24:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/3fc9w1ah_nm2g.js"],"SampleDetailWrapper"] 4c:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/1f7k-b47qno-6.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4d8,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan[Backdoor]/MSIL.Bladabindi Sample c0b0ead029f8… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c0b0ead029f8…. Malware family: Trojan[Backdoor]/MSIL.Bladabindi. Threat score 100/100. 19/27 AV engines flagged this file. 5 malicious and 12 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20","keywords":["Malicious","Trojan[Backdoor]/MSIL.Bladabindi","malware analysis","sandbox report","threat intelligence","c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20"],"about":{"@type":"SoftwareApplication","name":"Server.exe","applicationCategory":["peexe","assembly","executable"],"identifier":"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan[Backdoor]/MSIL.Bladabindi","antivirusDetections":{"malicious":19,"total":27},"behavioralIndicators":{"malicious":5,"suspicious":12},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T406,Observed namespace "System.IO.MemoryStream" and TypeReference ".ctor" in "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Write" in "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "ToArray" in "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "get_Length" in "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "WriteByte" in "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "set_Position" in "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin" Observed namespace "System.IO.MemoryStream" and TypeReference "Read" in "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin"26:T481,"" (Indicator: "enumchildwindows"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp")2a:T27ce,"" (Indicator: "GetDC"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "GetDesktopWindow" (Indicator: "GetDesktopWindow"; Source: "00000000-00002052.00000000.133338.00AD0000.00000004.mdmp")41:T1117,Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found reference to API "GetAsyncKeyState" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found reference to API "11393482453,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11393406337,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11393535159,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11392669881,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11393341575,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11393703031,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11389361043,5624,103,,GetAsyncKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11393619911,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11392948433,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11393661347,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11392366929,5624,104,,GetKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11390940615,5624,103,,GetAsyncKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11392816343,5624,103,,GetAsyncKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "11391617303,5624,103,,GetAsyncKeyState,user32.dll,"00:34:40.250",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp") Found reference to API "83494126920,5624,104,,GetKeyState,user32.dll,"00:35:10.296",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "83493736448,5624,104,,GetKeyState,user32.dll,"00:35:10.296",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "83493970448,5624,103,,GetAsyncKeyState,user32.dll,"00:35:10.296",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "83494088880,5624,104,,GetKeyState,user32.dll,"00:35:10.296",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "83493815192,5624,104,,GetKeyState,user32.dll,"00:35:10.296",RX=0,PX=0" (Indicator: "GetKeyState"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "83493007316,5624,103,,GetAsyncKeyState,user32.dll,"00:35:10.296",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found reference to API "83494166348,5624,103,,GetAsyncKeyState,user32.dll,"00:35:10.296",RX=0,PX=0" (Indicator: "GetAsyncKeyState"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp")42:T9e4,"" (Indicator: "RsaCryptoServiceProvider"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp")44:T72d,Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; File: "00000000-00002052.00000000.133338.00E71000.00000020.mdmp") Found reference to API "GetProcessesByName" (Indicator: "GetProcessesByName"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found reference to API "GetProcessById" (Indicator: "GetProcessById"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found reference to API "8053921778,4300,3121,,CreateToolhelp32Snapshot,kernel32.dll,"00:34:42.187",RX=0,PX=0" (Indicator: "CreateToolhelp32Snapshot"; Source: "00000000-00002052.00000000.133338.00AD0000.00000004.mdmp") Found reference to API "GetModuleHandle failed" (Indicator: "GetModuleHandle"; Source: "00000000-00002052.00000000.133338.00E71000.00000020.mdmp") Found reference to API "GetModuleHandleW" (Indicator: "GetModuleHandle"; Source: "00000000-00002052.00000000.133338.00E89000.00000002.mdmp") Found reference to API "GetCurrentProcess" (Indicator: "GetCurrentProcess"; Source: "00000000-00002052.00000000.133338.00E89000.00000002.mdmp") Found reference to API "GetCurrentProcessId" (Indicator: "GetCurrentProcess"; Source: "00000000-00002052.00000000.133338.00E89000.00000002.mdmp")45:Tbc5,Found string "[Back]" (Indicator: "[Back]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[tab]" (Indicator: "[tab]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[shift]" (Indicator: "[shift]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[ctrl]" (Indicator: "[ctrl]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[ctrl]" (Indicator: "[Ctrl]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[alt]" (Indicator: "[alt]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[alt]" (Indicator: "[Alt]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[pause]" (Indicator: "[pause]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[esc]" (Indicator: "[esc]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[end]" (Indicator: "[end]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[home]" (Indicator: "[home]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[left]" (Indicator: "[left]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[right]" (Indicator: "[right]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[down]" (Indicator: "[down]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[insert]" (Indicator: "[insert]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[Delete]" (Indicator: "[Delete]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F1]" (Indicator: "[F1]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F2]" (Indicator: "[F2]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F3]" (Indicator: "[F3]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F4]" (Indicator: "[F4]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F5]" (Indicator: "[F5]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F6]" (Indicator: "[F6]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F7]" (Indicator: "[F7]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F8]" (Indicator: "[F8]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F9]" (Indicator: "[F9]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F10]" (Indicator: "[F10]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "[F11]" (Indicator: "[F11]"; Source: "00000000-00001988.00000001.135059.05690000.00000004.mdmp")46:T843,Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found string "C:\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found string "C:\\WINDOWS\\system32\\drivers\\etc\\hosts" (Indicator: "\drivers\"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "\drivers\"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found string ":\WINDOWS\system32\drivers\etc\hosts" (Indicator: "system32\drivers"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found string "Microsoft Windows 10 Pro|C:\WINDOWS|\Device\Harddisk0\Partition2" (Indicator: "\Device\"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.05690000.00000004.mdmp") Found string "\Device\HarddiskVolume1" (Indicator: "\Device\"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00001988.00000001.135059.031D0000.00000004.mdmp") Found string ":\WINDOWS\system32\DRIVERS" (Indicator: "system32\drivers"; Source: "00000000-00002052.00000000.133338.00AD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\Windows\SysWOW64\netsh.exe" (Indicator: "\Device\"; Source: "00000000-00002052.00000000.133338.00AD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2" (Indicator: "\Device\"; Source: "00000000-00002052.00000000.133338.00AD0000.00000004.mdmp") Found string "\Device\HarddiskVolume2\c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin.exe" (Indicator: "\Device\"; Source: "00000000-00002052.00000000.133338.00AD0000.00000004.mdmp")47:T442,Found reference to API "_SystemParametersInfo" (Indicator: "SystemParametersInfo"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found reference to API "SystemParametersInfo" (Indicator: "SystemParametersInfo"; File: "c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin") Found reference to API "_SystemParametersInfo" (Indicator: "SystemParametersInfo"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found reference to API "SystemParametersInfoA" (Indicator: "SystemParametersInfo"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found reference to API "SystemParametersInfo" (Indicator: "SystemParametersInfo"; Source: "00000000-00001988.00000000.133138.00B82000.00000002.mdmp") Found reference to API "SystemParametersInfoW" (Indicator: "SystemParametersInfo"; Source: "00000000-00002052.00000000.133338.00AD0000.00000004.mdmp")48:Ta1d,"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found reference to \"MD5CryptoServiceProvider\" (Indicator: \"MD5CryptoServiceProvider\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet code contains potential unpacker","description":"Observed function \"System.Reflection.Load\" in \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"","origin":"Static Parser","mitre_attack_id":"T1620","relevance":1,"id":"static-115","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Found virtual disk drive like strings","description":"Found string - winmgmts:\\\\.\\root\\SecurityCenter2; Source: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found string - inmgmts:\\\\.\\root\\SecurityCenter2; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string - \\\\.\\root\\cimv2; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564","relevance":1,"id":"string-145","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Observed a high volume of repeated registry API calls (API Hammering)","description":"$26","origin":"Registry Access","mitre_attack_id":"T1497","relevance":7,"id":"registry-215","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"$27","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to block user input (API string)","description":"Found reference to API \"BlockInput_\" (Indicator: \"BlockInput\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found reference to API \"BlockInput_1\" (Indicator: \"BlockInput\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found reference to API \"BlockInput_\" (Indicator: \"BlockInput\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found reference to API \"BlockInput_1\" (Indicator: \"BlockInput\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found reference to API \"BlockInput\" (Indicator: \"BlockInput\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1562.001","relevance":1,"id":"string-547","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00002052-34756-15-00E79AC0\n SetUnhandledExceptionFilter@KERNELBASE.DLL at 00000000-00002052-34756-18-00E79870","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to access crypto-related API (String)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-920","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to decode string content at runtime (.NET)","description":"Observed function \"ToBase64String\" in \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"\n Observed function \"FromBase64String\" in \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"","origin":"Static Parser","mitre_attack_id":"T1140","relevance":5,"id":"static-106","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to import cryptographic keys (seen in ransomware)","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-603","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Able to use Microsoft's Enhanced Cryptographic Provider","description":"Found api reference \"CryptImportKey\" (Indicator: \"CryptImportKey\"; Source: \"00000000-00001988.00000000.133138.