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "whatsmyip.net" (Indicator: "whatsmyip.net"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "whatsmyip.org" (Indicator: "whatsmyip.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp") "whatsmyipaddress.org" (Indicator: "whatsmyipaddress.org"; File: "00000000-00006072.00000000.79151.02960000.00000004.mdmp, 00000000-00006072.00000000.79151.04910000.00000004.mdmp")2d:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAB3d3d3d3d3d3d3d3d3AAAAd3d3d3d3d3d3d3d3dwAAd3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3dwB3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3cHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3B3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cHB3d3d3d3d3d3d3d3d3d3Bwd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3cAd3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3d3dwcHd3d3d3d3d3d3d3d3d3dwd3d3d3d3d3d3d3d3d3d3AHd3d3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3cAB3d3d3d3d3d3d3d3d3dwAAAAd3AAAAAAAAB3d3d3dwAAAAAAAAAAAAAAAAAHd3AAAHd3d3d3d3d3d3d3d3cAAAAAAAAAAAAAAAAAAAAAAADwAAAD8AAAA8AAAAMAAAAAAAAAAwAAAAMAAAADAAAAAwAAAAMAAAABAAAAAAAAAAMAAAADAAAAAAAAAAKAAAACAAAAAAAAAAKAAAACgAAAAAAAAAMAAAAAAAAAAoAAAAEAAAADAAAAAOAAAAOAAAAH8f/wA////4fAAAAP/////w==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791084926638,"unified_at":"2026-10-04T03:35:26.638Z","metadata":{"hashes":{"sha256":"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2","sha1":"f746b5f15ebf476579d0705720ab4daec3306e41","md5":"69fb73e283630210dcb0e9b400a1ee4c","sha512":"ee9062a2b4a2ece85c000e369dd1bc1815ce159c87235cba0e36e7a26f7548c28d4c6dfe9a10b22addbe7b1f8c2cd9972446925a5e57fa0644d9c617cda1784f","ssdeep":"6144:YY0L64nRBgQZ50kxyZCQj4pPIuVBNX++ZbE8GqcdPQrixxAAY4eZu:YY0O4RBgQwsyZj4pPlxu+ZQ8id4rixxH","ssdeep_chunks":["6144:YY0L64n","6144:Y0L64nR","6144:0L64nRB","6144:L64nRBg","6144:64nRBgQ","6144:4nRBgQZ","6144:nRBgQZ5","6144:RBgQZ50","6144:BgQZ50k","6144:gQZ50kx","6144:QZ50kxy","6144:Z50kxyZ","6144:50kxyZC","6144:0kxyZCQ","6144:kxyZCQj","6144:xyZCQj4","6144:yZCQj4p","6144:ZCQj4pP","6144:CQj4pPI","6144:Qj4pPIu","6144:j4pPIuV","6144:4pPIuVB","6144:pPIuVBN","6144:PIuVBNX","6144:IuVBNX+","6144:uVBNX++","6144:VBNX++Z","6144:BNX++Zb","6144:NX++ZbE","6144:X++ZbE8","6144:++ZbE8G","6144:+ZbE8Gq","6144:ZbE8Gqc","6144:bE8Gqcd","6144:E8GqcdP","6144:8GqcdPQ","6144:GqcdPQr","6144:qcdPQri","6144:cdPQrix","6144:dPQrixx","6144:PQrixxA","6144:QrixxAA","6144:rixxAAY","6144:ixxAAY4","6144:xxAAY4e","6144:xAAY4eZ","6144:AAY4eZu","12288:YY0L64n","12288:Y0L64nR","12288:0L64nRB","12288:L64nRBg","12288:64nRBgQ","12288:4nRBgQZ","12288:nRBgQZ5","12288:RBgQZ50","12288:BgQZ50k","12288:gQZ50kx","12288:QZ50kxy","12288:Z50kxyZ","12288:50kxyZC","12288:0kxyZCQ","12288:kxyZCQj","12288:xyZCQj4","12288:yZCQj4p","12288:ZCQj4pP","12288:CQj4pPI","12288:Qj4pPIu","12288:j4pPIuV","12288:4pPIuVB","12288:pPIuVBN","12288:PIuVBNX","12288:IuVBNX+","12288:uVBNX++","12288:VBNX++Z","12288:BNX++Zb","12288:NX++ZbE","12288:X++ZbE8","12288:++ZbE8G","12288:+ZbE8Gq","12288:ZbE8Gqc","12288:bE8Gqcd","12288:E8GqcdP","12288:8GqcdPQ","12288:GqcdPQr","12288:qcdPQri","12288:cdPQrix","12288:dPQrixx","12288:PQrixxA","12288:QrixxAA","12288:rixxAAY","12288:ixxAAY4","12288:xxAAY4e","12288:xAAY4eZ","12288:AAY4eZu","6144:YY0O4RB","6144:Y0O4RBg","6144:0O4RBgQ","6144:O4RBgQw","6144:4RBgQws","6144:RBgQwsy","6144:BgQwsyZ","6144:gQwsyZj","6144:QwsyZj4","6144:wsyZj4p","6144:syZj4pP","6144:yZj4pPl","6144:Zj4pPlx","6144:j4pPlxu","6144:4pPlxu+","6144:pPlxu+Z","6144:Plxu+ZQ","6144:lxu+ZQ8","6144:xu+ZQ8i","6144:u+ZQ8id","6144:+ZQ8id4","6144:ZQ8id4r","6144:Q8id4ri","6144:8id4rix","6144:id4rixx","6144:d4rixxH"],"imphash":"318b75056fe1945612232cd0eae11bd2"},"file_info":{"file_name":"69fb73e283630210dcb0e9b400a1ee4c.