24:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/1l73s1hqiu28q.js","/_next/static/chunks/3l_wb6il5gi_h.js","/_next/static/chunks/136wug8odqdqr.js"],"SampleDetailWrapper"] 2f:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/0g8d-v19n010u.js","/_next/static/chunks/2xonh_kqmr__3.js","/_next/static/chunks/3spet-0yezls2.js"],"IconMark"] 23:T4a0,{"@context":"https://schema.org","@type":"TechArticle","headline":"Malicious Application.Keylogger Sample e58864cc22cd… — Score 51/100 — Hybrid Analysis","description":"Malicious verdict for sample e58864cc22cd…. Malware family: Application.Keylogger. Threat score 51/100. 8/28 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1","keywords":["Malicious","Application.Keylogger","malware analysis","sandbox report","threat intelligence","e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1"],"about":{"@type":"SoftwareApplication","name":"WinKeyServer.exe","applicationCategory":["peexe","executable"],"identifier":"e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1","additionalType":"Malicious sample"},"threatScore":51,"malwareFamily":"Application.Keylogger","antivirusDetections":{"malicious":8,"total":28},"behavioralIndicators":{"malicious":1,"suspicious":7},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}25:T44a,Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; File: "WinKeyServer.exe") Found reference to API "-WaitForSingleObject@8" (Indicator: "WaitForSingleObject"; File: "WinKeyServer.exe") Found reference to API "yWaitForSingleObject@8" (Indicator: "WaitForSingleObject"; File: "WinKeyServer.exe") Found reference to API "IWaitForSingleObject@8" (Indicator: "WaitForSingleObject"; File: "WinKeyServer.exe") Found reference to API "WaitForSingleObject" (Indicator: "WaitForSingleObject"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API "-WaitForSingleObject@8" (Indicator: "WaitForSingleObject"; Source: "00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API "yWaitForSingleObject@8" (Indicator: "WaitForSingleObject"; Source: "00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API "IWaitForSingleObject@8" (Indicator: "WaitForSingleObject"; Source: "00000000-00009888.00000002.158419.004FE000.00000002.mdmp")26:Tc2d,Assembly shows XOR instruction xor bh byte ptr [edx-45C3FFF1h] in Stream UID: 6300-5999-0041CD78 Assembly shows XOR instruction xor esi ebx in Stream UID: 6300-6114-0040D550 Assembly shows XOR instruction xor ecx 1Fh in Stream UID: 6300-6114-0040D550 Assembly shows XOR instruction xor edx 1Fh in Stream UID: 6300-6114-0040D550 Assembly shows XOR instruction xor eax 1Fh in Stream UID: 6300-6114-0040D550 Assembly shows XOR instruction xor byte ptr [esi-49B9FFF1h] dh in Stream UID: 6300-6593-0041D008 Assembly shows XOR instruction xor al B8h in Stream UID: 6300-6893-0041CF08 Assembly shows XOR instruction xor eax ecx in Stream UID: 6300-7082-00482D90 Assembly shows XOR instruction xor al B7h in Stream UID: 6300-7272-0041CD50 Assembly shows XOR instruction xor esi eax in Stream UID: 6300-7794-0045D2E0 Assembly shows XOR instruction xor esi 01h in Stream UID: 6300-7794-0045D2E0 Assembly shows XOR instruction xor edi 01h in Stream UID: 6300-7794-0045D2E0 Assembly shows XOR instruction xor esi edx in Stream UID: 6300-7794-0045D2E0 Assembly shows XOR instruction xor esi eax in Stream UID: 6300-7798-0045E180 Assembly shows XOR instruction xor esi 01h in Stream UID: 6300-7798-0045E180 Assembly shows XOR instruction xor edi 01h in Stream UID: 6300-7798-0045E180 Assembly shows XOR instruction xor esi edx in Stream UID: 6300-7798-0045E180 Assembly shows XOR instruction xor edi 01h in Stream UID: 6300-7830-0045A2A0 Assembly shows XOR instruction xor esi eax in Stream UID: 6300-7830-0045A2A0 Assembly shows XOR instruction xor esi 01h in Stream UID: 6300-7830-0045A2A0 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7952-00446D00 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7953-00446CF0 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7954-00446CE0 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7955-00446CD0 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7956-00446CC0 Assembly shows XOR instruction xor eax 01h in Stream UID: 6300-7958-004452E0 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7965-00446210 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7971-00440230 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7972-0043E6C0 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7973-0043D9A0 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-7974-0043CC60 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-8033-00433930 Assembly shows XOR instruction xor esi eax in Stream UID: 6300-8033-00433930 Assembly shows XOR instruction xor eax 01h in Stream UID: 6300-8033-00433930 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-8034-00434B60 Assembly shows XOR instruction xor esi eax in Stream UID: 6300-8034-00434B60 Assembly shows XOR instruction xor eax 01h in Stream UID: 6300-8034-00434B60 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-9159-0043BF41 Assembly shows XOR instruction xor edx 01h in Stream UID: 6300-9169-0043F40127:T12bb,"WinKeyServer.exe" called "GetProcAddress" with a parameter InitializeCriticalSectionEx (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter FlsAlloc (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter FlsSetValue (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter FlsGetValue (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter LCMapStringEx (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter FlsFree (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter InitOnceExecuteOnce (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CreateEventExW (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CreateSemaphoreW (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CreateSemaphoreExW (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CreateThreadpoolTimer (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter SetThreadpoolTimer (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter WaitForThreadpoolTimerCallbacks (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CloseThreadpoolTimer (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWait (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter SetThreadpoolWait (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWait (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter FlushProcessWriteBuffers (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter FreeLibraryWhenCallbackReturns (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter GetCurrentProcessorNumber (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CreateSymbolicLinkW (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter GetCurrentPackageId (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter GetTickCount64 (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter GetFileInformationByHandleEx (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter SetFileInformationByHandle (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter GetSystemTimePreciseAsFileTime (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter InitializeConditionVariable (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter WakeConditionVariable (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter WakeAllConditionVariable (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter SleepConditionVariableCS (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter InitializeSRWLock (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter AcquireSRWLockExclusive (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter TryAcquireSRWLockExclusive (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter ReleaseSRWLockExclusive (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter SleepConditionVariableSRW (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CreateThreadpoolWork (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter SubmitThreadpoolWork (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CloseThreadpoolWork (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CompareStringEx (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter GetLocaleInfoEx (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter AreFileApisANSI (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter RtlGetVersion (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CoCreateInstance (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CoCreateInstanceEx (UID: 00000000-00009888) "WinKeyServer.exe" called "GetProcAddress" with a parameter CoGetClassObject (UID: 00000000-00009888)28:T26e8,Found reference to API (Indicator: "LoadLibraryA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "DeleteCriticalSection"; File: "WinKeyServer.exe") Found reference to API (Indicator: "GetCPInfo"; File: "WinKeyServer.exe") Found reference to API (Indicator: "MultiByteToWideChar"; File: "WinKeyServer.exe") Found reference to API (Indicator: "TlsFree"; File: "WinKeyServer.exe") Found reference to API (Indicator: "WaitForSingleObject"; File: "WinKeyServer.exe") Found reference to API (Indicator: "GetCurrentThreadId"; File: "WinKeyServer.exe") Found reference to API (Indicator: "CreateSemaphoreW"; File: "WinKeyServer.exe") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; File: "WinKeyServer.exe") Found reference to API (Indicator: "VirtualProtect"; File: "WinKeyServer.exe") Found reference to API (Indicator: "ReleaseSemaphore"; File: "WinKeyServer.exe") Found reference to API (Indicator: "SetLastError"; File: "WinKeyServer.exe") Found reference to API (Indicator: "TlsGetValue"; File: "WinKeyServer.exe") Found reference to API (Indicator: "ExitProcess"; File: "WinKeyServer.exe") Found reference to API (Indicator: "FindNextFileA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "Sleep"; File: "WinKeyServer.exe") Found reference to API (Indicator: "GetCommandLineA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "VirtualQuery"; File: "WinKeyServer.exe") Found reference to API (Indicator: "TlsAlloc"; File: "WinKeyServer.exe") Found reference to API (Indicator: "TlsSetValue"; File: "WinKeyServer.exe") Found reference to API (Indicator: "CloseHandle"; File: "WinKeyServer.exe") Found reference to API (Indicator: "CreateThread"; File: "WinKeyServer.exe") Found reference to API (Indicator: "InterlockedIncrement"; File: "WinKeyServer.exe") Found reference to API (Indicator: "LeaveCriticalSection"; File: "WinKeyServer.exe") Found reference to API (Indicator: "GetLastError"; File: "WinKeyServer.exe") Found reference to API (Indicator: "InitializeCriticalSection"; File: "WinKeyServer.exe") Found reference to API (Indicator: "GetModuleHandleA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "FindClose"; File: "WinKeyServer.exe") Found reference to API (Indicator: "CreateSemaphoreA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "FindFirstFileA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "FreeLibrary"; File: "WinKeyServer.exe") Found reference to API (Indicator: "GetProcAddress"; File: "WinKeyServer.exe") Found reference to API (Indicator: "CreateMutexA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "InterlockedDecrement"; File: "WinKeyServer.exe") Found reference to API (Indicator: "ReleaseMutex"; File: "WinKeyServer.exe") Found reference to API (Indicator: "InterlockedExchange"; File: "WinKeyServer.exe") Found reference to API (Indicator: "EnterCriticalSection"; File: "WinKeyServer.exe") Found reference to API (Indicator: "WideCharToMultiByte"; File: "WinKeyServer.exe") Found reference to API (Indicator: "SetWindowsHookExA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "DispatchMessageA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "UnhookWindowsHookEx"; File: "WinKeyServer.exe") Found reference to API (Indicator: "SendInput"; File: "WinKeyServer.exe") Found reference to API (Indicator: "TranslateMessage"; File: "WinKeyServer.exe") Found reference to API (Indicator: "CallNextHookEx"; File: "WinKeyServer.exe") Found reference to API (Indicator: "GetMessageA"; File: "WinKeyServer.exe") Found reference to API (Indicator: "CloseHandle"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "CreateMutexA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "CreateSemaphoreW"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "CreateThread"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "DeleteCriticalSection"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "EnterCriticalSection"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "ExitProcess"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "FindClose"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "FindFirstFileA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "FindNextFileA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "FreeLibrary"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "GetCPInfo"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "GetCommandLineA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "GetCurrentThreadId"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "GetLastError"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "GetModuleHandleA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "GetProcAddress"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "InitializeCriticalSection"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "InterlockedDecrement"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "InterlockedExchange"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "InterlockedIncrement"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "LeaveCriticalSection"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "LoadLibraryA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "MultiByteToWideChar"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "ReleaseMutex"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "ReleaseSemaphore"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "SetLastError"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "SetUnhandledExceptionFilter"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "Sleep"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "TlsAlloc"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "TlsFree"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "TlsGetValue"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "TlsSetValue"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "VirtualProtect"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "VirtualQuery"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "WaitForSingleObject"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API (Indicator: "WideCharToMultiByte"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "CallNextHookEx"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "DispatchMessageA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "GetMessageA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "SendInput"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "SetWindowsHookExA"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "TranslateMessage"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp") Found reference to API (Indicator: "UnhookWindowsHookEx"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp")29:T5e2,Found reference to API "SetLastError" (Indicator: "SetLastError"; File: "WinKeyServer.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; File: "WinKeyServer.exe") Found reference to API "-GetLastError@0" (Indicator: "GetLastError"; File: "WinKeyServer.exe") Found reference to API "-SetLastError@4" (Indicator: "SetLastError"; File: "WinKeyServer.exe") Found reference to API "IGetLastError@0" (Indicator: "GetLastError"; File: "WinKeyServer.exe") Found reference to API "ISetLastError@4" (Indicator: "SetLastError"; File: "WinKeyServer.exe") Found reference to API "GetLastError" (Indicator: "GetLastError"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API "SetLastError" (Indicator: "SetLastError"; Source: "00000000-00009888.00000001.156502.004FB000.00000004.mdmp, 00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API "-GetLastError@0" (Indicator: "GetLastError"; Source: "00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API "-SetLastError@4" (Indicator: "SetLastError"; Source: "00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API "IGetLastError@0" (Indicator: "GetLastError"; Source: "00000000-00009888.00000002.158419.004FE000.00000002.mdmp") Found reference to API "ISetLastError@4" (Indicator: "SetLastError"; Source: "00000000-00009888.00000002.158419.004FE000.00000002.mdmp")2a:T59e,"WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\SEGMENT HEAP"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CONHOST.EXE"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER\BAM"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\STATESEPARATION\REDIRECTIONMAP\KEYS"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SAFEBOOT\OPTION"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "OPEN"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SRP\GP\DLL"; Key: ""; Value: "")2b:Tb25,"WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "ACP"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\NLS\CODEPAGE"; Key: "OEMCP"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RAISEEXCEPTIONONPOSSIBLEDEADLOCK"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\SESSION MANAGER"; Key: "RESOURCEPOLICIES"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "57A6ED1A-79F7-5011-B242-4784E5620CF7"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: "WINKEYSERVER.EXE"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\MICROSOFT\WOW64\X86"; Key: ""; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\SERVICES\BAM\STATE\USERSETTINGS\S-1-5-21-1271187874-1938232448-3812392235-1001"; Key: "\DEVICE\HARDDISKVOLUME3\WINDOWS\SYSTEM32\CONHOST.EXE"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "3C74AFB9-8D82-44E3-B52C-365DBF48382A"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "B749553B-D950-5E03-6282-3145A61B1002"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "05F95EFE-7F75-49C7-A994-60A55CC09571"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSAPPCOMPAT"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\TERMINAL SERVER"; Key: "TSUSERENABLED"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\POLICIES\MICROSOFT\WINDOWS\SAFER\CODEIDENTIFIERS"; Key: "TRANSPARENTENABLED"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\FILESYSTEM"; Key: "LONGPATHSENABLED"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "8CCCA27D-F1D8-4DDA-B5DD-339AEE937731"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "LOGFLAGS"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SYSTEM\CONTROLSET001\CONTROL\WMI\SECURITY"; Key: "18608E62-A628-49D9-8C02-55972E097D24"; Value: "") "WinKeyServer.exe" (Access type: "QUERYVAL"; Path: "HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS NT\CURRENTVERSION\APPCOMPATFLAGS"; Key: "SHOWDEBUGINFO"; Value: "")2c:T46c,"WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\apphelp.dll" "WinKeyServer.exe" trying to touch file "C:\WinKeyServer.exe" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\ntdll.