26:I[7638,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js","/_next/static/chunks/1w1axrg6kzses.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/1kn_tf3p-ubex.js","/_next/static/chunks/1wq095nwqbaw1.js"],"SampleDetailWrapper"] 69:I[27201,["/_next/static/chunks/3q3zujqgvmbhp.js","/_next/static/chunks/1sl4dwu7ouhir.js","/_next/static/chunks/3eaw1sz4hhkwg.js","/_next/static/chunks/0poobxhsa58tt.js","/_next/static/chunks/3utyn4akhmarc.js"],"IconMark"] 25:T4c3,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Malware/Malware Sample c5bfd0abb2e4… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample c5bfd0abb2e4…. Malware family: Malware/Malware. Threat score 100/100. 3/27 AV engines flagged this file. 12 malicious and 20 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3","keywords":["Malicious","Malware/Malware","malware analysis","sandbox report","threat intelligence","c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3"],"about":{"@type":"SoftwareApplication","name":"c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin","applicationCategory":["peexe","executable"],"identifier":"c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Malware/Malware","antivirusDetections":{"malicious":3,"total":27},"behavioralIndicators":{"malicious":12,"suspicious":20},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}27:T4ca,Found reference to API "OpenThreadToken" (Indicator: "OpenThread"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "GetThreadContext" (Indicator: "GetThreadContext"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "ResumeThread" (Indicator: "ResumeThread"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "SetThreadContext" (Indicator: "SetThreadContext"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "SuspendThread" (Indicator: "SuspendThread"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp")28:T1089,Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "MsgWaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "WaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjects"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "MsgWaitForMultipleObjectsEx" (Indicator: "WaitForMultipleObjectsEx"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "SetTimer" (Indicator: "SetTimer"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.00155000.00000002.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObject"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.00155000.00000002.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "WaitForSingleObjectEx" (Indicator: "WaitForSingleObjectEx"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.00155000.00000002.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "GetSystemTimeAsFileTime" (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.00155000.00000002.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "QueryPerformanceCounter" (Indicator: "QueryPerformanceCounter"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.00155000.00000002.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "QueryPerformanceFrequency" (Indicator: "QueryPerformanceFrequency"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "WaitForMultipleObjects" (Indicator: "WaitForMultipleObjects"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "GetTickCount64" (Indicator: "GetTickCount64"; Source: "00000000-00004464.00000000.235208.72581000.00000040.mdmp")29:T626,Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "LoadLibraryExW" (Indicator: "LoadLibrary"; File: "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00003064.00000000.232038.02720000.00000004.mdmp, 00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.726EB000.00000004.mdmp") Found reference to API "FreeLibrary" (Indicator: "FreeLibrary"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "LoadLibraryW" (Indicator: "LoadLibrary"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.00155000.00000002.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to API "LoadLibraryA" (Indicator: "LoadLibrary"; Source: "00000000-00004464.00000000.235208.02FD0000.00000004.mdmp, 00000000-00004464.00000000.235208.72581000.00000040.mdmp")2a:T1a10,Found reference to "SHA512" (Indicator: "SHA512"; Source: "00000000-00003064-00000CC3-2603729620") Found reference to "HMACSHA256" (Indicator: "HMAC"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "HMACSHA256" (Indicator: "HMACSHA256"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "Aes256" (Indicator: "Aes"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "SHA256Managed" (Indicator: "SHA256Managed"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "CryptoStreamMode" (Indicator: "CryptoStream"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "CryptoConfig" (Indicator: "CryptoConfig"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "CryptoStream" (Indicator: "CryptoStream"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "SymmetricAlgorithm" (Indicator: "SymmetricAlgorithm"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "AsymmetricAlgorithm" (Indicator: "AsymmetricAlgorithm"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "HashAlgorithm" (Indicator: "HashAlgorithm"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "CryptographicException" (Indicator: "CryptographicException"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "MD5CryptoServiceProvider" (Indicator: "MD5CryptoServiceProvider"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "RSACryptoServiceProvider" (Indicator: "RSACryptoServiceProvider"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "Aes"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "AesCryptoServiceProvider" (Indicator: "AesCryptoServiceProvider"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "DeriveBytes"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "Rfc2898DeriveBytes" (Indicator: "Rfc2898DeriveBytes"; Source: "00000000-00003064.00000000.232038.027BA000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.04701000.00000004.mdmp, 00000000-00003064.00000001.233958.047B0000.00000020.mdmp, 00000000-00003064.00000001.233958.06F10000.00000004.mdmp") Found reference to "{Aes" (Indicator: "Aes"; Source: "00000000-00003064.00000000.232038.72581000.00000040.mdmp, 00000000-00003064.00000001.233958.72581000.00000040.mdmp") Found reference to "{Aes" (Indicator: "Aes"; Source: "00000000-00004464.00000000.235208.72581000.00000040.mdmp")2b:T698,"library\std\src\panicking.rs" Heuristic match: "()/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\str\pattern.