24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2c:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T487,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Doina.Generic Sample cf90ad8eef1b… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample cf90ad8eef1b…. Malware family: Doina.Generic. Threat score 100/100. 9/24 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","keywords":["Malicious","Doina.Generic","malware analysis","sandbox report","threat intelligence","cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333"],"about":{"@type":"SoftwareApplication","name":"ZillberReleyHost.exe","applicationCategory":["peexe","executable"],"identifier":"cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Doina.Generic","antivirusDetections":{"malicious":9,"total":24},"behavioralIndicators":{"malicious":2,"suspicious":8},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T681e,Found XOR loop in file "ZillberReleyHost.exe" at offset 53560; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 109985; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 111870; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 194893; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 312338; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 490865; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 508934; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 563398; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 622025; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 649724; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 701247; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 712221; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 786303; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 857800; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 918044; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 921992; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 923675; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 923835; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 923844; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1005512; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1005837; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1005935; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1006622; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1006698; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1022017; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1088291; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1088386; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1088399; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1104797; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1368115; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1443967; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1516171; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1517220; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1517233; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1523020; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1525048; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1525155; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1525391; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1525469; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1525811; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1541515; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1541577; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1541588; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1554157; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1605479; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1633767; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1650094; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1650487; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1651646; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1651759; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1651777; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1652925; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1653640; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1653674; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1654050; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1655620; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1655636; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1661522; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1661706; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1662827; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1662864; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1678005; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1898129; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1904390; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 1913837; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2030309; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2033099; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2040390; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2056740; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2079602; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2080082; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2080709; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2081059; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2081464; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2082313; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2082332; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2082411; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2082570; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2085438; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2085470; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2086079; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2086308; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2089192; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2295053; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2304513; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2310737; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2320043; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2356347; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2386655; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2390301; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2415072; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2459933; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2463892; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2478801; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2582581; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2619210; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2664225; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2740857; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2804828; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2887137; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2939360; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2965590; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 2976479; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3076916; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3079555; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3085441; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3155318; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3184547; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3281249; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3365414; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3418395; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3438206; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3463648; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3466166; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3473651; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3597023; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3623612; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3632371; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3660511; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3760757; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3785439; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3803871; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3987936; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 