MALICIOUS — 025d64d22cfe4c1b7161a898aff37a55054b4dc76bd36c1b8246117fa88dfab3

MALICIOUS — 025d64d22cfe4c1b7161a898aff37a55054b4dc76bd36c1b8246117fa88dfab3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Drolnux family. 7 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 025d64d22cfe4c1b7161a898aff37a55054b4dc76bd36c1b8246117fa88dfab3
SHA-1: ad0385285299c9d6b764ac1227342d126a95e0a6
MD5: 50fbf0b2570badb0e53f41e645ef8cd4
imphash: ea28f662ab831803e9a8c823439760d0
ssdeep: 1536:r1Sbpfv5DOWknf7LAQkhB5EQr5PqNzH3EEIMrAgx29E9zt7oymDbHPp3Hc8AOB:IbpfhDOW7hBhr4pX5r9x29E9z5VmDThZ
TLSH: T13E397CAA53261B18F9E1CA96C92D2F2D12036CE963FD05DC6723813395D5CA3107A4F7
Submitted as: 025d64d22cfe4c1b7161a898aff37a55054b4dc76bd36c1b8246117fa88dfab3
File type: pe · Size: 85542 bytes
Verdict: malicious (100/100) · Family: Drolnux

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Worm.Drolnux-6796867-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
Microsoft Defender: Worm:Win32/Drolnux!pz
Emsisoft (Emergency Kit): Trojan.Generic.7930782
Trellix Stinger (McAfee): Generic-FAHD!50FBF0B2570B
Kaspersky (KVRT): Trojan-Ransom.Win32.Blocker.mgn

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Drolnux-6796867-0 (rule Win.Worm.Drolnux-6796867-0) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s) across 3 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.66, confidence 0.90
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 21 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.ibayme.eb2a.com/dwn.dmp, http://www.ibayme.eb2a.com/ad.php, 1.9.0.5 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

125378 behavior events · 3 ATT&CK techniques · 83 dropped files.

Dropped files

C:\Program Files\WindowsApps\Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\Assets\GettingStarted\Reimagine.theme-light.jpg - 77cd3f210a852ccb3c67046126c95750e7335af5073be9126218e1033601010d
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\Focus0_48000Hz.raw - f68442c0ecae1d1d3bd435b25f1507cc74a4582c10f9567cf3e61d10d2d0d991
C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-en-us-onecore_31bf3856ad364e35_10.0.26100.1_none_f8f09a49f1697814\M1033Zira.keyboard.RAD - 47e33f4fa62eb9177512383aabbb6ff75ca7486d8db4dc5d2e26816712073dcc
C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg - e010cdbed55de0c5e76f5431efbb898c8092ca72e3c5a2ad62798956791494ba
C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..ragethelpdiagnostic_31bf3856ad364e35_10.0.26100.1_none_a80d3d319006b4ee.manifest - a4a75456e6b5486dbe0a9bd9b882f0da5d27fa32c8770ae96fd0c0d2fba5e5ec
C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-en-us-onecore_31bf3856ad364e35_10.0.26100.1_none_f8f09a49f1697814\M1033David.keyboard.RAD - c28e46bd33f2129cf37cad01715d1ac24156013a0cf5acd6f94b2053e9116261
C:\Program Files\WindowsApps\Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\Assets\GettingStarted\Image-Creator.theme-light.jpg - 4e22b56d6ce3279571e29d5b642a40e8da80506147631ced5c7fe33bb281c0af
C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.26100.8246_none_fc849c86024680fc\Windows.Devices.Radios.dll - fe507242f22060f86c3bcef4c34473dfe46fd8421b01d2086f4e4447eb0ba900
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\GoBack_48000Hz.raw - b3c5a4d6099c4af9f4d8c3df3b4bef2e9a9193bc8c2ede7544e4c6ab4a618b6e
C:\Program Files\PDF_Reader\PDF_Reader.exe - bd892cc006a9674164c874d6b940adf4fa90d4c40a39d11c45404839ca7ba18c
C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.26100.7920_none_fc37734802807af8\r\Windows.Devices.Radios.dll - b0450f85ceb8c2f01557684133504a0967a3d753b1bf79a6e4979eb6417b6120
C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.8115_none_69a9721261f79982.manifest - 81473a8d4c7eb9d9e769b85aa2d9b77a83df8882530f3eb39756559c5576c376
C:\Program Files\WindowsApps\Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\Assets\GettingStarted\Object-Select.theme-light.jpg - 568b8a2403e727ccafa123c1c624aeb09a0ce8880ae70df9e885f26a1779bdf6
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\Focus2_48000Hz.raw - 57ab9c8a42c55a1a84b3b5e8c7fb15d723bbfb69fafb834002e3228636d8c108
C:\Program Files\PDF_Reader\bin\COM7.EXE - d7c4a89a6ec272ed86d5cffed8a0d21d6884286c19e13aa79ea52da50ffac0b3

Embedded URLs

http://www.ibayme.eb2a.com/dwn.dmp
http://www.ibayme.eb2a.com/ad.php
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787946527&P2=404&P3=2&P4=YfgrEX24JVXQJG71qdS6lj6Z79QQuY3lZyH%2b1Wvljuflp9qdKpPILh7FeJmUTFn119c6uxaTXs1M6hNsTzcmTA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787946572&P2=404&P3=2&P4=IXiAXXHMJicuZhnGcDatTeDUuzgMBvHWMDgeaGQnOG0au8cAv%2buBiJl6hme9jREYnCqC1ZM7CTfccU4LCqdQcQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.ibayme.eb2a.com
s.com

Embedded IP addresses

1.9.0.5
4.150.223.106
4.230.171.124
40.84.85.40
52.253.84.76
74.178.240.61
135.233.95.135
20.184.175.11
52.123.128.14
20.76.201.171
52.123.129.14
74.178.232.29
20.184.175.22
203.26.79.13
172.178.240.162
135.233.45.223
52.148.114.188
57.155.104.224
72.145.35.99
92.223.78.30
52.110.12.10
52.110.12.5

Registry keys

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

File paths

c:\windows\system32\syssh32.dll
C:\RECYCLER\bilbilal.exe
C:\MusicMP3
c:\WINDOWS\system32\shell32.dll

More Drolnux samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report