MALICIOUS — 0be26482a47e696774686dd19be90ee8220e17c739a85e6b114d4a81d32b3cfc.exe

MALICIOUS — 0be26482a47e696774686dd19be90ee8220e17c739a85e6b114d4a81d32b3cfc.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Kimsuky family. 4 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 0be26482a47e696774686dd19be90ee8220e17c739a85e6b114d4a81d32b3cfc
SHA-1: e92c8aafeeab0389212315343d7d0ba76dfbc5b7
MD5: 841664aa6849f5182429a4442a5a9884
imphash: f6b9641ad162eb50262d3dd2353d2ab2
ssdeep: 196608:aetzdwy/m4vsRkOVsRs9JWBs0sCc+Lp7nWd4m53eoRZAka+zBxdOI15ytRoJZVp:RtRf/LvXQsg8BYRa7WzJwkbzBLH//jp
TLSH: T1286D3367C0EA2150FCB88671BDC43D1CB81266DA64B5462E5A47FDDCAD80ABB327C311
Submitted as: 0be26482a47e696774686dd19be90ee8220e17c739a85e6b114d4a81d32b3cfc.exe
File type: pe · Size: 12720128 bytes
Verdict: malicious (99/100) · Family: Kimsuky

Detections (4 of 55 engines)

capa (capabilities): capability:execution/powershell
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiVM_Sandbox
Kaspersky (KVRT): HEUR:Trojan.Win64.Kimsuky.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 14 weighted signals:

2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in rundll32.exe (pid 1088) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 19 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiVM_Sandbox (rule YR_AntiVM_Sandbox) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
query domain / anti-analysis (rule query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://attach.docucloud.o-r.kr/FreeDownload.php - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

653 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://attach.docucloud.o-r.kr/FreeDownload.php
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787786652&P2=404&P3=2&P4=Asw0jYJJwPrssLALxTtAJIX6L0ZSj9l8ucoNbXsv5RwCzvR56IfqDG%2bmSPDmH%2fo9wXXnsysWGC6niHaRM0XZdg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787786710&P2=404&P3=2&P4=fQYcIHyw0k9LyWb%2b%2bkCaKYg14QRCGVq7jbIXYtKH0akGcsxLjAxNc96SPkngZgHTcN5dw97noa2qM3dGa5VAVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

0.cn
t.se
u.it
3.za
6.it
fr.eu
k.nl
attach.docucloud.o-r.kr

Embedded IP addresses

20.184.175.2
4.230.171.124
40.84.97.4
4.144.132.223
74.178.76.128
74.178.240.51
20.231.239.246
52.123.128.14
85.210.193.152
135.233.95.144
135.234.160.245
52.123.252.231
52.123.252.226
20.165.94.46
203.26.79.13
52.148.114.188
72.145.35.106
52.110.12.42
52.110.12.10

File paths

u:\U
d:\=7
A:\-
o:\l1
p:\fF
c:\windows\system32\rundll32.exe

More Kimsuky samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report