3994335; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4174219; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4267333; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4295124; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4455654; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4487009; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4502446; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4512224; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4598495; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4602555; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4632228; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4751931; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4889003; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4901909; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 4959724; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 5036512; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 5059206; code bytes = 30d0 Found XOR loop in file "ZillberReleyHost.exe" at offset 52312; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 58398; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 84466; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 102274; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 135373; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 151929; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 181114; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 252863; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 270719; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 277019; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 279016; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 279201; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 285816; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 377235; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 417785; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 536322; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 547517; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 554835; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 557907; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 575751; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 575884; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 613286; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 624629; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 685681; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 705865; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 740829; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 752075; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 754639; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 810892; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 847966; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 880023; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 910295; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1022047; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1028017; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1066800; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1101368; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1154742; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1164635; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1172820; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1389967; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1442853; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1566266; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1607448; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1608979; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1617724; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1641509; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1664441; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1695137; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1716989; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1718316; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1722970; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1759003; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1854847; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1869081; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1945738; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1954043; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1957101; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 1966342; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2003859; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2021322; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2099140; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2100593; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2100813; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2289111; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2293851; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2294809; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2304781; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2306275; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2309143; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2324367; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2329031; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2338559; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2350071; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2353731; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2521283; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2642056; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2929347; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 2946483; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3166344; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3237437; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3329857; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3334709; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3368454; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3442859; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3445821; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3661814; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3688669; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3690632; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3894931; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3896759; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3929527; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3960247; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 3968194; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4004985; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4148386; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4214920; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4220652; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4411673; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4432665; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4660434; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4739208; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4858569; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4872595; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 4975974; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 5000578; code bytes = 33c1 