24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 58:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T421,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample aa589ef7e0ea… — Score 85/100 — Hybrid Analysis","description":"Malicious verdict for sample aa589ef7e0ea…. Threat score 85/100. 0/26 AV engines flagged this file. 2 malicious and 22 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/aa589ef7e0ea27bed4ee87929117cfc5b28b68c343b3991209514db311c1a3ec","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","aa589ef7e0ea27bed4ee87929117cfc5b28b68c343b3991209514db311c1a3ec"],"about":{"@type":"SoftwareApplication","name":"ChatAgent.exe","applicationCategory":["compressed","7zip"],"identifier":"aa589ef7e0ea27bed4ee87929117cfc5b28b68c343b3991209514db311c1a3ec","additionalType":"Malicious sample"},"threatScore":85,"antivirusDetections":{"malicious":0,"total":26},"behavioralIndicators":{"malicious":2,"suspicious":22},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T627,Found reference to API "CreateThread" (Indicator: "CreateThread"; File: "aa589ef7e0ea27bed4ee87929117cfc5b28b68c343b3991209514db311c1a3ec.bin") file/memory contains long string with (Indicator: "VirtualAlloc"; File: "System.dll") file/memory contains long string with (Indicator: "VirtualFree"; File: "System.dll") Found reference to API "vkFreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found reference to API "FreeMemory" (Indicator: "FreeMemory"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp") Found reference to API "vkFreeMemory: Invalid device [VUID-vkFreeMemory-device-parameter]" (Indicator: "FreeMemory"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp") Found reference to API "CreateThread" (Indicator: "CreateThread"; Source: "00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp") Found reference to API "VirtualAlloc" (Indicator: "VirtualAlloc"; Source: "00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.786DF000.00000002.mdmp") Found reference to API "VirtualFree" (Indicator: "VirtualFree"; Source: "00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.786DF000.00000002.mdmp")26:T8a0,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "aa589ef7e0ea27bed4ee87929117cfc5b28b68c343b3991209514db311c1a3ec.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "aa589ef7e0ea27bed4ee87929117cfc5b28b68c343b3991209514db311c1a3ec.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp, 00000000-00003288.00000002.159662.786DF000.00000002.mdmp, 00000000-00003288.00000002.159662.8D174000.00000002.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp, 00000000-00003288.00000002.159662.786DF000.00000002.mdmp, 00000000-00003288.00000002.159662.8D174000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp, 00000000-00003288.00000002.159662.786DF000.00000002.mdmp, 00000000-00003288.00000002.159662.8D174000.00000002.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp, 00000000-00003288.00000002.159662.786DF000.00000002.mdmp, 00000000-00003288.00000002.159662.8D174000.00000002.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003288.00000002.159662.6CF68000.00000002.mdmp")27:Tadb,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "aa589ef7e0ea27bed4ee87929117cfc5b28b68c343b3991209514db311c1a3ec.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "aa589ef7e0ea27bed4ee87929117cfc5b28b68c343b3991209514db311c1a3ec.bin") file/memory contains long string with (Indicator: "FreeLibrary"; File: "System.dll") file/memory contains long string with (Indicator: "LoadLibrary"; File: "System.dll") Found reference to API "loader_scanned_icd_add: Failed querying 'vkCreateInstance' via dlsym/LoadLibrary for ICD %s" (Indicator: "LoadLibrary"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp") Found reference to API "loader_scanned_icd_add: Could not get 'vkEnumerateInstanceExtensionProperties' via dlsym/LoadLibrary for ICD %s" (Indicator: "LoadLibrary"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp, 00000000-00003288.00000002.159662.786DF000.00000002.mdmp, 00000000-00003288.00000002.159662.8D174000.00000002.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp, 00000000-00003288.00000002.159662.786DF000.00000002.mdmp, 00000000-00003288.00000002.159662.8D174000.00000002.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003288.00000000.155820.75CCC000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp, 00000000-00003288.00000002.159662.8D174000.00000002.mdmp") Found reference to API "FreeLibraryAndExitThread" (Indicator: "FreeLibrary"; Source: "00000000-00003288.00000002.159662.6CF68000.00000002.mdmp, 00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp") Found reference to API "GPU.ANGLE.D3DCompilerLoadLibraryResult" (Indicator: "LoadLibrary"; Source: "00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp") Found reference to API "D3D Compiler LoadLibrary failed. GetLastError=" (Indicator: "LoadLibrary"; Source: "00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp") Found reference to API "LoadLibrary failed to load D3D Compiler DLL." (Indicator: "LoadLibrary"; Source: "00000000-00003288.00000002.159662.6DFD0000.00000002.mdmp")28:T799,Found string - %TEMP%\3BwMIeSSffs6e3L56SjHbymBZws\.\.\vk_swiftshader.dll; Source: "00000000-00003288-00000C2B-1436851775") Found string - \\.\DISPLAY1; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - \\.\DISPLAY2; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - \\.\DISPLAY7; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - \\.\DISPLAY3; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - \Users\HAPUBWS\AppData\Local\Temp\3BwMIeSSffs6e3L56SjHbymBZws\.\vk_swiftshader_icd.json; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - \\.\DISPLAY5; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - \\.\DISPLAY6; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - C:\Users\HAPUBWS\AppData\Local\Temp\3BwMIeSSffs6e3L56SjHbymBZws\.\.\vk_swiftshader.dll; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - VK_ICD_FILENAMES=C:\Users\HAPUBWS\AppData\Local\Temp\3BwMIeSSffs6e3L56SjHbymBZws\.\vk_swiftshader_icd.json; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp") Found string - IeSSffs6e3L56SjHbymBZws\.\vk_swi; Source: "00000000-00003288.00000000.155820.CFC70000.00000004.mdmp, 00000000-00003288.00000002.159662.CFC70000.00000004.mdmp")29:T774," HTTP/1.1 101 Switching Protocols\nUpgrade: websocket\nConnection: Upgrade\nSec-WebSocket-Accept: cVD4B7Nr294ox2xIkJzu25tMz4M= with no response body","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":10,"id":"network-61","sources":[{"report_type":"sandbox","report_id":"69e0cb6e0b383c18c60a1809"}]},{"level":"suspicious","category":"General","name":"Reads configuration files (.ini files)","description":"\"