21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 2b:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T42d,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Sample b2a52d4797f1… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b2a52d4797f1…. Threat score 100/100. 0/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b2a52d4797f1dce5069f476aed9abd7b577d0a79ff935d7971485d9240e38f14","keywords":["Malicious","malware analysis","sandbox report","threat intelligence","b2a52d4797f1dce5069f476aed9abd7b577d0a79ff935d7971485d9240e38f14"],"about":{"@type":"SoftwareApplication","name":"eis_nt64.exe","applicationCategory":["peexe","64bits","executable"],"identifier":"b2a52d4797f1dce5069f476aed9abd7b577d0a79ff935d7971485d9240e38f14","additionalType":"Malicious sample"},"threatScore":100,"antivirusDetections":{"malicious":0,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T20ad,Pattern match: ".msi.eula/manifest.erm" Pattern match: ".msi.eula/eulabgr.html" Pattern match: ".msi.eula/eulachs.html" Pattern match: ".msi.eula/eulacht.html" Pattern match: ".msi.eula/eulahrv.html" Pattern match: ".msi.eula/eulacsy.html" Pattern match: ".msi.eula/eulanld.html" Pattern match: ".msi.eula/eulaenu.html" Pattern match: ".msi.eula/eulafin.html" Pattern match: ".msi.eula/eulafra.html" Pattern match: ".msi.eula/euladeu.html" Pattern match: ".msi.eula/eulahun.html" Pattern match: ".msi.eula/eulaita.html" Pattern match: ".msi.eula/eulajpn.html" Pattern match: ".msi.eula/eulanor.html" Pattern match: ".msi.eula/eulaplk.html" Pattern match: ".msi.eula/eulaptb.html" Pattern match: ".msi.eula/eularom.html" Pattern match: ".msi.eula/eularus.html" Pattern match: ".msi.eula/eulasky.html" Pattern match: ".msi.eula/eulaslv.html" Pattern match: ".msi.eula/eulaesn.html" Pattern match: ".msi.eula/eulasve.html" Pattern match: ".msi.eula/eulatrk.html" Pattern match: ".msi.eula/eulaukr.html" Pattern match: ".msi.eula/euladan.html" Pattern match: ".msi.eula/eulafrc.html" Pattern match: ".msi.eula/eulaell.html" Pattern match: ".msi.eula/eulaare.html" Pattern match: ".msi.eula/eulaheb.html" Pattern match: ".msi.eula/eulaeti.html" Pattern match: ".msi.eula/eulasrl.html" Pattern match: ".msi.eula/eulatha.html" Pattern match: ".msi.eula/eulakkz.html" Pattern match: ".msi.eula/eulakor.html" Pattern match: ".msi.eula/eulaesl.html" Pattern match: ".msi.eula/eulalvi.html" Pattern match: ".msi.eula/eulalth.html" Pattern match: ".msi.eula/eulavit.html" Pattern match: ".msi.eula/eulaind.html" Heuristic match: "2cCkC PADPK" (Indicator: "cmd=")24:T445,"eis_nt64.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eis_nt64.exe" "eis_nt64.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts\bootstrapper_20200803160157.log" "eis_nt64.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\.erm\epi-base.zip" "eis_nt64.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\sciter-x.dll" "eis_nt64.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eguiActivation.dll" "eis_nt64.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eguiActivationLang.dll" "eis_nt64.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\plgInstaller.dll" "eis_nt64.exe" created file "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\BootHelper.exe"25:T46d,"eis_nt64.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "eis_nt64.exe" touched file "C:\Windows\System32\en-US\msctf.dll.mui" "eis_nt64.exe" touched file "C:\Windows\AppPatch\AppPatch64\sysmain.sdb" "eis_nt64.exe" touched file "C:\Windows\Fonts\StaticCache.dat" "eis_nt64.exe" touched file "C:\Users\9sUw2BO\AppData\Local\Microsoft\Windows\Caches" "eis_nt64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\cversions.1.db" "eis_nt64.exe" touched file "C:\Users\%OSUSER%\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" "eis_nt64.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches" "eis_nt64.