24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 29:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T49f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious DarkHotel.Generic Sample 2cab9946741f… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample 2cab9946741f…. Malware family: DarkHotel.Generic. Threat score 100/100. 16/26 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0","keywords":["Malicious","DarkHotel.Generic","malware analysis","sandbox report","threat intelligence","2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0"],"about":{"@type":"SoftwareApplication","name":"bounty-85646536503021611","applicationCategory":["peexe","executable"],"identifier":"2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"DarkHotel.Generic","antivirusDetections":{"malicious":16,"total":26},"behavioralIndicators":{"malicious":6,"suspicious":16},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T271e,"vboxvideo.inf" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_282ccc1684d6e163\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vbox") "2017-12-11 20:24:00, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\VBoxGuest.cat]" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM DISM Driver Manager: PID=1172 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2017-12-11 20:24:00, Info DISM API: PID=2796 TID=2828 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_12eb69aba9e5025e\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_bc42bb1917d1bc65\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vbox") "2018-02-20 09:38:55, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\VBoxGuest.cat]" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM DISM Driver Manager: PID=3012 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2018-02-20 09:38:55, Info DISM API: PID=1720 TID=1964 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_9fc262b6119df1ee\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_e9f3789e40cc2499\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:42, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:42, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM API: PID=2008 TID=2408 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf - DismGetDriverInfoInternal" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is boot-critical. - CDriverPackage::FillInPackageDetails" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vbox") "2019-01-03 17:11:43, Info IsDriverPackageSigned: File [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf] is signed by a catalog [C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\VBoxGuest.cat]" (Indicator: "vboxguest") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vbox") "2019-01-03 17:11:43, Info DISM DISM Driver Manager: PID=1456 Signature status of driver C:\Windows\System32\DriverStore\FileRepository\vboxguest.inf_amd64_neutral_cf01905bf05ff6d6\vboxguest.inf is: SIGNED - CDriverPackage::InitSignatureStatus" (Indicator: "vboxguest") "2019-03-21 15:34:49, Info DISM API: PID=2344 TID=1716 Input parameters: Session: 2, DriverPath: C:\Windows\System32\DriverStore\FileRepository\vboxvideo.inf_amd64_neutral_9bc3c1389d21f9ef\vboxvideo.inf - DismGetDriverInfoInternal" (Indicator: "vbox")26:T683,Found malicious artifacts related to "209.99.64.52": ... URL: http://milwaukeequote.com/ (AV positives: 4/93 scanned on 02/01/2022 18:49:09) URL: http://elpasoquote.com/ (AV positives: 7/93 scanned on 02/01/2022 18:49:04) URL: https://digitaltechnyc.com/ (AV positives: 1/93 scanned on 02/01/2022 18:20:04) URL: http://austinquote.com/ (AV positives: 4/93 scanned on 02/01/2022 16:16:57) URL: http://alaskaquote.com/ (AV positives: 8/93 scanned on 02/01/2022 15:39:21) File SHA256: 4ad465b840cf7a5b5098806a97dd31846b1459fc592bb8021096b7392550389f (AV positives: 1/72 scanned on 01/25/2022 19:31:52) File SHA256: c406b4a6585a420bb4d5f7ee6095786a01f4d036c8bc15852c2657759eef17e8 (AV positives: 16/74 scanned on 09/30/2021 17:38:53) File SHA256: e308e6237e2599a5bd7f634d8c23b4c974018c931360ebeb387041901a639206 (AV positives: 14/74 scanned on 09/29/2021 18:07:47) File SHA256: afeb23b4dca9837f0de59c2b958c222685b58a82ba3fb7cb5f02119d7537c091 (AV positives: 15/74 scanned on 09/22/2021 14:34:31) File SHA256: c0876ec7d91af16b788afed14d3b3dd0c3347aab93a5c483f22592cc450a77e1 (Date: 09/09/2021 02:15:45) File SHA256: 5c1d5fd46a88611c31ecbb8ffc1142a7e74ec7fb7d72bd3891131c880ef3f584 (AV positives: 1/76 scanned on 10/29/2020 16:51:58) File SHA256: a88d342413cb10ecf0a79726e4f946d211bf8db8bbe8255db0c4e03e565e8668 (Date: 02/03/2020 01:29:45) File SHA256: 875dd37d323b87fc2f043c60a33801d05d5e8f094aea51c161ca706cbc50afe1 (Date: 02/03/2020 00:39:45) File SHA256: 4c35f80d17d468922f47143fd390b3542d9389ceeca019282e8e44819877c96a (Date: 01/31/2020 02:53:06) File SHA256: cb0a1046bebfe9e5d1bd26c21db20038c070a22a260f5e39a7eb80c818b96e60 (Date: 01/31/2020 02:26:21)27:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==28:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1791570731602,"unified_at":"2026-10-09T18:32:11.602Z","metadata":{"hashes":{"sha256":"2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0","sha1":"baab0383ca3b10d4b9348cf6fed7e8010ce62217","md5":"a8151939085ce837b3a7deec58efa7b4","sha512":"92821a077f07971d913aa05fdffba0778cb6747e6b4b122bac0cc916755a3e7497112bf8117696baf63bbfd4cecb8cbe3e5262a218757f78f4e5e6aefe1a85c0","ssdeep":"6144:Oz1puZ9rSbebLUshObTFewW8dFlKVYkvcPAPQt:O2ZdFksh6Tz/dFRjh","ssdeep_chunks":["6144:Oz1puZ9","6144:z1puZ9r","6144:1puZ9rS","6144:puZ9rSb","6144:uZ9rSbe","6144:Z9rSbeb","6144:9rSbebL","6144:rSbebLU","6144:SbebLUs","6144:bebLUsh","6144:ebLUshO","6144:bLUshOb","6144:LUshObT","6144:UshObTF","6144:shObTFe","6144:hObTFew","6144:ObTFewW","6144:bTFewW8","6144:TFewW8d","6144:FewW8dF","6144:ewW8dFl","6144:wW8dFlK","6144:W8dFlKV","6144:8dFlKVY","6144:dFlKVYk","6144:FlKVYkv","6144:lKVYkvc","6144:KVYkvcP","6144:VYkvcPA","6144:YkvcPAP","6144:kvcPAPQ","6144:vcPAPQt","12288:Oz1puZ9","12288:z1puZ9r","12288:1puZ9rS","12288:puZ9rSb","12288:uZ9rSbe","12288:Z9rSbeb","12288:9rSbebL","12288:rSbebLU","12288:SbebLUs","12288:bebLUsh","12288:ebLUshO","12288:bLUshOb","12288:LUshObT","12288:UshObTF","12288:shObTFe","12288:hObTFew","12288:ObTFewW","12288:bTFewW8","12288:TFewW8d","12288:FewW8dF","12288:ewW8dFl","12288:wW8dFlK","12288:W8dFlKV","12288:8dFlKVY","12288:dFlKVYk","12288:FlKVYkv","12288:lKVYkvc","12288:KVYkvcP","12288:VYkvcPA","12288:YkvcPAP","12288:kvcPAPQ","12288:vcPAPQt","6144:O2ZdFks","6144:2ZdFksh","6144:ZdFksh6","6144:dFksh6T","6144:Fksh6Tz","6144:ksh6Tz/","6144:sh6Tz/d","6144:h6Tz/dF","6144:6Tz/dFR","6144:Tz/dFRj","6144:z/dFRjh"],"imphash":"b70ac5ff714ddf5159c16ca1a41f186f"},"file_info":{"file_name":"bounty-85646536503021611","file_type":["peexe","executable"],"file_type_id":"exe","file_size":285576,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1643742146000,"last_seen":1643742146000,"last_multi_scan":1643742146000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":null},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":26},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":13},"sandbox_signatures":{"informative_count":18,"suspicious_count":16,"malicious_count":6,"total":40},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"aegislab":{"name":"AegisLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ahnlab":{"name":"AhnLab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"malicious","threat_name":"TR/Gericos.ser","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Gen:Variant.DarkHotel.15","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bytehero":{"name":"ByteHero","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_60% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cyren":{"name":"Cyren","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Gen:Variant.DarkHotel.15 (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Agent.OKG trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"ikarus":{"name":"IKARUS","success":true,"verdict":"malicious","threat_name":"Trojan.BadCert","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Riskware ( 0015e4f01 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"kaspersky":{"name":"Kaspersky","success":true,"verdict":"malicious","threat_name":"HEUR:Trojan.Win32.Generic","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"malicious","threat_name":"BackDoor-FCJB!A8151939085C","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.TrjGen.dsvlpk","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"quickheal":{"name":"Quick Heal","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicro":{"name":"Trend Micro","success":true,"verdict":"malicious","threat_name":"TROJ_GARVEEP.