Found XOR loop in file "ZillberReleyHost.exe" at offset 657329; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1047233; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1262600; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1710402; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1842025; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1842905; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1860379; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1861872; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1862001; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1900107; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 1965794; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2010766; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2132858; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2295048; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2305882; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2309864; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2310888; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2316282; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2320280; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2337832; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2348598; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2352438; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2361653; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2419296; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2581257; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2603346; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2658810; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2726367; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2732777; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2749052; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2779444; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2828059; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2866585; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2876747; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2905541; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 2943584; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3027423; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3109251; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3126637; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3167235; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3248607; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3336469; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3394015; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3456742; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3467872; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3538481; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3543058; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3670313; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3705738; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3763245; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3765538; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3835678; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3900076; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 3992160; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4023830; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4100425; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4178769; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4248031; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4258196; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4381129; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4445781; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4484395; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4516448; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4527466; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4532703; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4656182; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4723167; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4821202; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 4834380; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 5021044; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 5032581; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 5040736; code bytes = 8030 Found XOR loop in file "ZillberReleyHost.exe" at offset 5055678; code bytes = 803026:T4fe,"ZillberReleyHost.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000c0000009e29547790dacb000000000028000000240000000000ca00d0f3af000000000000000000000000000000000000000000d007b00030000000000000000c0000000000b000000000005c000000000000000000000028d8cb0048b1ca000c00000000000000200000000000b000d001b000d40bb00000000000d00bb00000000000c8f3af0050f5537790dacb0030f4af007cf4af00 (UID: 00000000-00007240) "ZillberReleyHost.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007240)27:T1f2c,Found reference to API (Indicator: "GetSystemTimeAsFileTime"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "Sleep"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "CreateMutexW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "FindFirstFileW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetTempPathW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "CreateThread"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetCurrentProcessId"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "CreateProcessW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "FindClose"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetCurrentProcess"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "CloseHandle"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "ExitProcess"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "OpenProcess"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "WriteProcessMemory"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "WriteFile"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "SetFilePointer"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "FlushInstructionCache"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetLastError"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "FlushFileBuffers"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetModuleFileNameW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetFileSizeEx"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "CreateDirectoryW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "HeapReAlloc"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "UnlockFileEx"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "ReadFile"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetCommandLineW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "MoveFileExW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetStdHandle"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "HeapFree"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "HeapAlloc"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "CreateFileW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "DeleteFileW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetFileAttributesW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "OpenMutexW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetEnvironmentVariableW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "VirtualQuery"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "CopyFileW"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "GetProcessHeap"; File: "ZillberReleyHost.exe") Found reference to API (Indicator: "DeleteFileW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "HeapFree"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetProcessHeap"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "HeapAlloc"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetModuleFileNameW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "HeapReAlloc"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetEnvironmentVariableW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetFileAttributesW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "CreateProcessW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "CreateFileW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "FlushFileBuffers"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "WriteFile"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetFileSizeEx"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "ReadFile"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "FindFirstFileW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetSystemTimeAsFileTime"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "UnlockFileEx"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcessId"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetTempPathW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "MoveFileExW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "CopyFileW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "OpenProcess"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetStdHandle"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "OpenMutexW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "CreateDirectoryW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetCommandLineW"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "SetFilePointer"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "GetCurrentProcess"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "WriteProcessMemory"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp") Found reference to API (Indicator: "FlushInstructionCache"; Source: "00000000-00007240.00000000.157276.01148000.00000002.mdmp")28:T5c3,"ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS\DISABLE8AND16BITMITIGATION"; Key: ""; Value: "")29:Ta9a,"ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "ZILLBERRELEYHOST.EXE"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELL FOLDERS"; Key: "CACHE"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CUSTOMLOCALE"; Key: "EMPTY"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\LANGUAGE"; Key: "INSTALLLANGUAGEFALLBACK"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "TYPE"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\MUI\UILANGUAGES\EN-US"; Key: "ALTERNATECODEPAGE"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP"; Key: "PREFERREDUILANGUAGES"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKCU\CONTROL PANEL\DESKTOP\MUICACHED"; Key: "MACHINEPREFERREDUILANGUAGES"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\SORTING\VERSIONS"; Key: ""; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "ENABLED"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA"; Key: "FIPSALGORITHMPOLICY"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\LSA\FIPSALGORITHMPOLICY"; Key: "MDMENABLED"; Value: "") "ZillberReleyHost.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\OLE"; Key: "PAGEALLOCATORUSESYSTEMHEAP"; Value: "")2a:T553,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007240.00000000.157276.00CA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007240.00000000.157276.00CA0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007240.00000000.157276.00CA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007240.00000000.157276.00CA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007240.00000000.157276.00CA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007240.00000000.157276.00CA0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007240.00000000.157276.00CA0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007240.00000000.157276.00CA0000.00000004.mdmp")2b:T400,AAABAAEAICAQEwAAAADoAgAAFgAAACgAAAAgAAAAQAAAAAEABAAAAAAAgAIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAAACAAAAAgIAAgAAAAIAAgACAgAAAgICAAMDAwAAAAP8AAP8AAAD//wD/AAAA/wD/AP//AAD///8A//////////////////////////////////////////////iIiIiIiIiIiIiIiI////93d3d3d3d3d3d3d3d3////d3df+Hd/h3+H/4d3d////3d3X1f39/f1h3f1d3f///93d19V9/X19ff1d3d3////d3dfV/d/d393j4d3d////3d3X/h3d3d3d3d3d3f///93d3d3d3d3d3d3d3d3////fMzMzMzMzMzMzMzMx////3zMzMzMzMzMzMzMzMf///98zMzMzMzMzMzMzMzH////fMzMzMzMzMzMzMzMx////3zMzI////////zMzMf///98zMzMzMzMzMzMzMzH////fMzMyIiIiIiIjMzMx////3zMzI////////zMzMf///98zMzMzMzMzMzMzMzH////fMzMj////////MzMx////3zMzMzMzMzMzMzMzMf///98zMzIiIjMzMzMzMzH////fMzMj///jMzMzMzMx////3zMzMzMzMzMzMzMzMf///98zMzMzMzMzMx3d3d/////fMzMzMzMzMzMd3d//////3zMzMzMzMzMzHd3//////98zMzMzMzMzMx3f///////fMzMzMzMzMzMd/////////zMzMzMzMzMzI////////////////////////////////////////////////8AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"SUCCESS","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791518512719,"unified_at":"2026-10-09T04:01:52.719Z","metadata":{"hashes":{"sha256":"cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","sha1":"3243fb84a11143e574696e23eb114b4467275c35","md5":"dcd580118706ee497e645311915996b0","sha512":"345cf9cf2db79c684b302d4f5c74881c5597362a82ed3e6be97c61f4a6129a6db04f1c8607709bb6c55ce4a80e4bab09b9ab92746ae8b0a08e848a793dc9abfd","ssdeep":"786432:CguB4HZNU3SCPSqcvJj5xRD5znOQTlfwuUeRADS3:1uSZeCOg/5znlTlfwuLcW","ssdeep_chunks":["786432:CguB4HZ","786432:guB4HZN","786432:uB4HZNU","786432:B4HZNU3","786432:4HZNU3S","786432:HZNU3SC","786432:ZNU3SCP","786432:NU3SCPS","786432:U3SCPSq","786432:3SCPSqc","786432:SCPSqcv","786432:CPSqcvJ","786432:PSqcvJj","786432:SqcvJj5","786432:qcvJj5x","786432:cvJj5xR","786432:vJj5xRD","786432:Jj5xRD5","786432:j5xRD5z","786432:5xRD5zn","786432:xRD5znO","786432:RD5znOQ","786432:D5znOQT","786432:5znOQTl","786432:znOQTlf","786432:nOQTlfw","786432:OQTlfwu","786432:QTlfwuU","786432:TlfwuUe","786432:lfwuUeR","786432:fwuUeRA","786432:wuUeRAD","786432:uUeRADS","786432:UeRADS3","1572864:CguB4HZ","1572864:guB4HZN","1572864:uB4HZNU","1572864:B4HZNU3","1572864:4HZNU3S","1572864:HZNU3SC","1572864:ZNU3SCP","1572864:NU3SCPS","1572864:U3SCPSq","1572864:3SCPSqc","1572864:SCPSqcv","1572864:CPSqcvJ","1572864:PSqcvJj","1572864:SqcvJj5","1572864:qcvJj5x","1572864:cvJj5xR","1572864:vJj5xRD","1572864:Jj5xRD5","1572864:j5xRD5z","1572864:5xRD5zn","1572864:xRD5znO","1572864:RD5znOQ","1572864:D5znOQT","1572864:5znOQTl","1572864:znOQTlf","1572864:nOQTlfw","1572864:OQTlfwu","1572864:QTlfwuU","1572864:TlfwuUe","1572864:lfwuUeR","1572864:fwuUeRA","1572864:wuUeRAD","1572864:uUeRADS","1572864:UeRADS3","786432:1uSZeCO","786432:uSZeCOg","786432:SZeCOg/","786432:ZeCOg/5","786432:eCOg/5z","786432:COg/5zn","786432:Og/5znl","786432:g/5znlT","786432:/5znlTl","786432:5znlTlf","786432:znlTlfw","786432:nlTlfwu","786432:lTlfwuL","786432:TlfwuLc","786432:lfwuLcW"],"imphash":"230a8cb70f5fc6f4574e4c22b6277a01","pehash":"b2fb7aa26176f9217833981562ca773cb62df721"},"file_info":{"file_name":"ZillberReleyHost.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":30413728,"entropy":8,"compile_timestamp":"2026-09-07T15:22:14","is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1791513726000,"last_seen":1791513726000,"last_multi_scan":1791513726000},"pe_metadata":{"is_dll":false,"is_packed":false,"section_count":5,"import_count":0,"export_count":0,"embedded_file_count":2,"sections":[{"name":".text","virtual_address":"0x1000","virtual_size":2124922,"raw_size":2125312},{"name":".rdata","virtual_address":"0x208000","virtual_size":13209,"raw_size":13312},{"name":".data","virtual_address":"0x20c000","virtual_size":119136,"raw_size":117248},{"name":".rsrc","virtual_address":"0x22a000","virtual_size":30944,"raw_size":31232},{"name":".reloc","virtual_address":"0x232000","virtual_size":72328,"raw_size":72704}],"section_names":[".text",".rdata",".data",".rsrc",".reloc"],"imported_dlls":null,"imported_functions":null}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":9,"suspicious_count":0,"total_engines":24},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":37},"sandbox_signatures":{"informative_count":76,"suspicious_count":8,"malicious_count":2,"total":86},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_60.0","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.129789","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_90% (D)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.Doina.129789 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Kryptik_AGen.GTW trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 005690671 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"malicious","threat_name":"Worm.Win32.Koobface.l6aW","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sentinelone":{"name":"SentinelOne","success":true,"verdict":"malicious","threat_name":"high_entropy","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/Agent.NIP.gen!Eldorado","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Doina.