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":373760,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1678215907000,"last_seen":1678215907000,"last_multi_scan":1678215907000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["backdoor","commodity","informationstealer","redlinestealer","windows-server-utility"]},"stats":{"av":{"malicious_count":5,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":32},"sandbox_signatures":{"informative_count":52,"suspicious_count":16,"malicious_count":3,"total":71},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 00516fdf1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"microsoftdefender":{"name":"Microsoft Defender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"Ransom.84989A88","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"Ransom.84989A88","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Loads the .NET runtime environment"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Input file contains API references not part of its Import Address Table (IAT)"},{"type":"informative","value":"Calls an API typically used to find a resource in a module"},{"type":"informative","value":"Calls an API typically used to load a resource in memory"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Found API related strings"},{"type":"informative","value":"Contains ability to modify processes thread functionality (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Contains ability to Connect to a message-type pipe (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Execution","technique":"Windows Management Instrumentation","attack_id":"T1047","attack_id_wiki":"https://attack.mitre.org/techniques/T1047","identifiers":[{"type":"suspicious","value":"Contains references to WMI/WMIC"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Persistence","technique":"Component Object Model Hijacking","attack_id":"T1546.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1546/015","identifiers":[{"type":"informative","value":"Overview of unique CLSIDs touched in registry"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"},{"type":"informative","value":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Privilege Escalation","technique":"Access Token Manipulation","attack_id":"T1134","attack_id_wiki":"https://attack.mitre.org/techniques/T1134","identifiers":[{"type":"suspicious","value":"Adjusts debug privileges"},{"type":"suspicious","value":"Calls an API typically used to enable or disable privileges in the specified access token"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Privilege Escalation","technique":"Abuse Elevation Control Mechanism","attack_id":"T1548","attack_id_wiki":"https://attack.mitre.org/techniques/T1548","identifiers":[{"type":"informative","value":"Contains ability to use security policy setting (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Privilege Escalation","technique":"Token Impersonation/Theft","attack_id":"T1134.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/001","identifiers":[{"type":"informative","value":"Contains ability to obtains specified information about the security of a file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Privilege Escalation","technique":"Create Process with Token","attack_id":"T1134.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1134/002","identifiers":[{"type":"informative","value":"Contains ability to create process with token (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"suspicious","value":"Tries to sleep for a long time (more than two minutes)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"suspicious","value":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)"},{"type":"informative","value":"Found debugger evasion api strings"},{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"},{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"suspicious","value":"Found a cryptographic related string"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Contains ability to decode base64 data (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Discovery","technique":"Peripheral Device Discovery","attack_id":"T1120","attack_id_wiki":"https://attack.mitre.org/techniques/T1120","identifiers":[{"type":"informative","value":"Queries volume information"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Calls an API's typically used for searching a directory for a files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Calls an API typically used to retrieve information about the current system"},{"type":"suspicious","value":"Contains ability to retrieve a module handle for the specified module"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve the OS version (API