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trendmicrohousecall":{"name":"Trend Micro HouseCall","success":true,"verdict":"malicious","threat_name":"TROJ_GARVEEP.SM","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Agent3.CJRQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Backdoor.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xvirusantimalware":{"name":"Xvirus Anti-Malware","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"DarkHotel.Generic","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Defense Evasion","technique":"Code Signing","attack_id":"T1553.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1553/002","identifiers":[{"type":"malicious","value":"The input sample is signed with an invalid certificate"},{"type":"informative","value":"The input sample is signed with a certificate"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Defense Evasion","technique":"NTFS File Attributes","attack_id":"T1564.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/004","identifiers":[{"type":"malicious","value":"Creates a resource fork (ADS) file (often used to hide data)"},{"type":"malicious","value":"Checks for a resource fork (ADS) file"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"suspicious","value":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Credential Access","technique":"Credential API Hooking","attack_id":"T1056.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/004","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Reads information about supported languages"},{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Collection","technique":"Email Collection","attack_id":"T1114","attack_id_wiki":"https://attack.mitre.org/techniques/T1114","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"GETs files from a webserver"},{"type":"suspicious","value":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}],"sandbox_signatures":[{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"External Systems","name":"Detected Suricata Alert","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","origin":"Suricata Alerts","relevance":10,"id":"suricata-0","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"Contacts domains","description":"\"updarling.000a.biz\"","origin":"Network Traffic","relevance":1,"id":"network-0","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"180.235.132.99:80\"\n \"209.99.64.52:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\220101005\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"220101005\"\n \"\\BaseNamedObjects\\Global\\WdsSetupLogInit\"\n \"\\BaseNamedObjects\\Global\\SetupLog\"\n \"\\BaseNamedObjects\\DBWinMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"Drops files marked as clean","description":"Antivirus vendors marked dropped file \"dismhost.exe.61F9885B.bin\" as clean (type is \"PE32+ executable (GUI) x86-64 for MS Windows\")","origin":"Binary File","relevance":10,"id":"binary-16","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /update3/rrecent.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: 180.235.132.99\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /update3/rrecent.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: updarling.000a.biz\nConnection: Keep-Alive\nCache-Control: no-cache\"\n \"GET /update3/rrecent.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: updarling.000a.biz\nConnection: Keep-Alive\nCache-Control: no-cache\nCookie: vsid=928vr3912879471348381\"","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\".exe\" touched \"WinInetBroker Class\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\LOCALSERVER32\")\n \".exe\" touched \"PSFactoryBuffer\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\\INPROCHANDLER\")\n \".exe\" touched \"Network List Manager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \".exe\" touched \"NetworkListManager\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\WOW6432NODE\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\\INPROCHANDLER\")\n \"dismhost.exe\" touched \"PSDispatch\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{00020420-0000-0000-C000-000000000046}\\PROGID\")\n \"dismhost.exe\" touched \"PSSupportErrorInfo\" (Path: \"HKLM\\SOFTWARE\\CLASSES\\CLSID\\{DF0B3D60-548F-101B-8E65-08002B2BD119}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"Process launched with changed environment","description":"Process \"dismhost.exe\" (UID: 00000000-00003780) was launched with modified environment variables: \"LOCALAPPDATA, USERDOMAIN, TEMP, APPDATA, USERPROFILE, TMP\"\n Process \"dismhost.exe\" (UID: 00000000-00003780) was launched with missing environment variables: \"LOGONSERVER, HOMEPATH, HOMEDRIVE\"","origin":"Monitored Target","relevance":10,"id":"target-67","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"Spawns new processes","description":"Spawned process \"dismhost.exe\" with commandline \"{DAEE4F44-7F8E-4501-B9EA-5185673556D5}\" (UID: 00000000-00003780)","origin":"Monitored Target","relevance":3,"id":"target-25","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"Spawns new processes that are not known child processes","description":"Spawned process \"dismhost.exe\" with commandline \"{DAEE4F44-7F8E-4501-B9EA-5185673556D5}\" (UID: 00000000-00003780)","origin":"Monitored Target","relevance":3,"id":"target-103","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"General","name":"The input sample is signed with a certificate","description":"The input sample is signed with a certificate issued by \"CN=GTE CyberTrust Global Root, OU=\"GTE CyberTrust Solutions\n Inc.\", O=GTE Corporation, C=US\" (SHA1: 97:81:79:50:D8:1C:96:70:CC:34:D8:09:CF:79:44:31:36:7E:F4:74; see report for more information)\n The input sample is signed with a certificate issued by \"CN=Cybertrust SureServer CA, O=GlobalSign Inc\" (SHA1: 09:6E:9B:47:56:94:74:64:DA:EA:5C:B5:E3:70:59:8D:CD:59:E8:24; see report for more information)\n The input sample is signed with a certificate issued by \"CN=GTE CyberTrust Global Root, OU=\"GTE CyberTrust Solutions\n Inc.\", O=GTE Corporation, C=US\" (SHA1: 91:F8:AA:B1:F7:C1:C5:66:61:1D:5D:6D:37:CA:E8:26:C3:A5:FD:48; see report for more information)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-0","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"Installation/Persistence","name":"Dropped files","description":"\"dismhost.exe.61F9885B.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"\n \"dism.log\" has type \"UTF-8 Unicode (with BOM) text with very long lines with CRLF line terminators\"\n \"GYPV7QTX.txt\" has type \"ASCII text\"","origin":"Binary File","relevance":3,"id":"binary-0","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \".exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\\GYPV7QTX.txt\"\n \"dismhost.exe\" touched file \"%WINDIR%\\TEMP\\CAE775AD-D438-43EA-96F9-00B87A4DAEDE\\en-US\\dismhost.exe.mui\"\n \"dismhost.exe\" touched file \"%WINDIR%\\Logs\\DISM\\dism.log\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"http://crl.globalsign.net/sureserver.crl0\"\n Pattern match: \"www.public-trust.com/cgi-bin/CRL/2018/cdp.crl0\"\n Pattern match: \"http://www.public-trust.com/CPS/SureServer.html0\"\n Heuristic match: \"updarling.000a.biz\"\n Heuristic match: \"dailypatch-rnr2008.net\"\n Heuristic match: \"updatewell.freebyte.us\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\".exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\".exe\" opened \"\\Device\\KsecDD\"\n \"dismhost.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0.bin\" was detected as \"Microsoft visual C++ 5.0\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Environment Awareness","name":"Possibly tries to implement anti-virtualization techniques","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497","relevance":4,"id":"string-1","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\".exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")\n \"dismhost.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"External Systems","name":"Found an IP/URL artifact that was identified as malicious by at least three reputation engines","description":"3/78 reputation engines marked \"http://updatewell.freebyte.us\" as malicious (3% detection rate)\n 3/93 reputation engines marked \"http://updarling.000a.biz\" as malicious (3% detection rate)","origin":"External System","relevance":10,"id":"avtest-6","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"General","name":"POSTs files to a webserver","description":"\"POST /update3/update.