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to create/open files (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to create a new process (API string)"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"},{"type":"informative","value":"Able to execute application using Windows wscript shell (JSP)"},{"type":"informative","value":"Able to retrieve command line parameters of the running process"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"},{"type":"informative","value":"Loads modules at runtime"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Able to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"Time Based Checks","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the host's architecture (API string)"},{"type":"informative","value":"Able to discover operating system information (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Reads information about supported languages"},{"type":"informative","value":"Reads the active computer name"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Contains ability to retrieve file and directory information (API string)"},{"type":"informative","value":"Able to rename or move file/directory (API string)"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Tries to access non-existent files (non-executable)"},{"type":"informative","value":"Contains references to file movement (imports API)"},{"type":"informative","value":"Contains ability to read files (API string)"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Reads files"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Able to retrieve/open a process (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"System Checks","attack_id":"T1497.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/001","identifiers":[{"type":"suspicious","value":"Queries process mitigation policy via NtQueryInformationProcess"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"suspicious","value":"Attempts to retrieve the system language code"},{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Triggers a burst of requests to the same API (API Hammering)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Contains ability to move file or directory (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Collection","technique":"Local Data Staging","attack_id":"T1074.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1074/001","identifiers":[{"type":"informative","value":"Contains ability to create directories (API string)"},{"type":"informative","value":"Calls an API typically used to create a directory"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Able to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Collection","technique":"Data from Local System","attack_id":"T1005","attack_id_wiki":"https://attack.mitre.org/techniques/T1005","identifiers":[{"type":"informative","value":"Calls an API typically used to copy file from one location to another"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Command and Control","technique":"Ingress Tool Transfer","attack_id":"T1105","attack_id_wiki":"https://attack.mitre.org/techniques/T1105","identifiers":[{"type":"suspicious","value":"Drops executable files"},{"type":"informative","value":"Contains ability to write files (API string)"},{"type":"informative","value":"Dropped files"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Calls an API used to open a process handle"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Impact","technique":"Data Encrypted for Impact","attack_id":"T1486","attack_id_wiki":"https://attack.mitre.org/techniques/T1486","identifiers":[{"type":"informative","value":"Contains reference to crypto DLLs"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Stealth","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to retrieve file time (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Stealth","technique":"File Deletion","attack_id":"T1070.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/004","identifiers":[{"type":"informative","value":"Contains ability to delete files/directories (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Stealth","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Stealth","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"Loads the Bcrypt module DLL"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Dropped file has high entropy (likely encrypted/compressed content)"},{"type":"suspicious","value":"CRC value set in PE header does not match actual value"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Stealth","technique":"Mutual Exclusion","attack_id":"T1480.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1480/002","identifiers":[{"type":"informative","value":"Creates mutants"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Stealth","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Stealth","technique":"Masquerading","attack_id":"T1036","attack_id_wiki":"https://attack.mitre.org/techniques/T1036","identifiers":[{"type":"malicious","value":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Stealth","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Defense Impairment","technique":"Disable or Modify Tools","attack_id":"T1685","attack_id_wiki":"https://attack.mitre.org/techniques/T1685","identifiers":[{"type":"informative","value":"Modifies process error mode to suppress error dialogs"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"tactic":"Defense Impairment","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Able to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")\n Found reference to API \"WriteProcessMemory\" (Indicator: \"WriteProcessMemory\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")\n Found reference to API \"WaitForSingleObject\" (Indicator: \"WaitForSingleObject\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007240.00000000.157276.00CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Modifies process error mode to suppress error dialogs","description":"\"ZillberReleyHost.exe\" set its error mode to SEM_NOOPENFILEERRORBOX\n \"ZillberReleyHost.exe\" set its error mode to SEM_FAILCRITICALERRORS","origin":"API Call","mitre_attack_id":"T1685","relevance":10,"id":"api-38","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"ZillberReleyHost.exe\" queried SystemProcessInformation at 00000000-00007240-00000C15-1448105578 [PID: 7240]\n \"ZillberReleyHost.exe\" queried SystemProcessInformation at 00000000-00007240-00000C15-1448114192 [PID: 7240]\n \"ZillberReleyHost.exe\" queried SystemProcessInformation at 00000000-00007240-00000C15-1448290937 [PID: 7240]\n \"ZillberReleyHost.exe\" queried SystemProcessInformation at 00000000-00007240-00000C15-1448300280 [PID: 7240]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Triggers a burst of requests to the same API (API Hammering)","description":"\"ZillberReleyHost.exe\" obfuscates its traffic by mimicking legitimate API call","origin":"API Call","mitre_attack_id":"T1497","relevance":5,"id":"api-289","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains reference to crypto DLLs","description":"Found string \":\\WINDOWS\\SYSTEM32\\MSVCP140.dll\" (Indicator: \"\\msvcp140.dll\"; Source: \"00000000-00007240.00000000.157276.00CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1486","relevance":1,"id":"string-493","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for crypto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains reference to crypto DLLs\n Matched sigs: Dropped file has high entropy (likely encrypted/compressed content)","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$25","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ZillberReleyHost.exe\")\n Found string \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007240.00000000.157276.00CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"ZillberReleyHost.