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\cversions.1.db" "eis_nt64.exe" touched file "%LOCALAPPDATA%\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db" "eis_nt64.exe" touched file "C:\Windows\System32\rsaenh.dll" "eis_nt64.exe" touched file "C:\Windows\System32\oleaccrc.dll" "BootHelper.exe" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls"26:T541,"eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\.erm\epi-base.zip" with delete access "eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\.erm" with delete access "eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\BootHelper.exe" with delete access "eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eguiActivation.dll" with delete access "eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eguiActivationLang.dll" with delete access "eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eis_nt64.exe" with delete access "eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\plgInstaller.dll" with delete access "eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\sciter-x.dll" with delete access "eis_nt64.exe" opened "C:\Users\9sUw2BO\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}" with delete access27:T547,UnhandledExceptionFilter GetTempPathW CopyFileW GetModuleFileNameW LoadLibraryExA LoadLibraryExW TerminateProcess LoadLibraryW GetVersionExW GetTickCount VirtualProtect GetFileSize GetStartupInfoW CreateDirectoryW DeleteFileW WriteFile FindNextFileW FindFirstFileW FindFirstFileExW GetProcAddress LockResource GetCommandLineW GetCommandLineA MapViewOfFile GetModuleHandleA GetModuleHandleW FindResourceW CreateProcessW Sleep VirtualAlloc WSAStartup connect closesocket send recv socket GetUserNameA CreateFileMappingA GetFileAttributesW GetTempPathA IsDebuggerPresent GetModuleFileNameA CreateThread ExitThread GetModuleHandleExW GetVersionExA LoadLibraryA GetFileSizeEx GetTempFileNameA GetComputerNameA CreateFileW CreateFileA FindResourceA ShellExecuteExA GetCursorPos GetUpdateRect SetWindowsHookExW GetWindowThreadProcessId HttpSendRequestA InternetCloseHandle InternetReadFile InternetOpenA InternetConnectA InternetQueryOptionA HttpQueryInfoA accept RegDeleteValueW OpenProcessToken RegEnumKeyW RegEnumKeyExW OpenFileMappingW FindResourceExW OutputDebugStringW CreateToolhelp32Snapshot OpenProcess Process32NextW Process32FirstW GetFileAttributesExW GetComputerNameExW ShellExecuteExW ShellExecuteW FindWindowExW RegDeleteKeyW GetThreadContext GetTempFileNameW28:T73a,"eis_nt64.exe" wrote bytes "3012ccf4fe070000" to virtual address "0xFE081648" (part of module "WININET.DLL") "eis_nt64.exe" wrote bytes "00100000" to virtual address "0xFD4F8468" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "40134efdfe070000" to virtual address "0xFD4FFE48" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "40134efdfe070000" to virtual address "0xFD4FFB48" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "00100000" to virtual address "0xFD4F85A4" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "48b81016ccf4fe070000ffe0" to virtual address "0xFD4E1000" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "48b86013ccf4fe070000ffe0" to virtual address "0xFD4E1340" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "00100000" to virtual address "0xFE191748" (part of module "WS2_32.DLL") "eis_nt64.exe" wrote bytes "48b8e011ccf4fe070000ffe0" to virtual address "0xFE161000" (part of module "WS2_32.DLL") "eis_nt64.exe" wrote bytes "40130000" to virtual address "0xFD4F8538" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "40130000" to virtual address "0xFD4F8478" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "00104efdfe070000" to virtual address "0xFD4FFE18" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "00104efdfe070000" to virtual address "0xFD4FFB18" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "40134efdfe070000" to virtual address "0xFD4FFE10" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "00104efdfe070000" to virtual address "0xFD4FFE50" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "40134efdfe070000" to virtual address "0xFD4FFB10" (part of module "SSPICLI.DLL") "eis_nt64.exe" wrote bytes "00104efdfe070000" to virtual address "0xFD4FFB50" (part of module "SSPICLI.DLL")29:T410,"eis_nt64.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eis_nt64.exe" (Handle: 592) "eis_nt64.