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.031D0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-602","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$28","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to decode base64 data","description":"Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found reference to API \"FromBase64String\" (Indicator: \"FromBase64String\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1140","relevance":1,"id":"string-106","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform crypto operations","description":"Observed namespace \"System.Security.Cryptography\" in [Source: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"]","origin":"Static Parser","mitre_attack_id":"T1027","relevance":1,"id":"static-118","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains ability to perform encryption (API string)","description":"file/memory contains long string with (Indicator: \"CryptProtectData\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found reference to API \"Uses CryptProtectData and CryptUnProtectData Windows APIs to encrypt and decrypt\" (Indicator: \"CryptProtectData\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-108","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains CRYPTO related strings\n Matched sigs: Contains ability to decode base64 data\n Matched sigs: Contains ability to use Cryptographic classes\n Matched sigs: Able to import cryptographic keys (seen in ransomware)\n Matched sigs: Able to use Microsoft's Enhanced Cryptographic Provider\n Matched sigs: Contains ability to perform encryption (API string)\n Matched sigs: Able to access crypto-related API (String)\n Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Able to decode string content at runtime (.NET)\n Matched sigs: Contains ability to perform crypto operations\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"Found XOR loop in file \"sample.bin\" at offset 2844; code bytes = 8030","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to enumerate system processes using native API","description":"Found reference to API \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002052-00000C2C-1083644336\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-907","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system file/directory information (.NET)","description":"Observed dotnet function \"GetDirectories\" in \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"\n Observed dotnet function \"GetFiles\" in \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"\n Observed dotnet function \"GetLogicalDrives\" in \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":3,"id":"static-200","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to gather system information (.NET)","description":"Found string \"IOSVersion\" (Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string \"GetDrives\" (Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string \"get_MachineName\" (Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string \"get_UserName\" (Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string \"GetLogicalDrives\" (Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp, 00000000-00001988.00000000.133138.031D0000.00000004.mdmp\")\n Found string \"get_OSVersion\" (Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string \"etUserNameA\" (Source: \"00000000-00001988.00000001.135059.031D0000.00000004.mdmp\")\n Found string \"UserName\" (Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found string \"CredUIParseUserNameW\" (Source: \"00000000-00002052.00000000.133338.00E71000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-937","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using API string","description":"Found string \"NtQuerySystemInformation\" (Indicator: \"NtQuerySystemInformation\"; Source: \"00000000-00002052-00000C2C-1083644336\")","origin":"File/Memory","mitre_attack_id":"T1497.001","relevance":1,"id":"string-659","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment using user register activity","description":"Found string \"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found string \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found string \"KEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"software\\microsoft\\windows\\currentversion\\uninstall\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-663","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to obtain MAC address in .NET file","description":"Observed retrieval of MAC address \"System.Net.NetworkInformation.GetPhysicalAddress\" in \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"","origin":"Static Parser","mitre_attack_id":"T1082","relevance":1,"id":"static-216","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query security token membership for user discovery (API string)","description":"Found reference to API \"AllocateAndInitializeSid\" (Indicator: \"AllocateAndInitializeSid\"; Source: \"00000000-00001988-00000C2C-1079740718\")\n Found reference to API \"FreeSid\" (Indicator: \"FreeSid\"; Source: \"00000000-00001988-00000C2C-1079741203\")\n Found reference to API \"CheckTokenMembership\" (Indicator: \"CheckTokenMembership\"; Source: \"00000000-00002052.00000000.133338.00E89000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-908","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query system locale information (API string)","description":"Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001988.00000001.135059.031D0000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001988.00000001.135059.031D0000.00000004.mdmp\")\n