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007240)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"ZillberReleyHost.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007240)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$26","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"ZillberReleyHost.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve file time (API string)","description":"Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetSystemTimeAsFileTime\" (Indicator: \"GetSystemTimeAsFileTime\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.006","relevance":1,"id":"string-249","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Environment Awareness","name":"Reads the active computer name","description":"\"ZillberReleyHost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Able to execute application using Windows wscript shell (JSP)","description":"file/memory contains long string with (Indicator: \"ActiveXObject\"; Source: \"00000000-00007240.00000000.157276.00AEA000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":10,"id":"string-461","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Able to rename or move file/directory (API string)","description":"Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; File: \"ZillberReleyHost.exe\")\n Found string \"MoveFileExW\" (Indicator: \"MoveFileExW\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-884","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Able to retrieve command line parameters of the running process","description":"Found string \"GetCommandLineW\" (Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-930","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Able to retrieve/open a process (API string)","description":"Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetProcessHeap\" (Indicator: \"GetProcessHeap\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")\n Found reference to API \"OpenProcess\" (Indicator: \"OpenProcess\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-272","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to copy file from one location to another","description":"\"ZillberReleyHost.exe\" called \"CopyFileW\" to copy C:\\ZillberReleyHost.exe to new location %ALLUSERSPROFILE%\\DiagTrack\\a8d13425176123be\\ZillberReleyHost.exe (UID: 00000000-00007240)","origin":"API Call","mitre_attack_id":"T1005","relevance":3,"id":"api-123","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a directory","description":"\"ZillberReleyHost.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\DiagTrack (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"CreateDirectoryW\" with parameter %ALLUSERSPROFILE%\\DiagTrack\\a8d13425176123be (UID: 00000000-00007240)","origin":"API Call","mitre_attack_id":"T1074.001","relevance":3,"id":"api-122","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"\"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter SleepConditionVariableCS (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter WakeAllConditionVariable (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter RtlGetVersion (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter CoCreateInstance (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter CoCreateInstanceEx (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter CoGetClassObject (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromFile (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007240)\n \"ZillberReleyHost.exe\" called \"GetProcAddress\" with a parameter FlsGetValue (UID: 00000000-00007240)","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains ability to create a new process (API string)","description":"Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"CreateProcessW\" (Indicator: \"CreateProcess\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-204","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains ability to create directories (API string)","description":"Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"CreateDirectoryW\" (Indicator: \"CreateDirectory\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1074.001","relevance":1,"id":"string-423","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains ability to create/open files (API string)","description":"Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"CreateFileW\" (Indicator: \"CreateFile\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-315","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$27","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains ability to move file or directory (API string)","description":"Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"MoveFileExW\" (Indicator: \"MoveFile\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-322","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetCommandLineW\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"kernel32.dllkernel32.dllGetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007240.00000000.157276.00AEA000.00000004.mdmp\")\n Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Contains references to file movement (imports API)","description":"Found MoveFileExW in import section (Source: ZillberReleyHost.exe)","origin":"Static Parser","mitre_attack_id":"T1083","relevance":1,"id":"static-205","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"Process ZillberReleyHost.exe created mutex with name \"\\BaseNamedObjects\\M_b57c583bf11ce99a\"","origin":"Created Mutant","mitre_attack_id":"T1480.002","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"File contains dynamic base/NX flags","description":"\"ZillberReleyHost.exe\" has flags like IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE\n IMAGE_DLLCHARACTERISTICS_NX_COMPAT\n IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE","origin":"Static Parser","id":"static-154","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"ZillberReleyHost.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 73d00000\n \"ZillberReleyHost.exe\" loaded module \"RPCRT4.DLL\" at base 73f40000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"ZillberReleyHost.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 772B0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"ZillberReleyHost.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 73F40000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"ZillberReleyHost.exe\" was detected as \"Microsoft Linker\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"PE file contains Debug data directory","description":"\"ZillberReleyHost.exe\" has Debug data directory \"IMAGE_DIRECTORY_ENTRY_DEBUG\"","origin":"Static Parser","id":"static-146","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"ZillberReleyHost.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"ZillberReleyHost.exe\" has an writable section named \".data\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"ZillberReleyHost.exe\" file has an entrypoint instructions - \"push\teax,push\tdword ptr [0x401000],call\t0x40116e,jmp\t0x401173,pop\teax,mov\tdword ptr [esp], eax,ret\t,mov\tdword ptr [esp], 0xfb6b6189,mov\teax, dword ptr [esp],mov\tecx, eax,rol\teax, 7,rol\tecx, 0x15,xor\teax, 0x6acdd39c,xchg\tdword ptr [0x6288ec], ecx,mov\tecx, eax,xchg\tdword ptr [0x6288f0], ecx,mov\tecx, eax,rol\teax, 6,rol\tecx, 9,xor\teax, 0x65298292,xchg\tdword ptr [0x6288f0], ecx,mov\tdword ptr [esp], eax,mov\tecx, dword ptr [esp],rol\tecx, 5,mov\teax, ecx,xor\teax, 0x77114f33,mov\tedx, eax,rol\teax, 0xe,xor\teax, ecx,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".text\" is \"0x206e00\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".text\" is \"0x206c7a\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"ZillberReleyHost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa c10, OU=VeriSign Trust Network, O=\"VeriSign\n Inc.