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\kernel32.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\KernelBase.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\apppatch\sysmain.sdb" "WinKeyServer.exe" trying to touch file "C:\Windows\apppatch\MergeSdbFilesSource\sysMerge.sdb" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\msvcrt.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\win32u.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\ucrtbase.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\msvcp_win.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\gdi32full.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\gdi32.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\user32.dll" "WinKeyServer.exe" trying to touch file "C:\Windows\SysWOW64\imm32.dll"2d:T7d7,"WinKeyServer.exe" called "FindFirstFileA" with parameter C:\* (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter $Recycle.Bin (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter $WinREAgent (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter Config.Msi (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter Documents and Settings (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter DumpStack.log.tmp (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter hiberfil.sys (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter MSOCache (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter pagefile.sys (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter PerfLogs (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter Program Files (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter Program Files (x86) (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter ProgramData (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter Recovery (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter swapfile.sys (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter System Volume Information (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter tempdir (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter Users (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter Windows (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter WinKeyServer.exe (UID: 00000000-00009888) "WinKeyServer.exe" called "FindNextFileA" with parameter Ìÿs (UID: 00000000-00009888)2e:T723,Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetDC"; Source: "00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp") Found reference to API "" (Indicator: "GetWindowDC"; Source: "00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateDC"; Source: "00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleBitmap"; Source: "00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp") Found reference to API "" (Indicator: "BitBlt"; Source: "00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp") Found reference to API "" (Indicator: "CreateCompatibleDC"; Source: "00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp")1b:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$23"}}],["$","$L24",null,{"initialData":{"schema_version":"1.0.15","sha256":"e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1","overall_status":"SUCCESS","all_analysis_status":{"qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS","fastscan_status":"SUCCESS"},"verdict":"malicious","threat_score":51,"unified_at_epoch_ms":1790517679510,"unified_at":"2026-09-27T14:01:19.510Z","metadata":{"hashes":{"sha256":"e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1","sha1":"b92e65289ab5eea664a5d3d0ac744bd0a005ce25","md5":"90332d03fc2475ab6206873e9f4d5a4a","sha512":"6509838afef24ebe8b75b20fcc8b61de00051c927a700c6f93ed7146d03e9f0bad60139fe6687ef810d4167a816ecc5ab98ab3bba417bdbaebf9a814ac43d43a","ssdeep":"24576:YphW5rJBRQIoNRE8MhiVEQTxB0o0WatZbcPJuQ5/313XX:YpcJJYIqK8JcQ","ssdeep_chunks":["24576:YphW5rJ","24576:phW5rJB","24576:hW5rJBR","24576:W5rJBRQ","24576:5rJBRQI","24576:rJBRQIo","24576:JBRQIoN","24576:BRQIoNR","24576:RQIoNRE","24576:QIoNRE8","24576:IoNRE8M","24576:oNRE8Mh","24576:NRE8Mhi","24576:RE8MhiV","24576:E8MhiVE","24576:8MhiVEQ","24576:MhiVEQT","24576:hiVEQTx","24576:iVEQTxB","24576:VEQTxB0","24576:EQTxB0o","24576:QTxB0o0","24576:TxB0o0W","24576:xB0o0Wa","24576:B0o0Wat","24576:0o0WatZ","24576:o0WatZb","24576:0WatZbc","24576:WatZbcP","24576:atZbcPJ","24576:tZbcPJu","24576:ZbcPJuQ","24576:bcPJuQ5","24576:cPJuQ5/","24576:PJuQ5/3","24576:JuQ5/31","24576:uQ5/313","24576:Q5/313X","24576:5/313XX","49152:YphW5rJ","49152:phW5rJB","49152:hW5rJBR","49152:W5rJBRQ","49152:5rJBRQI","49152:rJBRQIo","49152:JBRQIoN","49152:BRQIoNR","49152:RQIoNRE","49152:QIoNRE8","49152:IoNRE8M","49152:oNRE8Mh","49152:NRE8Mhi","49152:RE8MhiV","49152:E8MhiVE","49152:8MhiVEQ","49152:MhiVEQT","49152:hiVEQTx","49152:iVEQTxB","49152:VEQTxB0","49152:EQTxB0o","49152:QTxB0o0","49152:TxB0o0W","49152:xB0o0Wa","49152:B0o0Wat","49152:0o0WatZ","49152:o0WatZb","49152:0WatZbc","49152:WatZbcP","49152:atZbcPJ","49152:tZbcPJu","49152:ZbcPJuQ","49152:bcPJuQ5","49152:cPJuQ5/","49152:PJuQ5/3","49152:JuQ5/31","49152:uQ5/313","49152:Q5/313X","49152:5/313XX","24576:YpcJJYI","24576:pcJJYIq","24576:cJJYIqK","24576:JJYIqK8","24576:JYIqK8J","24576:YIqK8Jc","24576:IqK8JcQ"],"imphash":"b66d075cb4bd6229ec9dd578c97df9ee"},"file_info":{"file_name":"WinKeyServer.exe","file_type":["peexe","executable"],"file_type_id":"exe","file_size":2335291,"is_container_sample":false,"url_analysis":false},"submissions":{"first_seen":1741991845000,"last_seen":1759055400000,"last_multi_scan":1759055400000}},"detections":{"summary":{"verdict":"malicious","score":51,"tags":["analysis"]},"stats":{"av":{"malicious_count":8,"suspicious_count":0,"total_engines":28},"attributions":{"malware_families_count":1,"threat_actors_count":0,"campaigns_count":0,"threat_types_count":0,"cves_count":0},"mitre_attacks":{"total":35},"sandbox_signatures":{"informative_count":64,"suspicious_count":7,"malicious_count":1,"total":72},"rule_matches":{"yara_count":0,"sigma_count":0,"suricata_count":0}},"av_detections":{"engines":{"ahnlab":{"name":"AhnLab","success":true,"verdict":"malicious","threat_name":"Unwanted/Win.Agent","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"antiy":{"name":"Antiy","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"avira":{"name":"Avira","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"bitdefender":{"name":"Bitdefender","success":true,"verdict":"malicious","threat_name":"Application.Keylogger.RBE","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"clamav":{"name":"ClamAV","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"cmc":{"name":"CMC","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"comodo":{"name":"Comodo","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"crowdstrike":{"name":"CrowdStrike","success":true,"verdict":"malicious","threat_name":"win/malicious_confidence_100% (W)","status":"malicious","progress":100,"data_source":"CrowdStrike","permalink":"https://www.crowdstrike.com/en-us/platform/endpoint-security/"},"cylance":{"name":"Cylance","success":true,"verdict":"malicious","threat_name":"Malware_-10","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"emsisoft":{"name":"Emsisoft","success":true,"verdict":"malicious","threat_name":"Application.Keylogger.RBE (B)","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"eset":{"name":"ESET","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"filseclab":{"name":"Filseclab","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"gridinsoft":{"name":"Gridinsoft","success":true,"verdict":"malicious","threat_name":"Trojan.Win32.Phonzy.cl","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"huorong":{"name":"Huorong","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"k7":{"name":"K7","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"lionic":{"name":"Lionic","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"mcafee":{"name":"McAfee","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"nanoav":{"name":"NANOAV","success":true,"verdict":"malicious","threat_name":"Riskware.Win32.KeyLogger.kyqmms","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"netgate":{"name":"NETGATE","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"rocketcyber":{"name":"RocketCyber","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"scrutiny":{"name":"Scrutiny","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"sophos":{"name":"Sophos","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"tachyon":{"name":"TACHYON","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"varist":{"name":"Varist","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"viritexplorer":{"name":"Vir.IT