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eis_nt64.exe" (Handle: 592) "eis_nt64.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\eis_nt64.exe" (Handle: 592) "eis_nt64.exe" wrote 32 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\BootHelper.exe" (Handle: 244) "eis_nt64.exe" wrote 52 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\BootHelper.exe" (Handle: 244) "eis_nt64.exe" wrote 8 bytes to a remote process "C:\Users\%OSUSER%\AppData\Local\Temp\eset\bts.session\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\BootHelper.exe" (Handle: 244)2a:T400,AAABAAEAICAQAAAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8AAAAADmZmZmZmZmZm4AAAAAAABmZmZmZmZmZmZmZgAAAAAGZmZmZmZmZmZmZmZgAAAAZmZmeI/////4h2ZmZgAABmZmj//////////4ZmZgAGZmb/////////////ZmZgBmZv//////////////ZmYOZmj//////////////4ZmZmZv////+Id3eI/////2ZmZmf///+GZmZmZmf///92ZmZo///4ZmZmZmZmf///hmZmaP//92ZmaIdmZm///4ZmZm////ZmZv//hmZo///2ZmZv///2Zmj///iIj///9mZmb///hmZo//////////ZmZm///4ZmZmZmZmZo///2ZmZv//+GZmZmZmZmaP//9mZmb///hmZmd3dmZmj///ZmZm////ZmaP//hmZv///2ZmZv///2Zmb//2Zmb///9mZmaP//92ZmZ3ZmZn///4ZmZmj///hmZmZmZmb///+GZmZn////hmZmZmZo////dmZmZv/////4iIiI/////2Zm5maP//////////////hmbgZmb//////////////2ZmAGZmb/////////////ZmZgAGZmaP//////////hmZmAAAGZmZniP////+IdmZmYAAAAGZmZmZmZmZmZmZmZgAAAAAGZmZmZmZmZmZmZmAAAAAAAA5mZmZmZmZmZuAAAAD+AAB/+AAAH/AAAA/gAAAHwAAAA4AAAAGAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgAAAAYAAAAHAAAAD4AAAB/AAAA/4AAAf/gAAfw==18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"schema_version":"1.0.15","sha256":"b2a52d4797f1dce5069f476aed9abd7b577d0a79ff935d7971485d9240e38f14","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790553246107,"unified_at":"2026-09-27T23:54:06.107Z","metadata":{"hashes":{"sha256":"b2a52d4797f1dce5069f476aed9abd7b577d0a79ff935d7971485d9240e38f14","sha1":"b7a8fdfedd48d96ffafad136b5afdb02ab8f08f6","md5":"4a3e85d856ea34a1062407ee4cc067b5","sha512":"a42a83e9ee1ef68cbfc650cb6caffefc67926f55598f174fe94b7bf019305ba8b669e558a233a555c356e167261be56d60e3307b04aed66393db903fb6cdef76","ssdeep":"Unknown","imphash":"Unknown"},"file_info":{"file_name":"eis_nt64.exe","file_type":["peexe","64bits","executable"],"file_type_id":"64-bit exe","file_size":59231840,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1596470405000,"last_seen":1662501348000,"last_multi_scan":1662501348000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["infostealer","kidlogger","ldpinch","socelars"]},"stats":{"av":{"malicious_count":0,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":0,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":9},"sandbox_signatures":{"informative_count":16,"suspicious_count":16,"malicious_count":6,"total":38},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"symantec":{"name":"Symantec","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{},"mitre_attacks":[{"tactic":"Command and Control","technique":"Custom Command and Control Protocol","attack_id":"T1094","attack_id_wiki":"https://attack.mitre.org/techniques/T1094","identifiers":[{"type":"suspicious","value":"Contains indicators of bot communication commands"}],"sources":[{"report_type":"sandbox","report_id":"5f2a75ea4b92cf73d03cd063"},{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"malicious","value":"Writes data to a remote process"},{"type":"malicious","value":"Allocates virtual memory in a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1063","attack_id_wiki":"https://attack.mitre.org/techniques/T1063","identifiers":[{"type":"malicious","value":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"informative","value":"Reads the registry for installed applications"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Scanning for window names"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]}],"sandbox_signatures":[{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/68 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5f2a75ea4b92cf73d03cd063"},{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"BootContainer.pdb\"\n \"em000_64.pdb\"\n \"em000k_64.