string)"},{"type":"informative","value":"Contains ability to retrieve information about operating system (API string)"},{"type":"informative","value":"Contains ability to retrieve information about the current system (API string)"},{"type":"informative","value":"Contains ability to retrieve the NetBIOS name of the local computer (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to determine whether a process running under Wow64"},{"type":"informative","value":"Reads the cryptographic machine GUID"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate processes (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Calls an API typically used to get handle of currently active window"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Reads the windows installation language"},{"type":"informative","value":"Contains ability to retrieve local language (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Discovery","technique":"System Network Configuration Discovery","attack_id":"T1016","attack_id_wiki":"https://attack.mitre.org/techniques/T1016","identifiers":[{"type":"malicious","value":"Found a reference to an external IP address lookup service"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Writes log files"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","identifiers":[{"type":"suspicious","value":"Found a potential E-Mail address in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to take screen capture of the target machine (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"suspicious","value":"Found browsers sensitive information related strings"},{"type":"suspicious","value":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Making HTTPS connections using secure TLS/SSL version"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"YARA signature match - RC4 Encryption"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to find a resource in a module","description":"\".exe\" called \"FindResourceA\" with parameter \"9424368\" - (UID: 00000000-00006072)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-140","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Calls an API typically used to load a resource in memory","description":"\".exe\" called \"LoadResource\" (UID: 00000000-00006072)","origin":"API Call","mitre_attack_id":"T1106","relevance":3,"id":"api-139","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to Connect to a message-type pipe (API string)","description":"Observed API string:\"CallNamedPipe\" [Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin]","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-165","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Observed api string:\"SetUnhandledExceptionFilter\" [Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin]\n Observed api string:\"UnhandledExceptionFilter\" [Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin]\n Observed api string:\"UnhandledExceptionFilter\" [Source: 00000000-00006072.00000000.79151.00400000.00000040.mdmp\n 00000000-00006072.00000000.79151.02A50000.00000040.mdmp\n 00000000-00006072.00000000.79151.02AA0000.00000004.mdmp\n 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]\n Observed api string:\"SetUnhandledExceptionFilter\" [Source: 00000000-00006072.00000000.79151.00400000.00000040.mdmp\n 00000000-00006072.00000000.79151.02A50000.00000040.mdmp\n 00000000-00006072.00000000.79151.02AA0000.00000004.mdmp\n 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.dll at 38331-2055-00407137\n SetUnhandledExceptionFilter@KERNEL32.dll at 38331-554-0040C665","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Found debugger evasion api strings","description":"Observed string:\"IsDebuggerPresent\" [Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin]","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-183","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data (API string)","description":"Observed api string:\"FromBase64String\" [Source: 00000000-00006072.00000000.79151.04D60000.00000004.mdmp\n 00000000-00006072.00000000.79151.06250000.00000004.mdmp\n 00000000-00006072.00000000.79151.078B0000.00000004.mdmp\n 00000000-00006072.00000000.79151.07930000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to determine whether a process running under