eXplorer","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"virusblokada":{"name":"VirusBlokAda","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"webrootsmd":{"name":"Webroot SMD","success":true,"verdict":"undetected","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"},"zillya":{"name":"Zillya!","success":true,"verdict":"malicious","threat_name":"Tool.KeyLogger.Win32.3472","progress":100,"data_source":"MetaDefender","permalink":"https://www.opswat.com/products/metadefender?utm_campaign=Technology%+Partners&utm_source=HA"}}},"rule_matches":{},"attributions":{"malware_families":[{"value":"Application.Keylogger","sources":[{"report_type":"quickscan","report_id":""}]}]},"mitre_attacks":[{"tactic":"Execution","technique":"Native API","attack_id":"T1106","attack_id_wiki":"https://attack.mitre.org/techniques/T1106","identifiers":[{"type":"informative","value":"Imports GetCommandLine API"},{"type":"informative","value":"Contains ability to load modules (API string)"},{"type":"informative","value":"Contains ability to execute Windows APIs"},{"type":"informative","value":"Contains ability to retrieve/modify process thread (API string)"},{"type":"informative","value":"Contains ability to dynamically load libraries"},{"type":"informative","value":"Contains ability to set/get the last-error code for a calling thread (API string)"},{"type":"informative","value":"Contains ability to retrieve address of exported function from a DLL (API string)"},{"type":"informative","value":"Calls an API typically used to retrieve function addresses"},{"type":"suspicious","value":"Imports suspicious APIs"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Execution","technique":"Shared Modules","attack_id":"T1129","attack_id_wiki":"https://attack.mitre.org/techniques/T1129","identifiers":[{"type":"informative","value":"Loads modules at runtime"},{"type":"informative","value":"Calls an API typically used to load libraries"},{"type":"informative","value":"Loads the RPC (Remote Procedure Call) module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Execution","technique":"Windows Command Shell","attack_id":"T1059.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1059/003","identifiers":[{"type":"informative","value":"Contains ability to retrieve the command-line string for the current process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Persistence","technique":"Windows Service","attack_id":"T1543.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1543/003","identifiers":[{"type":"informative","value":"Contains ability to access device drivers"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"tactic":"Privilege Escalation","technique":"Dynamic-link Library Injection","attack_id":"T1055.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/001","identifiers":[{"type":"informative","value":"Contains ability to load/free library (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Privilege Escalation","technique":"Thread Execution Hijacking","attack_id":"T1055.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/003","identifiers":[{"type":"informative","value":"Creates a thread in a self process"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Privilege Escalation","technique":"Extra Window Memory Injection","attack_id":"T1055.011","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/011","identifiers":[{"type":"suspicious","value":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Privilege Escalation","technique":"Process Injection","attack_id":"T1055","attack_id_wiki":"https://attack.mitre.org/techniques/T1055","identifiers":[{"type":"informative","value":"Contains ability to inject code into another process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Privilege Escalation","technique":"Thread Local Storage","attack_id":"T1055.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/005","identifiers":[{"type":"suspicious","value":"Found TLS callbacks"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Embedded Payloads","attack_id":"T1027.009","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/009","identifiers":[{"type":"suspicious","value":"Section contains high entropy"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Software Packing","attack_id":"T1027.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/002","identifiers":[{"type":"suspicious","value":"PE file contains unusual section name"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Time Based Evasion","attack_id":"T1497.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/003","identifiers":[{"type":"informative","value":"Contains ability to delay the execution of current thread"},{"type":"informative","value":"Contains ability to delay execution by waiting for signal/timeout (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Debugger Evasion","attack_id":"T1622","attack_id_wiki":"https://attack.mitre.org/techniques/T1622","identifiers":[{"type":"informative","value":"Contains ability to register a top-level exception handler (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"User Activity Based Checks","attack_id":"T1497.002","attack_id_wiki":"https://attack.mitre.org/techniques/T1497/002","identifiers":[{"type":"informative","value":"Able to identify virtual environment by using user activity (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Obfuscated Files or Information","attack_id":"T1027","attack_id_wiki":"https://attack.mitre.org/techniques/T1027","identifiers":[{"type":"informative","value":"PE file contains zero-size sections"},{"type":"informative","value":"Matched Compiler/Packer signature (DIE)"},{"type":"informative","value":"PE file contains zero-sized sections"},{"type":"informative","value":"Shows ability to obfuscate file or information"},{"type":"informative","value":"Loads the Bcrypt module DLL"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Dynamic API Resolution","attack_id":"T1027.007","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/007","identifiers":[{"type":"informative","value":"Contains ability to dynamically determine API calls"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Indicator Removal from Tools","attack_id":"T1027.005","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/005","identifiers":[{"type":"informative","value":"Contains XOR operation loops [Stream disassembly]"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Encrypted/Encoded File","attack_id":"T1027.013","attack_id_wiki":"https://attack.mitre.org/techniques/T1027/013","identifiers":[{"type":"suspicious","value":"YARA signature match – detects packer/protector"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"tactic":"Defense Evasion","technique":"Execution Guardrails","attack_id":"T1480","attack_id_wiki":"https://attack.mitre.org/techniques/T1480","identifiers":[{"type":"informative","value":"Shows ability to use execution guardrails"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Deobfuscate/Decode Files or Information","attack_id":"T1140","attack_id_wiki":"https://attack.mitre.org/techniques/T1140","identifiers":[{"type":"informative","value":"Shows ability to deobfuscate/decode files or information"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Credential Access","technique":"OS Credential Dumping","attack_id":"T1003","attack_id_wiki":"https://attack.mitre.org/techniques/T1003","identifiers":[{"type":"informative","value":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"tactic":"Credential Access","technique":"Keylogging","attack_id":"T1056.