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: 180.235.132.99\nContent-Length: 422\nConnection: Keep-Alive\nCache-Control: no-cache\" with no payload\n \"POST /update3/update.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: updarling.000a.biz\nContent-Length: 398\nConnection: Keep-Alive\nCache-Control: no-cache\nCookie: vsid=928vr3912879471348381\" with no payload","origin":"Network Traffic","mitre_attack_id":"T1071.001","relevance":5,"id":"network-4","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Drops executable files","description":"\"dismhost.exe.61F9885B.bin\" has type \"PE32+ executable (GUI) x86-64 for MS Windows\"","origin":"Binary File","relevance":10,"id":"binary-1","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"180.235.132.99\"\n Potential IP \"180.235.132.99\" found in string \"GET /update3/rrecent.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: 180.235.132.99\nConnection: Keep-Alive\nCache-Control: no-cache\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 180.235.132.99 on port 80 is sent without HTTP header\n TCP traffic to 209.99.64.52 on port 80 is sent without HTTP header","origin":"Network Traffic","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSAPPCOMPAT\")","origin":"Registry Access","mitre_attack_id":"T1021.001","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\".exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \".exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\WOW6432NODE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\".exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"CRC value set in PE header does not match actual value","description":"\"dismhost.exe.61F9885B.bin\" claimed CRC 141269 while the actual is CRC 308640","origin":"Static Parser","relevance":10,"id":"static-0","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"RegDeleteKeyA\n SetSecurityDescriptorDacl\n RegCloseKey\n OpenProcessToken\n GetUserNameA\n RegDeleteValueA\n RegOpenKeyExA\n RegEnumKeyA\n RegEnumKeyExA\n DeviceIoControl\n GetVersionExA\n OpenProcess\n DeleteFileA\n GetTempPathA\n GetModuleHandleA\n FindFirstFileA\n GetStartupInfoA\n GetComputerNameA\n FindNextFileA\n TerminateProcess\n GetSystemDirectoryA\n GetDriveTypeA\n CreateProcessA\n Sleep\n CreateFileA\n GetTickCount\n GetModuleFileNameExA\n EnumProcesses\n GetClipboardData\n HttpSendRequestA\n InternetReadFile\n InternetCloseHandle\n InternetOpenA\n InternetConnectA\n HttpQueryInfoA\n WSAStartup\n OutputDebugStringW\n GetModuleFileNameW\n GetVersionExW\n OutputDebugStringA\n VirtualProtect\n GetFileAttributesW\n GetCommandLineW\n UnhandledExceptionFilter\n LoadLibraryExW\n GetStartupInfoW\n MapViewOfFile\n GetProcAddress\n CreateFileMappingW\n CreateThread\n LoadLibraryW\n GetSystemDirectoryW\n FindResourceExW\n GetModuleHandleW\n GetModuleHandleExW\n CreateFileW","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\".exe\" wrote bytes \"c0dff4761cf9f376ccf8f3760d64f57600000000c011907400000000fc3e907400000000e0139074000000009457a97625e0f476c6e0f47600000000bc6aa87600000000cf319074000000009319a976000000002c32907400000000\" to virtual address \"0x75071000\" (part of module \"NSI.DLL\")\n \".exe\" wrote bytes \"7d07f87681edf676ae86f576c6e0f476effdf7762d16f6766014f876478df576a8e2f4766089f57600000000ad3748768b2d4876b641487600000000\" to virtual address \"0x731B1000\" (part of module \"WSHTCPIP.DLL\")\n \".exe\" wrote bytes \"0efcf77681edf676ae86f576c6e0f476effdf7762d16f676c0fcf376da8ffe766014f876478df576a8e2f4766089f57600000000ad3748768b2d4876b641487600000000\" to virtual address \"0x731C1000\" (part of module \"WSHIP6.DLL\")\n \".exe\" wrote bytes \"7111d0017a3bcf01ab8b02007f950200fc8c0200729602006cc805001ecdcc017d26cc01\" to virtual address \"0x752A07E4\" (part of module \"USER32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1056.004","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Reads information about supported languages","description":"\".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \".exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"dismhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")\n \"dismhost.