Wow64","description":"\".exe\" called \"IsWow64Process\" with parameter \"6072\" - (UID: 00000000-00006072)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-146","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get handle of currently active window","description":"\".exe\" called \"GetActiveWindow\" (UID: 00000000-00006072)","origin":"API Call","mitre_attack_id":"T1010","relevance":5,"id":"api-150","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\".exe\" called \"RtlGetNtProductType\" (UID: 00000000-00006072)\n \".exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00006072)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$25","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve local language (API string)","description":"Observed string:\"GetLocaleInfoA\" [Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin]\n Observed string:\"GetLocaleInfoA\" [Source: 00000000-00006072.00000000.79151.00400000.00000040.mdmp\n 00000000-00006072.00000000.79151.02A50000.00000040.mdmp\n 00000000-00006072.00000000.79151.02AA0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1614.001","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS version (API string)","description":"Observed string:\"VerSetConditionMask \" [Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin]\n Observed string:\"GetVersionInfo \" [Source: 00000000-00006072.00000000.79151.04D60000.00000004.mdmp\n 00000000-00006072.00000000.79151.06250000.00000004.mdmp\n 00000000-00006072.00000000.79151.078B0000.00000004.mdmp\n 00000000-00006072.00000000.79151.07930000.00000004.mdmp]\n Observed string:\"GetVersionExW \" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure (API string)","description":"Observed API string:\"GetStartupInfo\" [Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin]\n Observed API string:\"GetStartupInfo\" [Source: 00000000-00006072.00000000.79151.00400000.00000040.mdmp\n 00000000-00006072.00000000.79151.02A50000.00000040.mdmp\n 00000000-00006072.00000000.79151.02AA0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1543","relevance":1,"id":"string-167","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Queries volume information","description":"\".exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Windows.Forms\\v4.0_4.0.0.0__b77a5c561934e089\\System.Windows.Forms.dll\" at 00000000-00006072-00000049-2897225\n \".exe\" queries volume information of \"C:\\Windows\\Microsoft.NET\\assembly\\GAC_MSIL\\System.Drawing\\v4.0_4.0.0.0__b03f5f7f11d50a3a\\System.Drawing.dll\" at 00000000-00006072-00000049-3476403","origin":"API Call","mitre_attack_id":"T1120","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"C:\\wereyo_kixuxovep\\nez27_xefig.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"Contains ability to modify processes thread functionality (API string)","description":"Observed API string:\"OpenThread\" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]\n Observed API string:\"GetThreadContext\" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"SM0:6072:168:WilStaging_02\"\n \"Local\\SM0:6072:168:WilStaging_02\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"Found API related strings","description":"\"CorExitProcess\" (Indicator: \"ExitProcess\")\n \"EncodePointer\" (Indicator: \"EncodePointer\")\n \"DecodePointer\" (Indicator: \"DecodePointer\")\n \"FlsSetValue\" (Indicator: \"FlsSetValue\")\n \"FlsGetValue\" (Indicator: \"FlsGetValue\")\n \"GAIsProcessorFeaturePresent\" (Indicator: \"IsProcessorFeaturePresent\")\n \"GetLastActivePopup\" (Indicator: \"GetLastActivePopup\")\n \"GetActiveWindow\" (Indicator: \"GetActiveWindow\")\n \"MessageBoxA\" (Indicator: \"MessageBoxA\")\n \"RaiseException\" (Indicator: \"RaiseException\")\n \"GetLastError\" (Indicator: \"GetLastError\")\n \"MultiByteToWideChar\" (Indicator: \"MultiByteToWideChar\")\n \"lstrlenA\" (Indicator: \"lstrlenA\")\n \"GetProcAddress\" (Indicator: \"GetProcAddress\")\n \"LoadLibraryA\" (Indicator: \"LoadLibraryA\")\n \"FreeResource\" (Indicator: \"FreeResource\")\n \"SizeofResource\" (Indicator: \"SizeofResource\")\n \"LockResource\" (Indicator: \"LockResource\")\n \"LoadResource\" (Indicator: \"LoadResource\")\n \"FindResourceA\" (Indicator: \"FindResourceA\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\".exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 73dd0000\n \".exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 73dd0000\n \".exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 73dd0000\n \".exe\" loaded module \"KERNEL32\" at base 74160000\n \".exe\" loaded module \"MSIMG32.DLL\" at base 72020000\n \".exe\" loaded module \"KERNEL32.DLL\" at base 74160000\n \".exe\" loaded module \"OLE32.DLL\" at base 76cc0000\n \".exe\" loaded module \"OLEAUT32.DLL\" at base 763f0000\n \".exe\" loaded module \"MSVCR100.DLL\" at base 71f60000\n \".exe\" loaded module \"%WINDIR%\\SYSTEM32\\UXTHEME.DLL\" at base 724d0000\n \".exe\" loaded module \"MSCOREE.DLL\" at base 71f00000\n \".exe\" loaded module \"ADVAPI32.DLL\" at base 77300000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\".exe\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\36eaccfde177c2e7b93b8dbdde4e012a\\mscorlib.ni.dll\" at 6C360000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-3","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"Windows Defender IOfficeAntiVirus implementation\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{2781761E-28E0-4109-99FE-B9D127C57AFE}\\INPROCSERVER32\")\n \".exe\" touched \"NDP SymBinder\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{0A29FF9E-7F9C-4437-8B11-F424491E3931}\\SERVER\")","origin":"Registry Access","mitre_attack_id":"T1546.015","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin\" has an writable section named \".data\"","origin":"Static Parser","relevance":1,"id":"static-95","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin\" file has an entrypoint instructions - \"call\t0x4083af,jmp\t0x404e9a,push\t8,push\t0x4130f0,call\t0x406aa8,mov\tecx, dword ptr [ebp + 8],test\tecx, ecx,je\t0x40505e,cmp\tdword ptr [ecx], 0xe06d7363,jne\t0x40505e,mov\teax, dword ptr [ecx + 0x1c],test\teax, eax,je\t0x40505e,mov\teax, dword ptr [eax + 4],test\teax, eax,je\t0x40505e,and\tdword ptr [ebp - 4], 0,push\teax,push\tdword ptr [ecx + 0x18],call\t0x40857c,mov\tdword ptr [ebp - 4], 0xfffffffe,call\t0x406aed,ret\t,xor\teax, eax,cmp\tbyte ptr [ebp + 0xc], al,setne\tal,ret\t,mov\tesp, dword ptr [ebp - 0x18],call\t0x4084d8,int3\t,call\t0x4080a9,\"","origin":"Static Parser","relevance":1,"id":"static-96","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe.log\" has type \"ASCII text with CRLF line terminators\"- Location: [%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe.log]- [targetUID: 00000000-00006072]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$26","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"$27","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes log files","description":"\".exe\" writes a file \"C:\\Users\\%OSUSER%\\AppData\\Local\\Microsoft\\CLR_v4.0_32\\UsageLogs\\9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe.log\"\n \"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe\" writes a file \"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe.log\"","origin":"API Call","mitre_attack_id":"T1074.001","relevance":1,"id":"api-159","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$28","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Network Related","name":"Making HTTPS connections using secure TLS/SSL version","description":"Connection was make using TLSv1.2 [tls.handshake.version: 0x00000303]","origin":"Network Traffic","mitre_attack_id":"T1573","relevance":1,"id":"network-54","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00006072\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1486","relevance":5,"id":"yara-104","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\".exe\" called \"CreateToolhelp32Snapshot\" (UID: 00000000-00006072)","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API's typically used for searching a directory for a files","description":"$29","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Observed api string:\"FindFirstFileW\" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]\n Observed api string:\"FindNextFileW\" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate processes (API string)","description":"Observed api string:\"CreateToolhelp32Snapshot\" [Source: 00000000-00006072.00000000.79151.00400000.00000040.mdmp\n 