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1056/001","identifiers":[{"type":"informative","value":"Contains ability to hook/unhook windows functions (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Discovery","technique":"System Information Discovery","attack_id":"T1082","attack_id_wiki":"https://attack.mitre.org/techniques/T1082","identifiers":[{"type":"informative","value":"Contains ability to retrieve a module handle (API string)"},{"type":"informative","value":"Contains ability to retrieve data about the local computer (API string)"},{"type":"informative","value":"Reads information about supported languages"},{"type":"malicious","value":"Contains ability to check the local/global descriptor table"},{"type":"informative","value":"Calls an API typically used to get product type"},{"type":"informative","value":"Calls an API typically used to get system version information"},{"type":"informative","value":"Contains reference to mutex-related activity (API string)"},{"type":"informative","value":"Contains ability to retrieve the OS information (API string)"},{"type":"informative","value":"Contains ability to read software policies"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Discovery","technique":"File and Directory Discovery","attack_id":"T1083","attack_id_wiki":"https://attack.mitre.org/techniques/T1083","identifiers":[{"type":"informative","value":"Calls an API typically used for searching a directory for files"},{"type":"informative","value":"Tries to access non-existent files (executable)"},{"type":"informative","value":"Contains ability to enumerate files on disk (API string)"},{"type":"informative","value":"Touches files"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Discovery","technique":"Query Registry","attack_id":"T1012","attack_id_wiki":"https://attack.mitre.org/techniques/T1012","identifiers":[{"type":"informative","value":"Opens registry keys"},{"type":"informative","value":"Queries registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Discovery","technique":"Process Discovery","attack_id":"T1057","attack_id_wiki":"https://attack.mitre.org/techniques/T1057","identifiers":[{"type":"informative","value":"Queries basic information of the specified process"},{"type":"suspicious","value":"Queries process information"},{"type":"informative","value":"Contains ability to enumerate process and/or its information (API string)"},{"type":"informative","value":"Calls an API typically used for taking snapshot of the specified processes"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Discovery","technique":"System Service Discovery","attack_id":"T1007","attack_id_wiki":"https://attack.mitre.org/techniques/T1007","identifiers":[{"type":"informative","value":"Queries services related registry keys"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Discovery","technique":"System Language Discovery","attack_id":"T1614.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1614/001","identifiers":[{"type":"informative","value":"Reads the windows installation language"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Command and Control","technique":"Application Layer Protocol","attack_id":"T1071","attack_id_wiki":"https://attack.mitre.org/techniques/T1071","identifiers":[{"type":"informative","value":"Found potential URL in binary/memory"},{"type":"informative","value":"Found potential URLs in memory dumps"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Command and Control","technique":"Encrypted Channel","attack_id":"T1573","attack_id_wiki":"https://attack.mitre.org/techniques/T1573","identifiers":[{"type":"informative","value":"Possibly tries to communicate over SSL connection (HTTPS)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Command and Control","technique":"Symmetric Cryptography","attack_id":"T1573.001","attack_id_wiki":"https://attack.mitre.org/techniques/T1573/001","identifiers":[{"type":"informative","value":"Shows ability to use encryption for command and control traffic"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Impact","technique":"Service Stop","attack_id":"T1489","attack_id_wiki":"https://attack.mitre.org/techniques/T1489","identifiers":[{"type":"informative","value":"Contains ability to terminate a process (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Privilege Escalation","technique":"ListPlanting","attack_id":"T1055.015","attack_id_wiki":"https://attack.mitre.org/techniques/T1055/015","identifiers":[{"type":"informative","value":"Able to visualize and control listed components (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Defense Evasion","technique":"Hidden Window","attack_id":"T1564.003","attack_id_wiki":"https://attack.mitre.org/techniques/T1564/003","identifiers":[{"type":"informative","value":"Contains ability to pass information to a window procedure (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"tactic":"Collection","technique":"Screen Capture","attack_id":"T1113","attack_id_wiki":"https://attack.mitre.org/techniques/T1113","identifiers":[{"type":"informative","value":"Contains ability to capture screen (API string)"}],"sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]}],"sandbox_signatures":[{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to delay execution by waiting for signal/timeout (API string)","description":"$25","origin":"File/Memory","mitre_attack_id":"T1497.003","relevance":1,"id":"string-226","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to inject code into another process (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WinKeyServer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055","relevance":1,"id":"string-92","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Anti-Detection/Stealthiness","name":"Contains ability to load/free library (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WinKeyServer.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; File: \"WinKeyServer.exe\")\n Found reference to API \"FreeLibrary\" (Indicator: \"FreeLibrary\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.001","relevance":1,"id":"string-318","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"Contains ability to register a top-level exception handler (API string)","description":"Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"SetUnhandledExceptionFilter\"; File: \"WinKeyServer.exe\")\n Found reference to API \"SetUnhandledExceptionFilter\" (Indicator: \"UnhandledExceptionFilter\"; File: \"WinKeyServer.exe\")","origin":"File/Memory","mitre_attack_id":"T1622","relevance":1,"id":"string-148","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-sized sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"level":"informative","category":"Cryptographic Related","name":"Contains XOR operation loops [Stream disassembly]","description":"$26","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1027.005","id":"stream-139","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to deobfuscate/decode files or information","description":"The analysis shows use of encryption and can be used to decode file or information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1140","relevance":1,"id":"summary-32","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to obfuscate file or information","description":"The analysis contains indicators for cyrpto or data obfuscation(base64/decrypt) which can hide information. Matched sigs: Contains XOR operation loops [Stream disassembly]","origin":"Indicator Combinations","mitre_attack_id":"T1027","relevance":1,"id":"summary-28","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Cryptographic Related","name":"Shows ability to use encryption for command and control traffic","description":"The analysis shows use of encryption\n use of http/https that can be used to send encrypted data on command and control server. Matched sigs: Contains XOR operation loops [Stream disassembly]\n Matched sigs: Found potential URL in binary/memory\n Matched sigs: Found potential URLs in memory dumps\n Matched sigs: Possibly tries to communicate over SSL connection (HTTPS)","origin":"Indicator Combinations","mitre_attack_id":"T1573.001","relevance":1,"id":"summary-31","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Environment Awareness","name":"Able to identify virtual environment by using user activity (API string)","description":"Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"WinKeyServer.exe\")\n Found string \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1497.002","relevance":1,"id":"string-661","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Environment Awareness","name":"Attempts to invoke APIs commonly associated with credential theft and data exfiltration functionality","description":"\"WinKeyServer.exe\" called \"NtQueryInformationToken\" with parameters (UID: 00000000-00009888)","origin":"API Call","mitre_attack_id":"T1003","relevance":3,"id":"api-297","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get product type","description":"\"WinKeyServer.exe\" called \"RtlGetNtProductType\" with parameter 01000000 (UID: 00000000-00009888)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-124","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"level":"informative","category":"Environment Awareness","name":"Calls an API typically used to get system version information","description":"\"WinKeyServer.exe\" called \"RtlGetVersion\" with parameter 140100000a000000000000005d5800000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 (UID: 00000000-00009888)","origin":"API Call","mitre_attack_id":"T1082","relevance":3,"id":"api-125","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to read software policies","description":"\"WinKeyServer.exe\" (Path: \"HKLM\\SOFTWARE\\POLICIES\\MICROSOFT\\WINDOWS\\SAFER\\CODEIDENTIFIERS\"; Key: \"TRANSPARENTENABLED\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":1,"id":"registry-78","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Environment Awareness","name":"Contains ability to retrieve the OS information (API string)","description":"Found reference to API \"tlGetVersion\" (Indicator: \"GetVersion\"; Source: \"00000000-00009888.00000000.154581.00930000.00000004.mdmp, 00000000-00009888.00000002.158419.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-171","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Calls an API typically used to load libraries","description":"\"WinKeyServer.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-synch-l1-2-0 (UID: 00000000-00009888)\n \"WinKeyServer.