24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 32:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T499,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Bulz.Generic Sample c599f3ca3417… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c599f3ca3417…. Malware family: Bulz.Generic. Threat score 100/100. 20/27 AV engines flagged this file. 4 malicious and 9 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c599f3ca3417169e4a620b8231f8a97ccc63e291b9e09c888e6807dd90f1f17c","keywords":["Malicious","Bulz.Generic","malware analysis","sandbox report","threat intelligence","c599f3ca3417169e4a620b8231f8a97ccc63e291b9e09c888e6807dd90f1f17c"],"about":{"@type":"SoftwareApplication","name":"MoneroNorthKoreaPyongynag.bin","applicationCategory":["peexe","assembly","executable"],"identifier":"c599f3ca3417169e4a620b8231f8a97ccc63e291b9e09c888e6807dd90f1f17c","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Bulz.Generic","antivirusDetections":{"malicious":20,"total":27},"behavioralIndicators":{"malicious":4,"suspicious":9},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T6c3,"" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.0.3705\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v1.1.4322\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorwks.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\clr.dll" "" touched file "C:\Windows\Microsoft.NET\Framework\v4.0.30319\Config\machine.config" "" touched file "C:\Windows\Globalization\Sorting\SortDefault.nls" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\51e2934144ba15628ba5a31be2dae7dc\mscorlib.ni.dll.aux" "" touched file "C:\Windows\Microsoft.NET\assembly\GAC_32\mscorlib\v4.0_4.0.0.0__b77a5c561934e089\mscorlib.dll" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\d1265d6159ea876f9d63ea4c1361b587\mscorlib.ni.dll.aux" "" touched file "C:\Windows\assembly\pubpol47.dat" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.V9921e851#\b8de0f79bc74f6c423e1c719ee7afefd\Microsoft.VisualBasic.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System\250e8e6af918e7ca66787117bc8633e3\System.ni.dll.aux" "" touched file "C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\75790ba48ebfa82fae7da9a114bc9886\System.Core.ni.dll.aux"26:T80c,"MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDEE26DD" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDEE2560" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDEE286A" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "9c5a5edb10e90000" to virtual address "0xEE5F69B8" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDEE2523" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "65488b0425d0140000" to virtual address "0xEDEE2B7B" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "65488b0425c8140000" to virtual address "0xEDEE2AE3" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "65488b0425d0140000" to virtual address "0xEDEE2BBB" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDEE2693" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "65488b0425d0140000" to virtual address "0xEDEE2C2B" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDEE263E" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDEE25DB" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "654c8b1c25c8140000" to virtual address "0xEDEE296C" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "65488b0425c8140000" to virtual address "0xEDEE2B00" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "65488b0425c8140000" to virtual address "0xEDEE2B20" (part of module "CLR.DLL") "MoneroNorthKoreaPyongynag.bin.exe" wrote bytes "65488b0425d0140000" to virtual address "0xEDEE2BEB" (part of module "CLR.DLL")27:T775,"\" queries volume information of \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 00015021-00003388-0000010C-42258250\n \"\" queries volume information of \"C:\\c599f3ca3417169e4a620b8231f8a97ccc63e291b9e09c888e6807dd90f1f17c.exe\" at 00015021-00003388-0000010C-42262987","origin":"API Call","relevance":2,"id":"api-11","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"External Systems","name":"Sample was identified as clean by Antivirus engines","description":"0/67 Antivirus vendors marked sample as malicious (0% detection rate)","origin":"External System","relevance":10,"id":"avtest-1","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"}]},{"level":"informative","category":"General","name":"Contains PDB pathways","description":"\"%USERPROFILE%\\documents\\visual studio 2017\\Projects\\ConsoleApp5\\ConsoleApp5\\obj\\Release\\ConsoleApp5.pdb\"","origin":"File/Memory","relevance":1,"id":"string-7","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"General","name":"Loads