\", C=US\" (SHA1: 20:62:F5:F4:77:BF:FB:F3:E6:36:51:DF:C3:75:B8:94:AD:04:C4:FE; see report for more information)\n The input sample is signed with a certificate issued by \"CN=VeriSign Class 3 Public Primary Certification Authority - G5, OU=\"c 2006 VeriSign\n Inc. - For authorized use only\", OU=VeriSign Trust Network, O=\"VeriSign\n Inc.\", C=US\" (SHA1: 49:58:47:A9:31:87:CF:B8:C7:1F:84:0C:B7:B4:14:97:AD:95:C6:4F; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"ZillberReleyHost.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"ZillberReleyHost.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"ZillberReleyHost.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\"- Location: [%ALLUSERSPROFILE%\\DiagTrack\\a8d13425176123be\\ZillberReleyHost.exe]- [targetUID: 00000000-00007240]\n \"ZillberReleyHost.exe%3AZone.Identifier\" has type \"ASCII text with CRLF line terminators\"- [targetUID: 00000000-00007240]","origin":"Binary File","mitre_attack_id":"T1105","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$28","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$29","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"ZillberReleyHost.exe\" reads file \"c:\\zillberreleyhost.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Queries process mitigation policy via NtQueryInformationProcess\n Matched sigs: Triggers a burst of requests to the same API (API Hammering)","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"\"ZillberReleyHost.exe\" trying to touch file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"ZillberReleyHost.exe\" trying to touch file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"ZillberReleyHost.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\apphelp.dll\"\n \"ZillberReleyHost.exe\" trying to touch file \"C:\\WINDOWS\\SysWOW64\\apphelp.dll\"\n \"ZillberReleyHost.exe\" trying to touch file \"C:\\ZillberReleyHost.exe\"\n \"ZillberReleyHost.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\ntdll.dll\"\n \"ZillberReleyHost.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\kernel32.dll\"\n \"ZillberReleyHost.exe\" trying to touch file \"C:\\Windows\\SysWOW64\\KernelBase.dll\"\n \"ZillberReleyHost.exe\" trying to touch file \"C:\\Windows\\apppatch\\sysmain.sdb\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\Windows\\System32\\WOW64LOG.DLL\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\WINDOWS\\system32\\wow64log.dll\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\FLTLIB.DLL\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\MSVCP140.DLL\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\MSVCP140.dll\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.DLL\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\VCRUNTIME140.dll\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\ProgramData\\DiagTrack\\a8d13425176123be\\ZILLBERRELEYHOST.EXE\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\ProgramData\\DiagTrack\\a8d13425176123be\\ZillberReleyHost.exe\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (non-executable)","description":"\"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\POLTARBI.MON\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\poltarbi.mon\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\ProgramData\\DIAGTRACK\"\n \"ZillberReleyHost.exe\" trying to access non-existent file \"C:\\ProgramData\\DiagTrack\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-161","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Installation/Persistence","name":"Writes files","description":"\"ZillberReleyHost.exe\" writes file \"c:\\programdata\\diagtrack\\a8d13425176123be\\zillberreleyhost.exe\"","origin":"API Call","relevance":1,"id":"api-242","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://www.w3.org/2001/xmlschema-instance\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to capture screen (API string)","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to discover operating system information (API string)","description":"Found reference to API \",,RtlGetNtProductType,NTDLL.dll,\"00:40:57.0\" (Indicator: \"RtlGetNtProductType\"; Source: \"00000000-00007240.00000000.157276.00CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-86","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"ZillberReleyHost.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"FindFirstFileW\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetCurrentProcessId\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")\n Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to read files (API string)","description":"Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"ReadFile\" (Indicator: \"ReadFile\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","id":"string-534","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve file and directory information (API string)","description":"Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetFileAttributesW\" (Indicator: \"GetFileAttributes\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")\n Found reference to API \"GetFileSizeEx\" (Indicator: \"GetFileSize\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")\n Found reference to API \"GetTempPathW\" (Indicator: \"GetTempPath\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-207","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the host's architecture (API string)","description":"Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"GetEnvironmentVariableW\" (Indicator: \"GetEnvironmentVariable\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-107","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"System Security","name":"Calls an API used to open a process handle","description":"Observed import api \"OpenProcess\" which can be \"used to open a process handle\" [Source: ZillberReleyHost.exe]","origin":"Static Parser","mitre_attack_id":"T1489","relevance":5,"id":"static-191","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume2\" (Indicator: \"\\Device\\\"; Source: \"00000000-00007240.00000000.157276.00CA0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"System Security","name":"Contains ability to delete files/directories (API string)","description":"Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"DeleteFileW\" (Indicator: \"DeleteFile\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1070.004","relevance":1,"id":"string-308","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"System Security","name":"Contains ability to write files (API string)","description":"Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"WriteFile\" (Indicator: \"WriteFile\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1105","id":"string-535","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"ZillberReleyHost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\SANDBOXFILTER\"; Key: \"SUPPORTEDFEATURES\"; Value: \"\")\n \"ZillberReleyHost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WCIFS\"; Key: \"SUPPORTEDFEATURES\"; Value: \"\")\n \"ZillberReleyHost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\WOF\"; Key: \"SUPPORTEDFEATURES\"; Value: \"\")\n \"ZillberReleyHost.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\FILEINFO\"; Key: \"SUPPORTEDFEATURES\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; File: \"ZillberReleyHost.exe\")\n Found reference to API \"CreateMutexW\" (Indicator: \"CreateMutex\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")\n Found reference to API \"OpenMutexW\" (Indicator: \"OpenMutex\"; Source: \"00000000-00007240.00000000.157276.01148000.00000002.