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"malicious","category":"Anti-Detection/Stealthyness","name":"Creates a resource fork (ADS) file (often used to hide data)","description":"\".exe\" created file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":8,"id":"api-19","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"54/69 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"54/69 Antivirus vendors marked sample as malicious (78% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"malicious","category":"General","name":"The input sample is signed with an invalid certificate","description":"Error: The signature of the certificate cannot be verified. (0x80096004)","origin":"Certificate Data","mitre_attack_id":"T1553.002","relevance":10,"id":"certificate-1","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"$26","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\".exe\" checked file \"C:\"","origin":"API Call","mitre_attack_id":"T1564.004","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"POSTs files to a webserver"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"Fingerprint","details_count":7,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Reads the windows installation language"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"Evasive","details_count":2,"details":[{"detail":"Tries to sleep for a long time (more than two minutes)"},{"detail":"Possibly tries to implement anti-virtualization techniques"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"Network Behavior","details_count":1,"details":[{"detail":"Contacts 4 domains and 4 hosts"}],"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}]},"activity":{"stats":{"process_count":2,"spawned_processes_count":2,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":9,"imported_dlls_count":89,"dropped_files_count":0,"extracted_files_count":3,"files_written_count":2,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":2,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":7,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":2,"dns_resolutions_count":4,"contacted_urls_count":2,"http_requests_count":2},"behavior_tags":null,"sample_flags":["Multi-Process","Network Traffic","Extracted Files"],"sandbox_reports":[{"id":"61f983c230988611df39da50","environment_id":120,"environment_description":"Windows 7 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Gen:Variant.DarkHotel","contacted_countries":["HKG","USA"],"submit_name":"2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0","analysis_start_time":"2022-02-01T19:02:35+00:00","indicators_count":{"informative":18,"suspicious":27,"malicious":8},"tags":["Multi-Process","Network Traffic","Extracted Files"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"180.235.132.99","port":80,"protocol":"TCP","country":"Hong Kong","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"address":"209.99.64.52","port":80,"protocol":"TCP","country":"United States","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}],"dns_resolutions":[{"domain":"**","country":"-","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"domain":"dailypatch-rnr2008.net","ttl":900,"country":"-","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"domain":"updarling.000a.biz","address":"209.99.64.52","ttl":300,"country":"United States","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"domain":"updatewell.freebyte.us","ttl":1800,"country":"-","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}],"http_requests":[{"host":"180.235.132.99","host_ip":"180.235.132.99:80","url":"/update3/rrecent.php","method":"GET","header":"GET /update3/rrecent.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: 180.235.132.99\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"host":"180.235.132.99","host_ip":"180.235.132.99:80","url":"/update3/update.php","method":"POST","header":"POST /update3/update.php HTTP/1.1\nUser-Agent: Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 5.1)\nHost: 180.235.132.99\nContent-Length: 422\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}],"processes":[{"pid":2844,"ppid":0,"name":"2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0.exe","command_line":"","sha256":"2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0","normalized_path":"C:\\2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0.exe","uid":"00000000-00002844","icon":"$27"},{"pid":3780,"ppid":0,"name":"dismhost.exe","command_line":"{DAEE4F44-7F8E-4501-B9EA-5185673556D5}","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","normalized_path":"%WINDIR%\\TEMP\\CAE775AD-D438-43EA-96F9-00B87A4DAEDE\\dismhost.exe","uid":"00000000-00003780","icon":"$28"}],"all_imported_dlls":["DmiProvider.dll","SPInf.dll","ntdll.dll","profapi.