MALICIOUS — 0cc91dbb883a56a5e07b2c4dd41efe87ff24e0c0456259727c800f47a6593c62

MALICIOUS — 0cc91dbb883a56a5e07b2c4dd41efe87ff24e0c0456259727c800f47a6593c62 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepender family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 0cc91dbb883a56a5e07b2c4dd41efe87ff24e0c0456259727c800f47a6593c62
SHA-1: 809c5271657c99fdb6151651fc086e6e2e478224
MD5: a12c4a5313c90216b2c728802952ab46
imphash: 5144a995e58e9a1dec8b8e0e5ed55aec
ssdeep: 12288:cRlfZtcAgTasjEAiaoEdtGEBMgnIi6w4Ovnp00VU3oAos/e320+Tw5ikVV7InFA:+AiaoNInI3si3v5TE5VcnFAEAeU
TLSH: T17853AEDD77097F0FC879AB5E283123AC1D04ECE530AAA85A0685B17217D342371F5A6B
Submitted as: 0cc91dbb883a56a5e07b2c4dd41efe87ff24e0c0456259727c800f47a6593c62
File type: pe · Size: 1064960 bytes
Verdict: malicious (100/100) · Family: Prepender

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Pidgeon.A
Emsisoft (Emergency Kit): Win32.Prepender.Gen.1
Trellix Stinger (McAfee): Flyagent.d
Kaspersky (KVRT): Virus.Win32.Agent.ev

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 19 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_4cab770708 (pid 1592) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Pidgeon.A (rule Virus:Win32/Pidgeon.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Prepender.Gen.1 (rule Win32.Prepender.Gen.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Flyagent.d (rule Flyagent.d) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Agent.ev (rule Virus.Win32.Agent.ev) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com, 1.1.0.3 - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 18 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

78009 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Sysmon64.exe - 7ede01d4b004d6f8c0373479f88ff81234767699c8ebbdb360c66c12c5444e3d
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe.exe - 50cd33a780c733692216d73789340c7aadab08bd73cf6192e0f385e6ee3ccaa6
C:\Users\analyst\AppData\Local\Temp\tsk_4cab770708ee44d0.exe.exe - c4cbef55f6dc2ee947b252c0581301ec363b036cfce05911801ee3dc8187a973
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 0bdb09f1059fa15207b847b1a16665b8b849afce0fbf4ecd9bd0a9b89ce06c55
C:\Program Files\7-Zip\7zG.exe.ico - 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
1756dac44c205572e34f0cca271aee8a87c8e82239e800f6f0f124262173a1cf - 1756dac44c205572e34f0cca271aee8a87c8e82239e800f6f0f124262173a1cf
C:\Program Files\7-Zip\Uninstall.exe.ico - ea0420b60b078a22fdcfd40d86d589793baa2e0327b37dcdcc5399aac4037d4e
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - 97a5be6571eb1a71d8ac6cd7606d1cf1e3e20c18a1cfe468a474fcade746c51c
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe - ce30a53bdeea3820768bb1a1c65e5885279c9946866d96aedd3e2fa0d237b29e
19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b - 19ae4dc6481f738d164b59daa58659ddc4419911089464415840e7ab31e4bf4b
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroTextExtractor.exe - 026dd424830506202f4f7ab0c1e2be793962cc24dcb457ff8b398e44f319ff07
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe.exe - 97a088ad70cd958562686035eb4a021169980c0ec16ead19b9be00f7a3a2f67b
C:\Program Files\7-Zip\7zG.exe - 97b14f1bcebfad87daa8bc6a4b8475d0a3537b1b23bdf3c1eb627f673c0df5c1
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 05267754a569fa13ce8a6bf44dcc542f5e1ade83fd99dfe53e2f301064d56ebe
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 30534ffd9e7f495ec8d4e2ab23fa074136922df336a5d0255a75e45c61aabd41

Embedded URLs

http://go.microsoft.com/fwlink/?LinkId=154498
http://www.w3.org/2001/XMLSchema-instance
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

b.it
6t.tv
go.microsoft.com
www.w3.org
crl.microsoft.com
www.microsoft.com
www.eyuyan.com
wtqq.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

1.1.0.3
20.184.175.1
52.230.59.222
4.230.171.124
85.210.196.11
74.178.76.54
20.184.175.4
135.233.95.144
13.89.179.12
172.64.154.167
135.233.45.222
4.207.44.68
52.148.114.188
72.145.35.102
52.110.12.15
52.110.12.31

File paths

C:\TFS_SDK\Windows

More Prepender samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report