the .NET runtime environment","description":"\"\" loaded module \"%WINDIR%\\Microsoft.NET\\assembly\\GAC_32\\mscorlib\\v4.0_4.0.0.0__b77a5c561934e089\\mscorlib.dll\" at 668E0000\n \"\" loaded module \"%WINDIR%\\assembly\\NativeImages_v4.0.30319_32\\mscorlib\\d1265d6159ea876f9d63ea4c1361b587\\mscorlib.ni.dll\" at 653F0000","origin":"Loaded Module","id":"module-3","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"Installation/Persistance","name":"Connects to LPC ports","description":"\"\" connecting to \"\\ThemeApiPort\"","origin":"API Call","relevance":1,"id":"api-16","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"}]},{"level":"informative","category":"Installation/Persistance","name":"Touches files in the Windows directory","description":"$25","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Heuristic match: \"ConsoleApp5.My\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"c599f3ca3417169e4a620b8231f8a97ccc63e291b9e09c888e6807dd90f1f17c.exe.bin\" was detected as \"Microsoft visual C# v7.0 / Basic .NET\"","origin":"Static Parser","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Creates guarded memory regions (anti-debugging trick to avoid memory dumping)","description":"\"\" is allocating memory with PAGE_GUARD access rights","origin":"API Call","relevance":10,"id":"api-1","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\"\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LOCALE\"; Key: \"00000409\")","origin":"Registry Access","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"5a5390db7ca3e139b97e8958"},{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"95.101.72.68:80\"\n \"93.184.221.240:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"}]},{"level":"suspicious","category":"Anti-Detection/Stealthyness","name":"Queries kernel debugger information","description":"\"MoneroNorthKoreaPyongynag.bin.exe\" at 00009490-00003368-00000033-18455624057","origin":"API Call","relevance":6,"id":"api-10","sources":[{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"MoneroNorthKoreaPyongynag.bin.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 95.101.72.68 on port 80 is sent without HTTP header\n TCP traffic to 93.184.221.240 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"$26","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"47/69 Antivirus vendors marked sample as malicious (68% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"47/69 Antivirus vendors marked sample as malicious (68% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5bef0b8b7ca3e108e026a6cc"},{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to use Cryptographic classes","description":"Found reference to \"HashAlgorithm\" (Indicator: \"HashAlgorithm\"; Source: \"00000000-00007780-00000BC0-1899692152\")","origin":"File/Memory","mitre_attack_id":"T1027","relevance":2,"id":"string-138","sources":[{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Dotnet file contains function to dynamically call methods at runtime","description":"Observed namespace \"Microsoft.VisualBasic.CompilerServices\" and MemberReference \"LateCall\" in \"MoneroNorthKoreaPyongynag.bin\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":1,"id":"static-135","sources":[{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"\"","origin":"File/Memory","mitre_attack_id":"T1071","id":"string-14","sources":[{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"Remote Access Related","name":"Able to modify Remote Configuration","description":"Found string \":\\WINDOWS\\Microsoft.Net\\assembly\\GAC_MSIL\\System.Runtime.Remoting\\v4.0_4.0.0.0__b77a5c561934e089\\System.Runtime.Remoting.dll\" (Source: \"00000000-00007780.00000000.185420.03350000.00000004.mdmp, 00000000-00007780.00000001.185662.03350000.00000004.mdmp\")\n Found string \"System.Runtime.Remoting, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089\" (Source: \"00000000-00007780.00000000.185420.03350000.00000004.mdmp, 00000000-00007780.00000001.185662.03350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1021","relevance":1,"id":"string-940","sources":[{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to perform SQL operations","description":"Found string \"\" (Indicator: \"System.Data.SqlClient\"; Source: \"00000000-00007780.00000000.185420.03350000.00000004.mdmp, 00000000-00007780.00000001.185662.03350000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1213","relevance":3,"id":"string-836","sources":[{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$31","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"6918a5287a2bc61587003568"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"