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","bcrypt.dll","dbghelp.dll","devobj.dll","dnsapi.dll","sspicli.dll","devrtl.dll","comctl32.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","bcryptprimitives.dll","KernelBase.dll","userenv.dll","RpcRtRemote.dll","wow64.dll","wow64cpu.dll","rpcrt4.dll","LogProvider.dll","wininet.dll","nsi.dll","clbcatq.dll","wow64win.dll","oleaut32.dll","OSProvider.dll","sechost.dll","shell32.dll","urlmon.dll","FWPUCLNT.DLL","normaliz.dll","DrUpdate.dll","rasadhlp.dll","gdi32.dll","cryptbase.dll","lpk.dll","IPHLPAPI.DLL","cfgmgr32.dll","avicap32.dll","winnsi.dll","npmproxy.dll","shlwapi.dll","version.dll","DismCorePS.dll","advapi32.dll","NapiNSP.dll","winrnr.dll","secur32.dll","mswsock.dll","api-ms-win-downlevel-version-l1-1-0.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","WSHTCPIP.DLL","kernel32.dll","usp10.dll","msvfw32.dll","pnrpnsp.dll","winhttp.dll","api-ms-win-downlevel-user32-l1-1-0.dll","ole32.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","ws2_32.dll","psapi.dll","msctf.dll","dhcpcsvc.dll","cryptsp.dll","rsaenh.dll","nlaapi.dll","winmm.dll","wshqos.dll","VxSSL64.dll","wdscore.dll","CbsCore.dll","setupapi.dll","drvstore.dll","mpr.dll","wship6.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","iertutil.dll","webio.dll","DismProv.dll","SSShim.dll","msvcrt.dll","imm32.dll","dhcpcsvc6.dll","user32.dll","api-ms-win-core-synch-l1-2-0.dll","rpcss.dll"]},"file_activity":{"dropped_files":null,"extracted_files":[{"name":"dismhost.exe.61F9885B.bin","sha256":"9a4b735603297448841758b29d3c387a4ce84e5fd0dae05622f43ce53b8c85e6","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"dism.log","sha256":"ad4513e1c5f97a0af3fd91184e725a4f2f72fc01c38ad1779d7c388be49782df","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"GYPV7QTX.txt","sha256":"774dfcb3629cfc18aa80c62b003367d8b0020d63367c7486cfdd264cd9d0bd5d","verdict":"undetected","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}],"files_written":[{"path":"\\DEVICE\\NETBT_TCPIP_{846EE342-7039-11DE-9D20-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{C3450F58-7060-4AEA-B0A0-C245927D78D0}","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\TCPIP\\PARAMETERS\\","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"key":"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{5F4A384C-5B98-4E51-85D5-8FED9B27753E}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\220101005","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"220101005","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"\\BaseNamedObjects\\Global\\WdsSetupLogInit","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"\\BaseNamedObjects\\Global\\SetupLog","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]},{"name":"\\BaseNamedObjects\\DBWinMutex","sources":[{"report_type":"sandbox","report_id":"61f983c230988611df39da50"}]}]}},"report_ids":{"sandbox_job_ids":["61f983c230988611df39da50"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious DarkHotel.Generic Sample 2cab9946741f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample 2cab9946741f…. Malware family: DarkHotel.Generic. Threat score 100/100. 16/26 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0"}],["$","meta","4",{"property":"og:title","content":"Malicious DarkHotel.Generic Sample 2cab9946741f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample 2cab9946741f…. Malware family: DarkHotel.Generic. Threat score 100/100. 16/26 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/2cab9946741fc4cddefcec2104d4fe6d76390868f60f3207e9cb0e210bbe8db0"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious DarkHotel.Generic Sample 2cab9946741f… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample 2cab9946741f…. Malware family: DarkHotel.Generic. Threat score 100/100. 16/26 AV engines flagged this file. 6 malicious and 16 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L29","11",{}]]