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-fibers-l1-1-1 (UID: 00000000-00009888)\n \"WinKeyServer.exe\" called \"LoadLibrary\" with a parameter api-ms-win-core-localization-l1-2-1 (UID: 00000000-00009888)\n \"WinKeyServer.exe\" called \"LoadLibrary\" with a parameter kernel32 (UID: 00000000-00009888)","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-175","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Calls an API typically used to retrieve function addresses","description":"$27","origin":"API Call","mitre_attack_id":"T1106","relevance":1,"id":"api-176","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Contains ability to delay the execution of current thread","description":"Sleep@KERNEL32.dll at 6300-5820-0041CFE0","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1497.003","relevance":3,"id":"stream-103","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically determine API calls","description":"Found GetProcAddress() and LoadLibraryA() in an import section (Source: WinKeyServer.exe)","origin":"Static Parser","mitre_attack_id":"T1027.007","relevance":1,"id":"static-79","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Contains ability to dynamically load libraries","description":"LoadLibraryA@KERNEL32.dll at 6300-8768-00401330\n LoadLibraryA@KERNEL32.dll at 6300-8770-0041D010","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1106","relevance":3,"id":"stream-108","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Contains ability to execute Windows APIs","description":"$28","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-101","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve the command-line string for the current process (API string)","description":"Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; File: \"WinKeyServer.exe\")\n Found reference to API \"GetCommandLineA\" (Indicator: \"GetCommandLine\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1059.003","relevance":1,"id":"string-206","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Contains ability to retrieve/modify process thread (API string)","description":"Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; File: \"WinKeyServer.exe\")\n Found reference to API \"CreateThread\" (Indicator: \"CreateThread\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-161","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Contains ability to set/get the last-error code for a calling thread (API string)","description":"$29","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-319","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Contains export functions","description":"\"WinKeyServer.exe\" contains export function called \"_Z10MouseEventijl@12\" at ordinal 1\n \"WinKeyServer.exe\" contains export function called \"_Z13KeyboardEventijl@12\" at ordinal 2","origin":"Static Parser","relevance":1,"id":"static-78","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Loads modules at runtime","description":"\"WinKeyServer.exe\" loaded module \"API-MS-WIN-CORE-SYNCH-L1-2-0\" at base 76c70000\n \"WinKeyServer.exe\" loaded module \"API-MS-WIN-CORE-FIBERS-L1-1-1\" at base 76c70000\n \"WinKeyServer.exe\" loaded module \"API-MS-WIN-CORE-LOCALIZATION-L1-2-1\" at base 76c70000\n \"WinKeyServer.exe\" loaded module \"KERNEL32\" at base 76a30000\n \"WinKeyServer.exe\" loaded module \"%WINDIR%\\TEMP\\VXOLE32.DLL\" at base 733f0000","origin":"API Call","mitre_attack_id":"T1129","relevance":1,"id":"api-7","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Loads the RPC (Remote Procedure Call) module DLL","description":"\"WinKeyServer.exe\" loaded module \"%WINDIR%\\SysWOW64\\rpcrt4.dll\" at 77380000","origin":"Loaded Module","mitre_attack_id":"T1129","id":"module-10","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Matched Compiler/Packer signature (DIE)","description":"\"WinKeyServer.exe\" was detected as \"GNU linker ld (GNU Binutils)\" and name: \"Linker\"","origin":"Static Parser","mitre_attack_id":"T1027","id":"static-157","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"PE file contains executable sections","description":"\"WinKeyServer.exe\" has an executable section named \".text\"","origin":"Static Parser","relevance":1,"id":"static-80","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"PE file contains writable sections","description":"\"WinKeyServer.exe\" has an writable section named \".data\"\n \"WinKeyServer.exe\" has an writable section named \".bss\"\n \"WinKeyServer.exe\" has an writable section named \".idata\"\n \"WinKeyServer.exe\" has an writable section named \".CRT\"\n \"WinKeyServer.exe\" has an writable section named \".tls\"","origin":"Static Parser","id":"static-95","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"PE file entrypoint instructions","description":"\"WinKeyServer.exe\" file has an entrypoint instructions - \"sub\tesp, 0x1c,mov\tdword ptr [esp], 1,call\tdword ptr [0x4fb334],call\t0x4011a0,lea\tesi, [esi],lea\tesi, [esi],sub\tesp, 0x1c,mov\tdword ptr [esp], 2,call\tdword ptr [0x4fb334],call\t0x4011a0,lea\tesi, [esi],lea\tesi, [esi],jmp\tdword ptr [0x4fb370],lea\tesi, [esi],lea\tesi, [esi],jmp\tdword ptr [0x4fb35c],nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,nop\t,push\tebp,mov\tebp, esp,push\tesi,\"","origin":"Static Parser","id":"static-96","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Possibly uses system binaries (Windows LOLbins)","description":"Observed system executable string:\"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" [Source: 00000000-00009888-00000BC0-1404057052]","origin":"File/Memory","relevance":1,"id":"string-170","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"level":"informative","category":"General","name":"Reads information about supported languages","description":"\"WinKeyServer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EMPTY\")\n \"WinKeyServer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\CUSTOMLOCALE\"; Key: \"EN-US\")\n \"WinKeyServer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\EXTENDEDLOCALE\"; Key: \"EN-US\")","origin":"Registry Access","mitre_attack_id":"T1082","relevance":3,"id":"registry-25","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Uses 32 bit executable PE","description":"\"WinKeyServer.exe\" has flags like IMAGE_FILE_32BIT_MACHINE\n IMAGE_FILE_EXECUTABLE","origin":"Static Parser","id":"static-153","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Installation/Persistence","name":"Contains ability to load modules (API string)","description":"Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; File: \"WinKeyServer.exe\")\n Found reference to API \"LoadLibraryA\" (Indicator: \"LoadLibrary\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-310","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Installation/Persistence","name":"Creates a thread in a self process","description":"\"WinKeyServer.exe\" creates a thread in process \"-1\" (Handle: FFFFFFFFFFFFFFFF)","origin":"API Call","mitre_attack_id":"T1055.003","relevance":3,"id":"api-264","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Installation/Persistence","name":"Opens registry keys","description":"$2a","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-177","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries basic information of the specified process","description":"\"WinKeyServer.exe\" queries basic process information of the \"C:\\WinKeyServer.exe\" (UID: 9888)","origin":"API Call","mitre_attack_id":"T1057","relevance":1,"id":"api-235","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Installation/Persistence","name":"Queries registry keys","description":"$2b","origin":"Registry Access","mitre_attack_id":"T1012","relevance":1,"id":"registry-172","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Installation/Persistence","name":"Shows ability to use execution guardrails","description":"The analysis shows indicators which can be used as execution guardrails to ensure that payload only executes against intended targets/system. Matched sigs: Contains ability to delay execution by waiting for signal/timeout (API string)\n Matched sigs: Able to identify virtual environment by using user activity (API string)\n Matched sigs: Contains ability to delay the execution of current thread","origin":"Indicator Combinations","mitre_attack_id":"T1480","relevance":1,"id":"summary-29","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Installation/Persistence","name":"Touches files","description":"$2c","origin":"API Call","mitre_attack_id":"T1083","relevance":1,"id":"api-263","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Installation/Persistence","name":"Tries to access non-existent files (executable)","description":"\"WinKeyServer.exe\" trying to access non-existent file \"C:\\CRYPTSP.DLL\"","origin":"API Call","mitre_attack_id":"T1083","relevance":3,"id":"api-126","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Network Related","name":"Found potential URL in binary/memory","description":"Pattern match: \"https://gcc.gnu.org/bugs/\"","origin":"File/Memory","mitre_attack_id":"T1071","relevance":3,"id":"string-3","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Network Related","name":"Found potential URLs in memory dumps","description":"Found URL \"https://gcc.gnu.org/bugs/):\" - Source: \"00000000-00009888.00000000.154581.004B2000.00000002.mdmp\")","origin":"Memory Dumps","mitre_attack_id":"T1071","relevance":1,"id":"memorydump-2","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Network Related","name":"Possibly tries to communicate over SSL connection (HTTPS)","description":"Found HTTPS url \"https://gcc.gnu.org\"","origin":"File/Memory","mitre_attack_id":"T1573","relevance":1,"id":"string-98","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for searching a directory for files","description":"$2d","origin":"API Call","mitre_attack_id":"T1083","relevance":5,"id":"api-102","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Calls an API typically used for taking snapshot of the specified processes","description":"\"WinKeyServer.exe\" called \"CreateToolhelp32Snapshot\" with parameters {\"dwFlags\": \"4\"\n \"th32ProcessID\": \"0\"}","origin":"API Call","mitre_attack_id":"T1057","relevance":3,"id":"api-103","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate files on disk (API string)","description":"Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; File: \"WinKeyServer.