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5f2a75ea4b92cf73d03cd063"},{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"$22","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5f2a75ea4b92cf73d03cd063"},{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least one reputation engine","description":"2/79 reputation engines marked \"http://www.ibsensoftware.com\" as malicious (2% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"5f2a75ea4b92cf73d03cd063"},{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"Heuristic match: \"1.3.6.1.4.1.311.2.1.4\"\n Heuristic match: \"1.3.6.1.4.1.311.10.1\"\n Heuristic match: \"1.3.6.1.4.1.311.2.4.1\"\n Heuristic match: \"1.3.6.1.4.1.311.3.3.1\"\n Heuristic match: \"1.2.840.113549.1.9.16.1.4\"\n Heuristic match: \"1.3.14.3.2.29\"\n Heuristic match: \"1.3.14.3.2.26\"\n Heuristic match: \"2.16.840.1.101.3.4.2.1\"\n Heuristic match: \"2.16.840.1.101.3.4.2.2\"\n Heuristic match: \"2.16.840.1.101.3.4.2.3\"\n Heuristic match: \"2.16.840.1.101.3.4.2.4\"\n \"2.5.29.35\"\n \"2.5.29.19\"\n \"2.5.29.14\"\n \"10.15.29.0\"\n \"13.2.16.0\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5f2a75ea4b92cf73d03cd063"},{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Remote Access Related","name":"Contains indicators of bot communication commands","description":"$23","origin":"File/Memory","mitre_attack_id":"T1094","relevance":10,"id":"string-29","sources":[{"report_type":"sandbox","report_id":"5f2a75ea4b92cf73d03cd063"},{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the registry for installed applications","description":"\"eis_nt64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EIS_NT64.EXE\")\n \"eis_nt64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\APP PATHS\\EIS_NT64.EXE\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-55","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"General","name":"Creates a writable file in a temporary directory","description":"$24","origin":"API Call","relevance":1,"id":"api-4","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\zCSMComm.Server.Id.BTS-Container-Comm.1644\"\n \"zCSMComm.Server.Id.BTS-Container-Comm.1644\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Global\\ESET-Instance-Lock-INSTALLER-01009B47-5B32-017F-B60D-E242EBDF11B2\"\n \"Global\\ESET-Instance-Lock-INSTALLER-01009B47-5B32-017F-B60D-E242EBDF11B2\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"sciter-x.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"plgInstaller.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"eguiActivation.dll\" as clean (type is \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"), Antivirus vendors marked dropped file \"eguiActivationLang.dll\" as clean (type is \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"eis_nt64.exe\" touched \"Computer\" (Path: \"HKCU\\CLSID\\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\\SHELLFOLDER\")\n \"eis_nt64.exe\" touched \"Memory Mapped Cache Mgr\" (Path: \"HKCU\\CLSID\\{1F486A52-3CB1-48FD-8F50-B8DC300D9F9D}\")\n \"eis_nt64.exe\" touched \"Security Manager\" (Path: \"HKCU\\CLSID\\{7B8A2D94-0AC9-11D1-896C-00C04FB6BFC4}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"General","name":"Scanning for window names","description":"\"eis_nt64.exe\" searching for class \"_EsetBootstrapperWnd\"","origin":"API Call","mitre_attack_id":"T1010","relevance":10,"id":"api-70","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"eis_nt64.exe\" with commandline \"--bts-container 1644 \"C:\\eis_nt64.exe\"\" (UID: 00079731-00003176)\n Spawned process \"BootHelper.exe\" with commandline \"--watchdog 3176 --product \"ESET Internet Security\" 13.2.16.0 103 ...\" (UID: 00079912-00001712)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"eis_nt64.exe\" with commandline \"--bts-container 1644 \"C:\\eis_nt64.exe\"\" (UID: 00079731-00003176)\n Spawned process \"BootHelper.exe\" with commandline \"--watchdog 3176 --product \"ESET Internet Security\" 13.2.16.0 103 ...\" (UID: 00079912-00001712)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"eis_nt64.exe\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"Installation/Persistance","name":"Dropped files","description":"\"eis_nt64.