MALICIOUS — psuser.dll

MALICIOUS — psuser.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (78/100). 1 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 03cc4f4d939170910cd2436d9ac4934ac3279105ca9fa90c3f5a0a65a5f2cd36
SHA-1: 00f84e727af7f7b42625f4366c5199265ba01c63
MD5: 1e00b25cff75e054a747bd3b23d105c4
imphash: 2628f13de1fd5864037ba8ca51ae64b3
ssdeep: 6144:yMRNsqFXAoJSSe9sbmASVIGNKhcNeYHHpy+UrDAO8OnbtvKWpLCuCEy:z3NzmASVIGNKhEFfUrDOOnb1KsCEy
TLSH: T12A494C8916181B63E7768E606D70FF2E01E2B0E52EFD781C0683D53E71A3C874525AB6
Submitted as: psuser.dll
File type: pe · Size: 410968 bytes
Verdict: malicious (78/100)

Detections (1 of 55 engines)

YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

Why this verdict

The malicious score of 78/100 is the fusion of 4 weighted signals:

Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8024) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 30 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

585 behavior events · 1 ATT&CK techniques · 1 dropped files.

Dropped files

C:\ProgramData\Microsoft\EdgeUpdate\Log\MicrosoftEdgeUpdate.log - 67a7f25fd858c709a68ae8fac12e4083cc9ef997676cc5fad13a0336124f61b5

Embedded URLs

https://www.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787642988&P2=404&P3=2&P4=bveIAhph2lvj839CDZFe6t60l1yEs%2fssX4bZAraIkrr1kmpgQy2NuDZGKECsgWRVoQvOZ78K%2fGNVhMqtf54g2A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787643068&P2=404&P3=2&P4=EcoVkbUhDMp9DMZVJXFAi2hqhvlMyqiG92v6Lhc5ZmmPNjhoPUxGwYduwRunnr8BwhtGVKYZxHixUz00noOYhQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

logging.cc
www.microsoft.com
crl.microsoft.com
corp.microsoft.com

Embedded IP addresses

135.232.92.34
20.184.175.21
4.144.132.223
57.155.104.224
4.230.171.124
74.178.76.128
13.89.179.12
20.165.94.54
52.110.12.46
52.110.12.33
20.231.239.246
40.99.134.2
52.123.128.14
52.123.129.14
172.215.188.225
203.26.79.13
20.42.73.26
52.123.252.246
135.234.160.245
52.123.252.195
20.165.94.46
52.123.252.216
52.148.114.188
72.154.7.113
135.233.45.223

Registry keys

HKLM\Software\Microsoft\Windows\CurrentVersion\MicrosoftEdge
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\
HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Microsoft
HKLM\Software\Microsoft\EdgeUpdateDev\
HKLM\Software\Policies\Microsoft\EdgeUpdate\
HKCU\Software\Microsoft\EdgeUpdate\ClientState\
HKLM\Software\Microsoft\EdgeUpdate\ClientState\
HKLM\Software\Microsoft\EdgeUpdate\ClientStateMedium\

File paths

T:\:d:l:t:
X:\:`:h:

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report