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; File: \"WinKeyServer.exe\")\n Found reference to API \"FindFirstFileA\" (Indicator: \"FindFirstFile\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")\n Found reference to API \"FindNextFileA\" (Indicator: \"FindNextFile\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1083","relevance":1,"id":"string-83","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to enumerate process and/or its information (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WinKeyServer.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1057","relevance":1,"id":"string-85","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve a module handle (API string)","description":"Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; File: \"WinKeyServer.exe\")\n Found reference to API \"GetModuleHandleA\" (Indicator: \"GetModuleHandle\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-427","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve address of exported function from a DLL (API string)","description":"Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; File: \"WinKeyServer.exe\")\n Found reference to API \"GetProcAddress\" (Indicator: \"GetProcAddress\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1106","relevance":1,"id":"string-317","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to retrieve data about the local computer (API string)","description":"Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; File: \"WinKeyServer.exe\")\n Found reference to API \"InterlockedExchange\" (Indicator: \"InterlockedExchange\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":3,"id":"string-115","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Imports GetCommandLine API","description":"Observed import api \"GetCommandLineA\" which can \"retrieve the command-line string for the current process\" [Source: WinKeyServer.exe]","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-88","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"System Security","name":"Contains ability to access device drivers","description":"Found string \"\\Device\\HarddiskVolume3\\Windows\\System32\\conhost.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00009888-00000BC0-1404057052\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"\\drivers\\\"; Source: \"00000000-00009888.00000000.154581.00930000.00000004.mdmp, 00000000-00009888.00000001.156502.00860000.00000004.mdmp, 00000000-00009888.00000002.158419.00860000.00000004.mdmp, 00000000-00009888.00000002.158419.00930000.00000004.mdmp\")\n Found string \"DriverData=C:\\Windows\\System32\\Drivers\\DriverData\" (Indicator: \"system32\\drivers\"; Source: \"00000000-00009888.00000000.154581.00930000.00000004.mdmp, 00000000-00009888.00000001.156502.00860000.00000004.mdmp, 00000000-00009888.00000002.158419.00860000.00000004.mdmp, 00000000-00009888.00000002.158419.00930000.00000004.mdmp\")\n Found string \"\\Device\\HarddiskVolume3\\WinKeyServer.exe\" (Indicator: \"\\Device\\\"; Source: \"00000000-00009888.00000000.154581.00930000.00000004.mdmp, 00000000-00009888.00000002.158419.00930000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1543.003","relevance":1,"id":"string-474","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"level":"informative","category":"System Security","name":"Contains ability to hook/unhook windows functions (API string)","description":"Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; File: \"WinKeyServer.exe\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; File: \"WinKeyServer.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; File: \"WinKeyServer.exe\")\n Found reference to API \"CallNextHookEx\" (Indicator: \"CallNextHook\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")\n Found reference to API \"SetWindowsHookExA\" (Indicator: \"SetWindowsHook\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")\n Found reference to API \"UnhookWindowsHookEx\" (Indicator: \"UnhookWindowsHook\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1056.001","relevance":1,"id":"string-91","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"System Security","name":"Contains ability to terminate a process (API string)","description":"Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; File: \"WinKeyServer.exe\")\n Found reference to API \"ExitProcess\" (Indicator: \"ExitProcess\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1489","relevance":1,"id":"string-316","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"System Security","name":"Queries services related registry keys","description":"\"WinKeyServer.exe\" (Access type: \"QUERYVAL\"; Path: \"HKLM\\SYSTEM\\CONTROLSET001\\SERVICES\\BAM\\STATE\\USERSETTINGS\\S-1-5-21-1271187874-1938232448-3812392235-1001\"; Key: \"\\DEVICE\\HARDDISKVOLUME3\\WINDOWS\\SYSTEM32\\CONHOST.EXE\"; Value: \"\")","origin":"Registry Access","mitre_attack_id":"T1007","relevance":1,"id":"registry-173","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Unusual Characteristics","name":"Contains reference to mutex-related activity (API string)","description":"Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; File: \"WinKeyServer.exe\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; File: \"WinKeyServer.exe\")\n Found reference to API \"CreateMutexA\" (Indicator: \"CreateMutex\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")\n Found reference to API \"ReleaseMutex\" (Indicator: \"ReleaseMutex\"; Source: \"00000000-00009888.00000001.156502.004FB000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1082","relevance":1,"id":"string-354","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Unusual Characteristics","name":"Reads the windows installation language","description":"\"WinKeyServer.exe\" (Path: \"HKLM\\SYSTEM\\CONTROLSET001\\CONTROL\\NLS\\LANGUAGE\"; Key: \"INSTALLLANGUAGEFALLBACK\")","origin":"Registry Access","mitre_attack_id":"T1614.001","relevance":2,"id":"registry-26","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"suspicious","category":"Anti-Detection/Stealthiness","name":"Queries process information","description":"\"WinKeyServer.exe\" queried SystemProcessInformation at 00000000-00009888-00000C15-1404861776 [PID: 9888]\n \"WinKeyServer.exe\" queried SystemProcessInformation at 00000000-00009888-00000C15-1404869296 [PID: 9888]\n \"WinKeyServer.exe\" queried SystemProcessInformation at 00000000-00009888-00000C15-1405123551 [PID: 9888]\n \"WinKeyServer.exe\" queried SystemProcessInformation at 00000000-00009888-00000C15-1405130778 [PID: 9888]","origin":"API Call","mitre_attack_id":"T1057","relevance":4,"id":"api-9","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"suspicious","category":"Anti-Reverse Engineering","name":"Section contains high entropy","description":"\"WinKeyServer.exe\" has section name .text with entropy \"6.292223161817609\"\n \"WinKeyServer.exe\" has section name .reloc with entropy \"6.665883031606093\"\n \"WinKeyServer.exe\" has section name /29 with entropy \"6.113330536855021\"","origin":"Static Parser","mitre_attack_id":"T1027.009","relevance":1,"id":"static-6","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"suspicious","category":"Pattern Matching","name":"YARA signature match – detects packer/protector","description":"YARA signature for packer/protector file \"sample.bin\"","origin":"YARA Signature","mitre_attack_id":"T1027.013","relevance":1,"id":"yara-154","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Found TLS callbacks","description":"\"WinKeyServer.exe\" has a TLS callback with entrypoint at 0x40c860\n \"WinKeyServer.exe\" has a TLS callback with entrypoint at 0x40c810","origin":"Static Parser","mitre_attack_id":"T1055.005","relevance":10,"id":"static-17","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"Imports suspicious APIs","description":"LoadLibraryA\n VirtualProtect\n