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"sciter-x.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"plgInstaller.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"eguiActivation.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"eguiActivationLang.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"BootHelper.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"bootstrapper_20200803160157.log\" has type \"ASCII text with CRLF line terminators\"\n \"epi-base.zip\" has type \"Zip archive data at least v2.0 to extract\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"eis_nt64.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"eguiActivationLang.dll\" was detected as \"Microsoft visual C++ vx.x DLL\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"eis_nt64.exe\" at 00079731-00003176-00000033-116082834","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".rsrc\n .rsrc with unusual entropies 7.80952474273\n 7.75396952352","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"eis_nt64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"eis_nt64.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"General","name":"Reads configuration files","description":"\"eis_nt64.exe\" read file \"%USERPROFILE%\\Desktop\\desktop.ini\"","origin":"API Call","relevance":4,"id":"api-6","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Installation/Persistance","name":"Drops executable files","description":"\"eis_nt64.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"sciter-x.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"plgInstaller.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"eguiActivation.dll\" has type \"PE32+ executable (DLL) (GUI) x86-64 for MS Windows\"\n \"eguiActivationLang.dll\" has type \"PE32 executable (DLL) (GUI) Intel 80386 for MS Windows\"\n \"BootHelper.exe\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"System Destruction","name":"Opens file with deletion access rights","description":"$26","origin":"API Call","relevance":7,"id":"api-25","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"eis_nt64.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"eis_nt64.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"eis_nt64.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"sciter-x.dll\" claimed CRC 4156129 while the actual is CRC 1995525\n \"plgInstaller.dll\" claimed CRC 2884152 while the actual is CRC 4156129\n \"eguiActivation.dll\" claimed CRC 1759913 while the actual is CRC 2884152\n \"eguiActivationLang.dll\" claimed CRC 2222634 while the actual is CRC 1759913\n \"BootHelper.exe\" claimed CRC 566520 while the actual is CRC 2222634","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"$27","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$28","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"eis_nt64.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Reads Antivirus engine related registry keys","description":"\"eis_nt64.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\ESET SECURITY\\CURRENTVERSION\\INFO\")\n \"eis_nt64.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\ESET FULL DISK ENCRYPTION\\CURRENTVERSION\\INFO\")\n \"eis_nt64.exe\" (Path: \"HKLM\\SOFTWARE\\ESET\\REMOTEADMINISTRATOR\\AGENT\\CURRENTVERSION\\INFO\")","origin":"Registry Access","mitre_attack_id":"T1063","relevance":8,"id":"registry-32","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"malicious","category":"General","name":"The analysis extracted a file that was identified as malicious","description":"1/92 Antivirus vendors marked dropped file \"eis_nt64.exe\" as malicious (classified as \"Unavailable\" with 1% detection rate)\n 1/90 Antivirus vendors marked dropped file \"BootHelper.exe\" as malicious (classified as \"Unavailable\" with 1% detection rate)","origin":"Binary File","relevance":10,"id":"binary-11","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"malicious","category":"General","name":"The analysis spawned a process that was identified as malicious","description":"1/92 Antivirus vendors marked spawned process \"eis_nt64.exe\" (PID: 3176) as malicious (classified as \"Unavailable\" with 1% detection