00000000-00006072.00000000.79151.02A50000.00000040.mdmp\n 00000000-00006072.00000000.79151.02AA0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about operating system (API string)","description":"Observed api string:\"8194978494,3664,3025,,RtlGetNtProductType,NTDLL.dll,\"252:06:09.578\",RX=0,PX=0\" [Source: 00000000-00006072.00000000.79151.02D17000.00000004.mdmp]\n Observed api string:\"8302323362,3664,3025,,RtlGetNtProductType,NTDLL.dll,\"252:06:09.625\",RX=0,PX=0\" [Source: 00000000-00006072.00000000.79151.02D17000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve information about the current system (API string)","description":"Observed api string:\"GetNativeSystemInfo\" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the NetBIOS name of the local computer (API string)","description":"Observed api string:\"GetComputerNameW\" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-122","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Observed API string:\"GetModuleFileName\" [Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin]\n Observed API string:\"GetModuleFileName\" [Source: 00000000-00006072.00000000.79151.00400000.00000040.mdmp\n 00000000-00006072.00000000.79151.02A50000.00000040.mdmp\n 00000000-00006072.00000000.79151.02AA0000.00000004.mdmp\n 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]\n Observed API string:\"GetModuleFileName\" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieves the class object from a DLL object handler (API string)","description":"Observed api string:\"DllGetClassObject\" [Source: 00000000-00006072.00000000.79151.74481000.00000020.mdmp]","origin":"File/Memory","relevance":1,"id":"string-82","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to take screen capture of the target machine (API string)","description":"Observed api string:\"\" [Source: 00000000-00006072.00000000.79151.02CD0000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"System Security","name":"Contains ability to create process with token (API string)","description":"Observed API string:\"CreateProcessAsUserW\" [Source: 00000000-00006072.00000000.79151.744F7000.00000002.mdmp]","origin":"File/Memory","mitre_attack_id":"T1134.002","relevance":1,"id":"string-168","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"System Security","name":"Contains ability to obtains specified information about the security of a file or directory (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1134.001","relevance":1,"id":"string-114","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"System Security","name":"Contains ability to use security policy setting (API string)","description":"Observed api string:\"SeDebugPrivilege$ which can Debug programs\"[Source: 00000000-00006072.00000000.79151.02D17000.00000004.mdmp]\n Observed api string:\"SeDebugPrivilege which can Debug programs\"[Source: 00000000-00006072.00000000.79151.05250000.00000004.mdmp]","origin":"File/Memory","mitre_attack_id":"T1548","relevance":3,"id":"string-97","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin\" was detected as \"VC8 -> Microsoft Corporation\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"\"RuntimeBroker.exe\" (Indicator: \"runtimebroker.exe\")","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\".exe\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","mitre_attack_id":"T1622","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Found a cryptographic related string","description":"Found - (Indicator: \"des\") in Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin\n Found - (Indicator: \"des\") in Source: 00000000-00006072-00000BC0-82904213\n Found - (Indicator: \"rar \") in Source: 9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.bin","origin":"File/Memory","mitre_attack_id":"T1027","relevance":3,"id":"string-57","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle for the specified module","description":"GetModuleHandleA@KERNEL32.dll at 38331-569-0040D667","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoW@KERNEL32.dll at 38331-1-00405017","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Environment Awareness","name":"Tries to sleep for a long time (more than two minutes)","description":"\".exe\" sleeping for \"1566804069\" milliseconds","origin":"API