MALICIOUS — 10ba4b124f346ae2ab5458ebfacbf5804258e7a07153995a1b8c700dc78813bf

MALICIOUS — 10ba4b124f346ae2ab5458ebfacbf5804258e7a07153995a1b8c700dc78813bf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Filerepmalware family. 3 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 10ba4b124f346ae2ab5458ebfacbf5804258e7a07153995a1b8c700dc78813bf
SHA-1: 12d176342fd2b95fee29c7eb3dc6273ce2d70c96
MD5: eba7d8c323176547684a6e9b1859c6d8
imphash: eb5bc6ff6263b364dfbfb78bdb48ed59
ssdeep: 98304:R1QT1++dGUFV+CFEBDpbG1DO1UOLqx4B73m8ChsJY/:Xe++0UF4uEBDp4DUnLq+Yf/
TLSH: T18963F1B972171822C7A7774095A6B47F89EBB4D352B7851C40E3C72EC9E13CB20B5289
Submitted as: 10ba4b124f346ae2ab5458ebfacbf5804258e7a07153995a1b8c700dc78813bf
File type: pe · Size: 5055104 bytes
Verdict: malicious (99/100) · Family: Filerepmalware

Detections (3 of 56 engines)

ClamAV (daily): Win.Malware.Filerepmalware-9908417-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Filerepmalware-9908417-0 (rule Win.Malware.Filerepmalware-9908417-0) - engine signal, weight 0.90, confidence 0.95
Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline - static signal, weight 0.35, confidence 0.60
Dropped 9 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

51352 behavior events · 2 ATT&CK techniques · 21 dropped files.

Dropped files

c:\program files (x86)\ckhunter\unins000.exe - 8a7cc1641c3187811c2a6695de5fe7265b0238686e3566325238a432daf7820c
c:\program files (x86)\ckhunter\ckhunter.exe - 46a40eb0d446d97fb45f461058380739a2c6c38595410408b98f9e5802679cc9
C:\Users\analyst\AppData\Local\Temp\is-9PQ63.tmp\_isetup\_setup64.tmp - 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
C:\Users\analyst\AppData\Local\Temp\is-H7Q34.tmp\tsk_2a97531990324714.tmp - 0e4c8658b174aa18e1f135a1fcb640a820ecf44efa8055309db1d5ddebc2251d
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000025.db - 1762f76efa3e38a34f9e9d5050bba53df979004d1959509c8e726e09bceca636
c:\program files (x86)\ckhunter\crdllunload64.dll - 0b28d446fdd3eae2c6532cf4611765fa4ca9fedfba6fb564ad1e4eb46420613a
c:\program files (x86)\ckhunter\history.txt - 59df86ecd4822f5fe077ca078dae25bfd19d052b6bb375c8e9010c7b86244ee2
c:\program files (x86)\ckhunter\usrfindhandle64.sys - b288dfec2bb19509eca5b659c022db1ac80534c2eb06f6f792d563e655cd5a71
C:\Program Files (x86)\ckHunter\unins000.dat - 7648ac6833d422452b2e8c293a927763666593c2b3685d66d8110636865415bb
C:\Users\analyst\AppData\Local\Temp\is-9PQ63.tmp\_isetup\_iscrypt.dll - 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
c:\program files (x86)\ckhunter\crdllunload32.dll - 6468cb2a3d578efba32239c1c2c4676b4ddc3af4da59c8a3cec1adb6adf76930
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db - 42c4c717415aa36389032b92ac9eaa450c4bce7443ee0fcbd6fee2a2d7d5c782
c:\program files (x86)\ckhunter\lhshellext32.dll - d0894fb05471025253d7d002678157ace15d5e1d960a2470ee1f83f2d9a9a4d5
c:\program files (x86)\ckhunter\lhshellext64.dll - b18e15ba181c0ded42e179babad2900ec54e410329cdd4bf67e9f64bb6f3d1bf
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\cversions.3.db - 10cce95f0fc63c290ac60ab5bde752f9e941e977a6dc182178115b0a2ea9ed75

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com
www.jrsoftware.org
olustgtapi.live

Embedded IP addresses

4.150.223.99
4.230.171.124
20.42.179.192
20.247.184.142
74.178.240.51
135.233.95.144
20.42.65.89
172.66.2.5
52.110.12.10
135.233.45.222
135.234.160.245
52.110.12.11
135.234.160.244
72.154.7.112
52.148.114.188
52.110.12.47
52.110.12.51

File paths

x:\dirname

More Filerepmalware samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report