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"ZillberReleyHost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"suspicious","category":"Cryptographic Related","name":"Dropped file has high entropy (likely encrypted/compressed content)","description":"Dropped file \"%ALLUSERSPROFILE%\\DiagTrack\\a8d13425176123be\\ZillberReleyHost.exe\" has high entropy 7.69886","origin":"Binary File","mitre_attack_id":"T1027","relevance":5,"id":"binary-60","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Attempts to retrieve the system language code","description":"\"ZillberReleyHost.exe\" called \"NtQueryInstallUILanguage\" with parameters {\"LanguageId\": \"1033\"}","origin":"API Call","mitre_attack_id":"T1614.001","relevance":10,"id":"api-307","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"suspicious","category":"Environment Awareness","name":"Queries process mitigation policy via NtQueryInformationProcess","description":"\"C:\\ZillberReleyHost.exe\" queried ProcessMitigationPolicy","origin":"API Call","mitre_attack_id":"T1497.001","relevance":1,"id":"api-323","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"suspicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"8/23 Antivirus vendors marked sample as malicious (34% detection rate)","origin":"External System","id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"ZillberReleyHost.exe\" has type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\"- Location: [%ALLUSERSPROFILE%\\DiagTrack\\a8d13425176123be\\ZillberReleyHost.exe]- [targetUID: 00000000-00007240]","origin":"Binary File","mitre_attack_id":"T1105","relevance":5,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"Wow64Transition@NTDLL.DLL\" in \"ZillberReleyHost.exe\"","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"ZillberReleyHost.exe\" claimed CRC 2402223 while the actual is CRC 30415159\n \"ZillberReleyHost.exe\" claimed CRC 2402223 while the actual is CRC 5099064","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"Sleep\n FindFirstFileW\n GetTempPathW\n CreateThread\n CreateProcessW\n OpenProcess\n WriteProcessMemory\n WriteFile\n GetModuleFileNameW\n GetFileSizeEx\n CreateDirectoryW\n GetCommandLineW\n CreateFileW\n DeleteFileW\n GetFileAttributesW\n CopyFileW","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_90% (D)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"level":"malicious","category":"Installation/Persistence","name":"Drops executable files to the application program directory (%ProgramData%)","description":"File type \"PE32 executable for MS Windows 6.00 (GUI) Intel i386 5 sections\" was dropped at \"%ALLUSERSPROFILE%\\DiagTrack\\a8d13425176123be\\ZillberReleyHost.exe\"","origin":"Binary File","mitre_attack_id":"T1036","relevance":7,"id":"binary-27","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"name":"Persistence","details_count":1,"details":[{"detail":"Drops executable files to the application program directory (%ProgramData%)"}],"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]}],"intel_graph":{"map":{"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33":{"type":"File","value":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"},"File:44a968c1a10bfbf9638df3629db1cf8af3866f9cf35fa300541cf8eb3b55140a":{"type":"File","value":"44a968c1a10bfbf9638df3629db1cf8af3866f9cf35fa300541cf8eb3b55140a"},"File:cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333":{"type":"File","value":"cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","verdict":{"verdict":"malicious","verdict_source":"static analysis","reasons":["PE file has invalid certificate"]},"filetype":"PE32 executable (GUI) Intel 80386, for MS Windows, 5 sections","filetype_short":"PE32","mime_type":"application/x-dosexec"}},"chains":[{"id":"1557946252994211498","root":"File:cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","edges":[],"verdict":{"verdict":"malicious","verdict_source":"static analysis","reasons":["PE file has invalid certificate"]}},{"id":"sandbox_files","root":"File:cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","edges":[{"edge_kind":"extracted","from_key":"File:cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","to_key":"File:44a968c1a10bfbf9638df3629db1cf8af3866f9cf35fa300541cf8eb3b55140a"},{"edge_kind":"extracted","from_key":"File:cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","to_key":"File:1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33"}],"verdict":{"verdict":"unknown","verdict_source":"sandbox"}}]}},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":1,"imported_dlls_count":31,"dropped_files_count":0,"extracted_files_count":2,"files_written_count":3,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":null,"sample_flags":["Extracted Files"],"sandbox_reports":[{"id":"6ac85479155cbfb1cf0a7acd","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":71,"malware_family":"Gen:Variant.Doina","submit_name":"ZillberReleyHost.exe","analysis_start_time":"2026-10-09T02:42:07+00:00","indicators_count":{"informative":76,"suspicious":10,"malicious":2},"tags":["Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}],"processes":[{"pid":7240,"ppid":0,"name":"ZillberReleyHost.exe","command_line":"","sha256":"cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333","normalized_path":"C:\\ZillberReleyHost.exe","uid":"00000000-00007240","icon":"$2b"}],"all_imported_dlls":["kernel32.dll","user32.dll","apphelp.dll","ws2_32.dll","cryptbase.dll","sechost.dll","oleaut32.dll","sspicli.dll","imm32.dll","shlwapi.dll","ntmarta.dll","KernelBase.dll","advapi32.dll","ole32.dll","msvcrt.dll","wow64.dll","win32u.dll","combase.dll","ntdll.dll","wow64cpu.dll","bcryptprimitives.dll","gdi32.dll","msvcp140.dll","rpcrt4.dll","fltLib.dll","VxSSL32.dll","gdi32full.dll","ucrtbase.dll","msvcp_win.dll","vcruntime140.dll","wow64win.dll"]},"file_activity":{"dropped_files":[],"extracted_files":[{"name":"ZillberReleyHost.exe","sha256":"44a968c1a10bfbf9638df3629db1cf8af3866f9cf35fa300541cf8eb3b55140a","verdict":"malicious","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"name":"ZillberReleyHost.exe%3AZone.Identifier","sha256":"1409cc4125f7e08d09a731da789dc35c09afa8e716c00ad22d9f3f1b17a2cb33","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]}],"files_written":[{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"path":"%ALLUSERSPROFILE%\\DiagTrack\\a8d13425176123be\\ZillberReleyHost.exe","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]},{"path":"%ALLUSERSPROFILE%\\DiagTrack\\a8d13425176123be\\ZillberReleyHost.exe:Zone.Identifier","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]}],"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":[{"name":"\\BaseNamedObjects\\M_b57c583bf11ce99a","sources":[{"report_type":"sandbox","report_id":"6ac85479155cbfb1cf0a7acd"}]}]}},"report_ids":{"sandbox_job_ids":["6ac85479155cbfb1cf0a7acd"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Doina.Generic Sample cf90ad8eef1b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample cf90ad8eef1b…. Malware family: Doina.Generic. Threat score 100/100. 9/24 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333"}],["$","meta","4",{"property":"og:title","content":"Malicious Doina.Generic Sample cf90ad8eef1b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample cf90ad8eef1b…. Malware family: Doina.Generic. Threat score 100/100. 9/24 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/cf90ad8eef1b73e674f5dbbc12f8bbc4ee0ebc2b9485ddf5ef3cf5ce863f5333"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Doina.Generic Sample cf90ad8eef1b… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample cf90ad8eef1b…. Malware family: Doina.Generic. Threat score 100/100. 9/24 AV engines flagged this file. 2 malicious and 8 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2c","11",{}]]