FindNextFileA\n Sleep\n GetCommandLineA\n CreateThread\n GetModuleHandleA\n FindFirstFileA\n GetProcAddress\n SetWindowsHookExA","origin":"Static Parser","mitre_attack_id":"T1106","relevance":1,"id":"static-1","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"suspicious","category":"Unusual Characteristics","name":"PE file contains unusual section name","description":"\"WinKeyServer.exe\" has a section named \"/4\"\n \"WinKeyServer.exe\" has a section named \".CRT\"\n \"WinKeyServer.exe\" has a section named \"/14\"\n \"WinKeyServer.exe\" has a section named \"/29\"\n \"WinKeyServer.exe\" has a section named \"/41\"\n \"WinKeyServer.exe\" has a section named \"/55\"\n \"WinKeyServer.exe\" has a section named \"/67\"\n \"WinKeyServer.exe\" has a section named \"/80\"\n \"WinKeyServer.exe\" has a section named \"/91\"\n \"WinKeyServer.exe\" has a section named \"/102\"","origin":"Static Parser","mitre_attack_id":"T1027.002","relevance":10,"id":"static-60","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"malicious","category":"Environment Awareness","name":"Contains ability to check the local/global descriptor table","description":"sldt sp at 6300-8666-0041CEB8","origin":"Hybrid Analysis Technology","mitre_attack_id":"T1082","relevance":8,"id":"stream-25","sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"},{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Anti-Detection/Stealthyness","name":"Contains ability to pass information to a window procedure (API string)","description":"Found reference to API \"\" (Indicator: \"CallWindowProc\"; Source: \"00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1564.003","relevance":1,"id":"string-320","sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Anti-Reverse Engineering","name":"PE file contains zero-size sections","description":"Raw size of \".bss\" is zero","origin":"Static Parser","mitre_attack_id":"T1027","relevance":10,"id":"static-5","sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Environment Awareness","name":"Able to visualize and control listed components (API string)","description":"Found reference to API \"\" (Indicator: \"enumchildwindows\"; Source: \"00000000-00005240.00000000.236308.030A0000.00000004.mdmp, 00000000-00005240.00000002.240151.030A0000.00000004.mdmp\")","origin":"File/Memory","mitre_attack_id":"T1055.015","relevance":1,"id":"string-721","sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"General","name":"Loads the Bcrypt module DLL","description":"\"WinKeyServer.exe\" loaded module \"%WINDIR%\\SysWOW64\\bcryptprimitives.dll\" at 75DD0000","origin":"Loaded Module","mitre_attack_id":"T1027","id":"module-9","sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"informative","category":"Spyware/Information Retrieval","name":"Contains ability to capture screen (API string)","description":"$2e","origin":"File/Memory","mitre_attack_id":"T1113","relevance":1,"id":"string-78","sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]},{"level":"suspicious","category":"Installation/Persistence","name":"Found a string that may be used as part of an injection method","description":"\"Shell_TrayWnd\" (Taskbar window class may be used to inject into explorer with the SetWindowLong method) in Source: 00000000-00005240.00000000.236308.03940000.00000002.mdmp\n 00000000-00005240.00000001.238231.03940000.00000002.mdmp\n 00000000-00005240.00000002.240151.03940000.00000002.mdmp\n \"!Progman\" (Program manager) in Source: 00000000-00005240.00000000.236308.03940000.00000002.mdmp\n 00000000-00005240.00000001.238231.03940000.00000002.mdmp\n 00000000-00005240.00000002.240151.03940000.00000002.mdmp","origin":"File/Memory","mitre_attack_id":"T1055.011","relevance":4,"id":"string-4","sources":[{"report_type":"sandbox","report_id":"68019f2ca277a99816038482"}]}],"incidents":[{"name":"Spyware","details_count":1,"details":[{"detail":"Found a string that may be used as part of an injection method"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]},{"name":"Fingerprint","details_count":1,"details":[{"detail":"Queries process information"}],"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}]}]},"activity":{"stats":{"process_count":1,"spawned_processes_count":1,"injected_processes_count":0,"script_calls_count":0,"mutex_created_count":0,"imported_dlls_count":31,"dropped_files_count":0,"extracted_files_count":0,"files_written_count":0,"files_deleted_count":0,"registry_keys_created_count":0,"registry_keys_modified_count":0,"registry_keys_deleted_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":0,"embedded_ips_count":0,"embedded_domains_count":0,"embedded_urls_count":0,"contacted_hosts_count":0,"dns_resolutions_count":0,"contacted_urls_count":0,"http_requests_count":0},"behavior_tags":["analysis"],"sample_flags":["User Comment"],"sandbox_reports":[{"id":"68468b5c31e745622602b60f","environment_id":140,"environment_description":"Windows 11 64 bit","state":"SUCCESS","verdict":"malicious","threat_score":51,"submit_name":"WinKeyServer.exe","analysis_start_time":"2025-06-09T07:21:01+00:00","indicators_count":{"informative":59,"suspicious":8,"malicious":1},"tags":["User Comment"],"is_in_unified_schema":true},{"id":"68019f2ca277a99816038482","environment_id":160,"environment_description":"Windows 10 64 bit","state":"SUCCESS","verdict":"suspicious","threat_score":48,"submit_name":"WinKeyServer.exe","analysis_start_time":"2025-04-18T00:39:09+00:00","indicators_count":{"informative":59,"suspicious":6,"malicious":1},"tags":["User Comment"],"is_in_unified_schema":true}],"network_activity":{"contacted_hosts":null,"dns_resolutions":null,"http_requests":null},"process_activity":{"sources":[{"report_type":"sandbox","report_id":"68468b5c31e745622602b60f"}],"processes":[{"pid":9888,"ppid":0,"name":"WinKeyServer.exe","command_line":"","sha256":"e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1","normalized_path":"C:\\WinKeyServer.exe","uid":"00000000-00009888","icon":"iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAACKElEQVR4Xu2RyW4TURBFvfEcB8f8AiwRv0UAA3E8ZERhSJiHsLCUFZK/gwAmTQYyAMYMhgASn+FNUVWvX3enKk/uTeRISUtHbnlxz73VicTpc+KfRq0CU/XJoUDuhPzzKPA879Bfggv0+/2hcPwKtFotaDabDL3b/y++/AdnX/xF/kBpGXn+G9mH0jPiF4w9RZ78hLHHRA+Kj3pwYWV/YK4q4KK0TMJQysJA2gukxYffofggROZI4hc4dOUPFBK+8P43OEPc+8qMLnVVjkQVcJ3KLjUrHdIllC5+MdwlOgNzVQEX4Wmt0Eq7ESFyp4N8hsJt5NYnlSOJXSBc2TUsdiPCDgtHWYosfISRm8SeypGoAq5TydMWIiuZQIrM78HI3C4zKFcVcBFdqqQknN9l8rM7PtuQn9lWOZLYBQIhUgikdukOyyy56Q+Qm0IaWypHogq4ThVdmichrbRSFm4ZUJqrb0K2tsFIoUQVcEFL7Vnz03alL2SpEWZr65CtIpPvGZkjiV2AVh5YSiutlIQ+mYoHmQlijZE5ElXA9QlyDSMMlloprsxUCF96Yw3S198ZrrWVUKIKuLDSjH/aQMhSKzTSdPktpK4Sb1SOJH4BEvvSNK0MpG1IoTBdbrOQufIaUpeR8VWVI1EFXJ+ATyukLGahla5Ccpx4BclLBimUqAIuzi9smpXlgyuTLA2FUc7NeCpHErvAUXE8CtSrE/wyDOpVLHD6nPjnPyIPUCMAVciHAAAAAElFTkSuQmCC"}],"all_imported_dlls":["shlwapi.dll","cryptsp.dll","kernel32.dll","ucrtbase.dll","VxSSL32.dll","rpcrt4.dll","advapi32.dll","user32.dll","ntdll.dll","wow64.dll","wow64base.dll","wow64cpu.dll","msvcrt.dll","imm32.dll","oleaut32.dll","KernelBase.dll","win32u.dll","gdi32.dll","msvcp_win.dll","ws2_32.dll","fltLib.dll","sechost.dll","ole32.dll","gdi32full.dll","wow64win.dll","wow64con.dll","apphelp.dll","combase.dll","cryptbase.dll","sspicli.dll","bcryptprimitives.dll"]},"file_activity":{"dropped_files":null,"extracted_files":null,"files_written":null,"files_deleted":null},"registry_activity":{"keys_created":null,"keys_modified":null,"keys_deleted":null},"mutex_activity":{"mutex_created":null}},"report_ids":{"sandbox_job_ids":["68468b5c31e745622602b60f","68019f2ca277a99816038482"]}}}]]}] 1e:null 22:[["$","title","0",{"children":"Malicious Application.Keylogger Sample e58864cc22cd… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","1",{"name":"description","content":"Malicious verdict for sample e58864cc22cd…. Malware family: Application.Keylogger. Threat score 51/100. 8/28 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","2",{"name":"robots","content":"index, follow"}],["$","link","3",{"rel":"canonical","href":"https://www.hybrid-analysis.com/sample/e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1"}],["$","meta","4",{"property":"og:title","content":"Malicious Application.Keylogger Sample e58864cc22cd… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","5",{"property":"og:description","content":"Malicious verdict for sample e58864cc22cd…. Malware family: Application.Keylogger. Threat score 51/100. 8/28 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","meta","6",{"property":"og:url","content":"https://www.hybrid-analysis.com/sample/e58864cc22cd8ec17ae35dd810455d604aadab7c3f145b6c53b3c261855a4bb1"}],["$","meta","7",{"name":"twitter:card","content":"summary"}],["$","meta","8",{"name":"twitter:title","content":"Malicious Application.Keylogger Sample e58864cc22cd… — Score 51/100 — Hybrid Analysis | Hybrid Analysis"}],["$","meta","9",{"name":"twitter:description","content":"Malicious verdict for sample e58864cc22cd…. Malware family: Application.Keylogger. Threat score 51/100. 8/28 AV engines flagged this file. 1 malicious and 7 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports."}],["$","link","10",{"rel":"icon","href":"/favicon.svg"}],["$","$L2f","11",{}]]