Found reference to API \"Win32API|National Language Support Functions|GetLocaleInfo|LOCALE_ILANGUAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001988.00000001.135059.031D0000.00000004.mdmp\")\n Found reference to API \"ional Language Support Functions|GetLocaleInfo|LOCALE_IDEFAULTANSICODEPAGE\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001988.00000001.135059.07FF0000.00000004.mdmp\")\n Found reference to API \"l Language Support Functions|GetLocaleInfo|LOCALE_ICOUNTRY\" (Indicator: \"GetLocaleInfo\"; Source: \"00000000-00001988.00000001.135059.07FF0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1614","relevance":1,"id":"string-201","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve geographical location information","description":"Found reference to API \"getaddrinfo\" (Indicator: \"getaddrinfo\"; Source: \"00000000-00001988-00000C2C-1087013057\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-739","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetMonitorInfoW\" in \"00000000-00002052.00000000.133338.00AD0000.00000004.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationW\" in \"00000000-00002052.00000000.133338.00AD0000.00000004.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found string \"System.Data.SqlClient\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found string \"System.Data.Odbc\" (Indicator: \"System.Data.Odbc\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegOpenKeyExW\" in \"00000000-00002052.00000000.133338.00E89000.00000002.mdmp\"\n Found registry query API: \"RegQueryInfoKeyW\" in \"00000000-00002052.00000000.133338.00E89000.00000002.mdmp\"\n Found registry query API: \"RegEnumValueW\" in \"00000000-00002052.00000000.133338.00E89000.00000002.mdmp\"\n Found registry query API: \"RegGetValueW\" in \"00000000-00002052.00000000.133338.00E89000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve information about pressed keystrokes (API string)","description":"$41","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-88","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve running process details (.NET)","description":"Found string \"GetProcessById\" (Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string \"get_ProcessName\" (Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-931","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00002052.00000000.133338.00AD0000.00000004.mdmp\")\n Found reference to API \"GetUserObjectInformationW\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00002052.00000000.133338.00AD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$42","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"\" (Indicator: \"password\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found string \"passwordFormat\" (Indicator: \"password\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found string \"passwordAttemptWindow\" (Indicator: \"password\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found string \"passwordStrengthRegularExpression\" (Indicator: \"password\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n file/memory contains long string with (Indicator: \"password\"; Source: \"00000000-00001988.00000001.135059.05690000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1555","relevance":1,"id":"string-475","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found registry key string for installed applications","description":"\"HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\n \"OFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001988.00000000.133138.00B82000.00000002.mdmp\n \"KEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001988.00000000.133138.00B82000.00000002.mdmp\n \"oftware\\Microsoft\\Windows\\CurrentVersion\\Uninstall\" (Indicator: \"microsoft\\windows\\currentversion\\uninstall\") in Source: 00000000-00001988.00000000.133138.00B82000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-96","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found strings related to keylogger","description":"$45","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-556","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Found system command-related strings","description":"Found string \"cmd.exe /c ping 0 -n 2 & del \\\"\" (Indicator: \"ping\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\"), Found string \"md.exe /c ping 0 -n 2 & del \"\" (Indicator: \"ping\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string \"Ping\" (Indicator: \"ping\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":7,"id":"string-126","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"References to WMI query strings used for information discovery","description":"Found string \"Select * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; File: \"c0b0ead029f81f3f5b58d387532be823208dec7eb894bddf9d215a5bdb375c20.bin\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; File: \"00000000-00002052.00000000.133338.00E71000.00000020.mdmp\")\n Found string \"elect * From AntiVirusProduct\" (Indicator: \"antivirusproduct\"; Source: \"00000000-00001988.00000000.133138.00B82000.00000002.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00001988.00000001.135059.031D0000.00000004.mdmp, 00000000-00001988.00000001.135059.05690000.00000004.mdmp\")\n Found string \"select * from Win32_OperatingSystem\" (Indicator: \" Win32_OperatingSystem\"; Source: \"00000000-00002052.00000000.133338.00E71000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-507","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"System Security","name":"Able to delete registry key/value (API string)","description":"Found registry deletion API: \"RegDeleteValueW\" in \"00000000-00002052.00000000.133338.00E89000.00000002.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1112","relevance":1,"id":"string-230","sources":[{"report_type":"sandbox","report_id":"69ef99631f903469dd0e7389"}]},{"level":"informative","category":"System Security","name":"Calls an API typically used to enable or disable privileges in the specified access token","description":"\"