Call","mitre_attack_id":"T1497.003","relevance":10,"id":"api-24","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"General","name":"Found a potential E-Mail address in binary/memory","description":"Pattern match: \"v@t.w3\"\n Pattern match: \"myapplicat@v.a\"\n Pattern match: \"p@pfg.p4p\"","origin":"File/Memory","mitre_attack_id":"T1114","relevance":3,"id":"string-63","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"53.84.7.37\"\n Potential IP \"1.0.0.0\" found in string \"\"\n Potential IP \"4.0.0.0\" found in string \"on=4.0.0.0,O\"\n \"0.0.0.0\"\n Potential IP \"4.0.0.0\" found in string \"ion=4.0.0.0, Culture=neuq\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture=neutral, PublicKeyToken\"\n Potential IP \"4.0.0.0\" found in string \"sion=4.0.0.0, Culture=neutral, PublicKeyr\"\n Potential IP \"4.0.0.0\" found in string \"4.0.0.0, Culture=neutral, PublicKeyTokenN\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains references to WMI/WMIC","description":"\"api-ms-win-base-bootconfig-l1-1-0\" (Indicator: \"bootconfig\")\n \"WmiPrvSE.exe\" (Indicator: \"wmiprvse.exe\")\n \"WMIADAP.exe\" (Indicator: \"wmiadap.exe\")","origin":"File/Memory","mitre_attack_id":"T1047","relevance":10,"id":"string-30","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Calls an API typically used to retrieve information about the current system","description":"\".exe\" called \"GetNativeSystemInfo\" (UID: 00000000-00006072)","origin":"API Call","mitre_attack_id":"T1082","relevance":5,"id":"api-108","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found browsers sensitive information related strings","description":"\"autofillProfilesTotal of RAMVPEntity12NAppData\\Local\\[^\\u0020-\\u007F]UNKNOWNLocal StateProcessId1*.1l1d1bProfile_%appdata%\\logins{0}\\FileZilla\\recentservers.xml%appdata%\\discord\\Local Storage\\leveldb\\tdatav10 MB or [AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}profiles\\Windows\\value\" in Source: 00000000-00006072.00000000.79151.04D60000.00000004.mdmp\n 00000000-00006072.00000000.79151.06250000.00000004.mdmp\n 00000000-00006072.00000000.79151.078B0000.00000004.mdmp\n 00000000-00006072.00000000.79151.07930000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1005","relevance":3,"id":"string-133","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Found desktop apps credentials related location strings","description":"\"autofillProfilesTotal of RAMVPEntity12NAppData\\Local\\[^\\u0020-\\u007F]UNKNOWNLocal StateProcessId1*.1l1d1bProfile_%appdata%\\logins{0}\\FileZilla\\recentservers.xml%appdata%\\discord\\Local Storage\\leveldb\\tdatav10 MB or [AString-ZaString-z\\d]{2String4}\\.[String\\w-]{String6}\\.[\\wString-]{2String7}profiles\\Windows\\value\" (Indicator: \"discord\\local storage\\\") in Source: 00000000-00006072.00000000.79151.04D60000.00000004.mdmp\n 00000000-00006072.00000000.79151.06250000.00000004.mdmp\n 00000000-00006072.00000000.79151.078B0000.00000004.mdmp\n 00000000-00006072.00000000.79151.07930000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1005","relevance":5,"id":"string-95","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"System Security","name":"Adjusts debug privileges","description":"\".exe\" adjusted SE_DEBUG_PRIVILEGE","origin":"API Call","mitre_attack_id":"T1134","relevance":3,"id":"api-28","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\".exe\" called an API \"AdjustTokenPrivileges\"","origin":"API Call","mitre_attack_id":"T1134","relevance":5,"id":"api-111","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetFileAttributesA\n UnhandledExceptionFilter\n FindResourceExW\n GetModuleFileNameW\n IsDebuggerPresent\n GetModuleFileNameA\n GetModuleHandleA\n TerminateProcess\n GetTickCount\n LoadLibraryA\n GetStartupInfoA\n GetStartupInfoW\n GetProcAddress\n WriteFile\n CreateFileA\n GetCommandLineW\n GetModuleHandleW\n Sleep\n VirtualAlloc","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Input file contains API references not part of its Import Address Table (IAT)","description":"$2b","origin":"File/Memory","mitre_attack_id":"T1106","relevance":10,"id":"string-64","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE GROUPS\"; Key: \"1\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":5,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"malicious","category":"Network Related","name":"Found a reference to an external IP address lookup service","description":"$2c","origin":"File/Memory","mitre_attack_id":"T1016","relevance":6,"id":"string-56","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"level":"malicious","category":"Pattern Matching","name":"YARA signature match","description":"YARA signature \"MALWARE_Win_RedLine\" matched process \"00000000-00006072\" as \"Detects RedLine infostealer\" (Author: ditekSHen)","origin":"YARA Signature","relevance":10,"id":"yara-0","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]}],"incidents":[{"name":"Spyware","details_count":2,"details":[{"detail":"Found a string that may be used as part of an injection method"},{"detail":"Found desktop apps credentials related location strings"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Input file contains API references not part of its Import Address Table (IAT)"}],"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":2,"imported_dlls_count":61,"dropped_files_count":0,"extracted_files_count":1,"files_written_count":1,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["backdoor","commodity","informationstealer","redlinestealer","windows-server-utility"],"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6407a5a2838c3d62a00e0222","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe","analysis_start_time":"2023-03-07T20:59:15+00:00","indicators_count":{"informative":52,"suspicious":18,"malicious":3},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}],"processes":[{"pid":6072,"ppid":0,"name":"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe","command_line":"","sha256":"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2","normalized_path":"C:\\9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe","uid":"00000000-00006072","icon":"$2d"}],"all_imported_dlls":["win32u.dll","bcrypt.dll","WinTypes.dll","wow64win.dll","msvcp_win.dll","cryptbase.dll","profapi.dll","CoreMessaging.dll","rsaenh.dll","wow64cpu.dll","gdi32.dll","advapi32.dll","CoreUIComponents.dll","apphelp.dll","uxtheme.dll","wintrust.dll","dwmapi.dll","rpcrt4.dll","vcruntime140_clr0400.dll","clbcatq.dll","ntdll.dll","wow64.dll","combase.dll","fltLib.dll","cryptsp.dll","ucrtbase.dll","ole32.dll","clr.dll","mscorlib.ni.dll","amsi.dll","mscoree.dll","msasn1.dll","clrjit.dll","psapi.dll","TextInputFramework.dll","gdi32full.dll","imm32.dll","sspicli.dll","shlwapi.dll","diasymreader.dll","KernelBase.dll","oleaut32.dll","kernel.appcore.dll","sechost.dll","mscoreei.dll","bcryptprimitives.dll","msvcrt.dll","msvcr100.dll","version.dll","kernel32.dll","wldp.dll","crypt32.dll","user32.dll","msimg32.dll","ucrtbase_clr0400.dll","System.ni.dll","SHCore.dll","ws2_32.dll","userenv.dll","msctf.dll","ntmarta.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe.log","sha256":"9ffa0a86729e45cfd8f7f3c46a114f4771baeb8fc7bef334d77b06bbfd0608ca","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]}],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\CLR_v4.0_32\\UsageLogs\\9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2.exe.log","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"SM0:6072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]},{"name":"Local\\SM0:6072:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"6407a5a2838c3d62a00e0222"}]}]}},"report_ids":{"sandbox_job_ids":["6407a5a2838c3d62a00e0222"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Generic Sample 9cda3093ddda… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 9cda3093ddda…. Malware family: Trojan.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Generic Sample 9cda3093ddda… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 9cda3093ddda…. Malware family: Trojan.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/9cda3093dddacbd05e0e9c8ce7320c73320ff2ea4b66ca3578b5b4fd9dc80fe2"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Generic Sample 9cda3093ddda… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 9cda3093ddda…. Malware family: Trojan.Generic. Threat score 100/100. 5/28 AV engines flagged this file. 3 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2e","11",{}]]