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\cell\once.rs" Heuristic match: "6/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\slice\sort\stable\quicksort.rs" Heuristic match: "[r/rust/deps\gimli-0.32.0\src\read\line.rs" Heuristic match: "/rustc/ded5c06cf21d2b93bffd5d884aa6e96934ee4234\library\core\src\num\wrapping.rs" Heuristic match: "nonesomeaccesserror/rust/deps\object-0.37.3\src\read\coff\symbol.rs" Heuristic match: "library\std\src\env.rs" Heuristic match: "zr/rust/deps\addr2line-0.25.0\src\unit.rs" Heuristic match: "/rust/deps\addr2line-0.25.0\src\function.rs" Heuristic match: "w^.kn" Heuristic match: "-l2.lk" Heuristic match: "i=.uy" Pattern match: "microsoft.net/framework/v4.0.30319/" Heuristic match: "fw.ps"54:T407,Observed import api "WNetCloseEnum" which can "end a network resource enumeration" [Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp] Observed import api "WNetEnumResource" which can "continue an enumeration of network recls.sources" [Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp] Observed import api "WNetGetConnection" which can "retrieve the name of the network resource associated with a local device" [Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp] Observed import api "WNetGetUniversalName" which can "take a drive-based path for a network resource and returns an information structure that contains a more universal form of the name" [Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp] Observed import api "WNetOpenEnum" which can "start an enumeration of network recls.sources or existing connections." [Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp]55:Tda6,"%PROGRAMDATA%\f43ba8be-46d3-49e9-a2cf-890eeaadd407\fondue.exe" (Indicator: "fondue.exe") "%PROGRAMDATA%\f43ba8be-46d3-49e9-a2cf-890eeaadd407\fondue.exe" (Indicator: "fondue.exe") "%PROGRAMDATA%\f43ba8be-46d3-49e9-a2cf-890eeaadd407\fondue.exee" (Indicator: "fondue.exe") "runtimebroker.exe" (Indicator: "runtimebroker.exe") "RuntimeBroker.exe" (Indicator: "runtimebroker.exe") "amData\f43ba8be-46d3-49e9-a2cf-890eeaadd407\fondue.exe" (Indicator: "fondue.exe") "Fondue.EXE" (Indicator: "fondue.exe") "rogramdata\f43ba8be-46d3-49e9-a2cf-890eeaadd407\fondue.exe" (Indicator: "fondue.exe") "C:\Users\HAPUBWS\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\fondue.exe.log" (Indicator: "fondue.exe") ":\ProgramData\f43ba8be-46d3-49e9-a2cf-890eeaadd407\fondue.exe.config" (Indicator: "fondue.exe") "fondue.exe.confi" (Indicator: "fondue.exe") "C:\ProgramData\f43ba8be-46d3-49e9-a2cf-890eeaadd407\fondue.exe -Embedding" (Indicator: "fondue.exe")63:T569,"c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-VS80O.tmp\c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp]- [targetUID: 00000000-00008024] "is-FQF4E.tmp" has type "PE32 executable for MS Windows 4.00 (DLL) Intel i386 (stripped to external PDB) UPX compressed 3 sections"- Location: [%ALLUSERSPROFILE%\f43ba8be-46d3-49e9-a2cf-890eeaadd407\is-FQF4E.tmp]- [targetUID: 00000000-00008124] "is-18US2.tmp" has type "PE32 executable for MS Windows 10.00 (GUI) Intel i386 5 sections"- Location: [%ALLUSERSPROFILE%\f43ba8be-46d3-49e9-a2cf-890eeaadd407\is-18US2.tmp]- [targetUID: 00000000-00008124] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-1AL9U.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00008024] "c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp" has type "PE32 executable for MS Windows 6.01 (GUI) Intel i386 11 sections"- Location: [%TEMP%\is-LJ3AE.tmp\c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp]- [targetUID: 00000000-00008024] "_setup64.tmp" has type "PE32+ executable for MS Windows 5.02 (console) x86-64 5 sections"- Location: [%TEMP%\is-UI780.tmp\_isetup\_setup64.tmp]- [targetUID: 00000000-00008024]64:T6e4,"\" (Indicator: \"GetLastError\"; Source: \"00000000-00004464.00000000.235208.02FD0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"informative","category":"General","name":"Contains ability to show a graphical window (API string)","description":"Found reference to API \"GetWindowThreadProcessId\" (Indicator: \"GetWindowThreadProcessId\"; File: \"c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin\")\n Found reference to API \"ShowWindow\" (Indicator: \"ShowWindow\"; File: \"c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-208","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"informative","category":"General","name":"Contains artifacts from Rust programming language","description":"$3f","origin":"File/Memory","relevance":1,"id":"string-943","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"$40","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileW in import section (Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin.tmp)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"Software\\Embarcadero\\Locales\" in Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin\n \"Software\\CodeGear\\Locales\" in Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin\n \"Software\\Borland\\Locales\" in Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin\n \"Software\\Borland\\Delphi\\Locales\" in Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin\n \"SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\" in Source: c5bfd0abb2e443daf2b319726ee97aadc657aacde9f466228efe908e2193e9b3.bin","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"informative","category":"General","name":"Creates directory on disk","description":"\" Risco Software Inc.\"\n \"is-18US2.tmp\" was detected as \"Visual C++ 2005 Release -> Microsoft\"\n \"_setup64.tmp\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Possibly uses a Windows Server utility","description":"$62","origin":"File/Memory","relevance":10,"id":"string-65","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"\" (Indicator: \"BootTrigger\"; Source: \"00000000-00003064.00000000.232038.02720000.00000004.mdmp, 00000000-00003064.00000001.233958.02720000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1053","relevance":5,"id":"string-32","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Loads the task scheduler COM API","description":"\"fondue.exe\" loaded module \"%WINDIR%\\SysWOW64\\taskschd.dll\" at 73090000","origin":"Loaded Module","mitre_attack_id":"T1559.001","relevance":5,"id":"module-4","sources":[{"report_type":"sandbox","report_id":"69792d303abbefca8202488d"}]},{"level":"malicious","category":"Installation/Persistence","name":"Writes data to a remote process","description":"\"