rate)\n 1/90 Antivirus vendors marked spawned process \"BootHelper.exe\" (PID: 1712) as malicious (classified as \"Unavailable\" with 1% detection rate)","origin":"Monitored Target","relevance":10,"id":"target-58","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Allocates virtual memory in a remote process","description":"\"eis_nt64.exe\" allocated memory in \"%WINDIR%\\System32\\oleacc.dll\"","origin":"API Call","mitre_attack_id":"T1055","relevance":7,"id":"api-20","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"malicious","category":"Installation/Persistance","name":"Writes data to a remote process","description":"$29","origin":"API Call","mitre_attack_id":"T1055","relevance":6,"id":"api-0","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"eis_nt64.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]}],"incidents":[{"name":"Persistence","details_count":1,"details":[{"detail":"Writes data to a remote process"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"Fingerprint","details_count":4,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"Reads Antivirus engine related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"Spreading","details_count":1,"details":[{"detail":"Opens the MountPointManager (often used to detect additional infection locations)"}],"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]}]},"activity":{"stats":{"process_count":3,"spawned_processes_count":3,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":8,"imported_dlls_count":75,"dropped_files_count":0,"extracted_files_count":8,"files_written_count":19,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["infostealer","kidlogger","ldpinch","socelars"],"sample_flags":["Launch Failed","Multi-Process","Extracted Files"],"sandbox_reports":[{"id":"5f2a75ea4b92cf73d03cd063","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"undetected","submit_name":"eis_nt64.exe","analysis_start_time":"2020-08-05T09:03:52+00:00","indicators_count":{"informative":3,"suspicious":3,"malicious":0},"tags":["Launch Failed"],"is_in_unified_schema":true},{"id":"5f2834836023e667eb09e13a","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"submit_name":"eis_nt64.exe","analysis_start_time":"2020-08-03T16:00:23+00:00","indicators_count":{"informative":16,"suspicious":22,"malicious":7},"tags":["Multi-Process","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}],"processes":[{"pid":1644,"ppid":0,"name":"eis_nt64.exe","command_line":"","sha256":"b2a52d4797f1dce5069f476aed9abd7b577d0a79ff935d7971485d9240e38f14","normalized_path":"C:\\eis_nt64.exe","uid":"00079618-00001644","icon":"$2a"},{"pid":3176,"ppid":1644,"name":"eis_nt64.exe","command_line":"--bts-container 1644 \"C:\\eis_nt64.exe\"","sha256":"d270cb0dd46c76f6ebdedaad91f79432fc487dff5abb34d1af993fdb7231414a","normalized_path":"%TEMP%\\eset\\bts.session\\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\\eis_nt64.exe","parent_uid":"00079618-00001644","uid":"00079731-00003176"},{"pid":1712,"ppid":3176,"name":"BootHelper.exe","command_line":"--watchdog 3176 --product \"ESET Internet Security\" 13.2.16.0 1033","sha256":"266fb6d85586435811979d33b23af2a04b24708c0a240edb417f62d98ca2364f","normalized_path":"%TEMP%\\eset\\bts.session\\{02D83BBE-D2FA-E67A-10C7-01CD35297AFF}\\BootHelper.exe","parent_uid":"00079731-00003176","uid":"00079912-00001712"}],"all_imported_dlls":["api-ms-win-downlevel-version-l1-1-0.dll","imm32.dll","oleacc.dll","urlmon.dll","VxSSL64.dll","cfgmgr32.dll","sciter-x.dll","wintrust.dll","comdlg32.dll","msvcrt.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","secur32.dll","WindowsCodecs.dll","user32.dll","advapi32.dll","Wldap32.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msctf.dll","ntmarta.dll","apphelp.dll","crypt32.dll","dwmapi.dll","ntdll.dll","KernelBase.dll","oleaccrc.dll","rpcss.dll","api-ms-win-downlevel-user32-l1-1-0.dll","gdi32.dll","GdiPlus.dll","ole32.dll","version.dll","webio.dll","msi.dll","lpk.dll","usp10.dll","iertutil.dll","userenv.dll","sechost.dll","rpcrt4.dll","shlwapi.dll","comctl32.dll","cryptbase.dll","propsys.dll","nsi.dll","ncrypt.dll","winmm.dll","plgInstaller.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","kernel32.dll","setupapi.dll","dbghelp.dll","clbcatq.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","devobj.dll","uxtheme.dll","winhttp.dll","msasn1.dll","rsaenh.dll","normaliz.dll","wininet.dll","sspicli.dll","shell32.dll","api-ms-win-core-synch-l1-2-0.dll","cabinet.dll","profapi.dll","imagehlp.dll","dhcpcsvc.dll","oleaut32.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","bcrypt.dll","IPHLPAPI.DLL","winnsi.dll","ws2_32.dll","cryptsp.dll","bcryptprimitives.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"BootHelper.exe","sha256":"266fb6d85586435811979d33b23af2a04b24708c0a240edb417f62d98ca2364f","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"eis_nt64.exe","sha256":"d270cb0dd46c76f6ebdedaad91f79432fc487dff5abb34d1af993fdb7231414a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"eguiActivation.dll","sha256":"27714507ef761ec2a88455930661d331e5646ae2cbf06d52577b34757353c36c","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"eguiActivationLang.dll","sha256":"3dabcf010e11071d34f5c2ad9af5f0d775cedcb6311f215959c522b860ff3402","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"plgInstaller.dll","sha256":"7dd6bbafd615f311546ff4631a5d7108b2f0db83fe5502fba3a4663584ca9dc1","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"sciter-x.dll","sha256":"9762140e4836eb66d1332fe50ba70dcceaaccff3ce11346fe3887d590dee0143","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"epi-base.zip","sha256":"631949d36687f530686b76ecbb08d9a25a616a86f264080907c9aebb459c5dd5","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"bootstrapper_20200803160157.log","sha256":"6946a6c507f970c0e667b778e04d0bedeb7faf917c366f1cc5393dcff37d6638","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]}],"files_written":[{"path":"%TEMP%\\eset\\bts.session","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"C:\\Users\\9sUw2BO","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%TEMP%\\eset","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%TEMP%\\eset\\bts","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%TEMP%\\eset\\bts\\bootstrapper_20200803160157.log","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"C:\\eis_nt64.exe","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%TEMP%\\eset\\bts.cache","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%WINDIR%\\AppPatch\\AppPatch64\\sysmain.sdb","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\cversions.1.db","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Caches\\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x000000000000001b.db","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"path":"C:\\share","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\zCSMComm.Server.Id.BTS-Container-Comm.1644","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"zCSMComm.Server.Id.BTS-Container-Comm.1644","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Global\\ESET-Instance-Lock-INSTALLER-01009B47-5B32-017F-B60D-E242EBDF11B2","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]},{"name":"Global\\ESET-Instance-Lock-INSTALLER-01009B47-5B32-017F-B60D-E242EBDF11B2","sources":[{"report_type":"sandbox","report_id":"5f2834836023e667eb09e13a"}]}]}},"report_ids":{"sandbox_job_ids":["5f2834836023e667eb09e13a","5f2a75ea4b92cf73d03cd063"]}}}]]}] 1b:null 1f:[["$","title","0",{"children":"Malicious Sample b2a52d4797f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b2a52d4797f1…. Threat score 100/100. 0/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b2a52d4797f1dce5069f476aed9abd7b577d0a79ff935d7971485d9240e38f14"}],["$","meta","4",{"property":"og:title","content":"Malicious Sample b2a52d4797f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b2a52d4797f1…. Threat score 100/100. 0/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b2a52d4797f1dce5069f476aed9abd7b577d0a79ff935d7971485d9240e38f14"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Sample b2a52d4797f1… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b2a52d4797f1…. Threat score 100/100. 0/27 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2b","11",{}]]