MALICIOUS — 138db75101ba86ac18e2e9eaceb9c0db16d3f54cc0eacf4f69396de25843bea9

MALICIOUS — 138db75101ba86ac18e2e9eaceb9c0db16d3f54cc0eacf4f69396de25843bea9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 138db75101ba86ac18e2e9eaceb9c0db16d3f54cc0eacf4f69396de25843bea9
SHA-1: e6fc326fa185cbb9567e3d67a9a2fccb24e97613
MD5: 646767d104359734c422d3805d8838de
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:S4J8iCLzQvgGX+FFN9kZY6IoupLk2UQQD8pyLpsWS4pLthEjQT65:J8ic0vt0FNKZY6Y5NjepZSkEjP
TLSH: T1DE427BE8AA686E6ADE36ED7D4CE5701D94422007207C695D06D3B22B04E78EFFC74427
Submitted as: 138db75101ba86ac18e2e9eaceb9c0db16d3f54cc0eacf4f69396de25843bea9
File type: pe · Size: 213486 bytes
Verdict: malicious (100/100) · Family: Razy

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Babuk.69
Kaspersky (KVRT): Trojan.Win32.Nobady.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Babuk.69 (rule Gen:Variant.Ransom.Babuk.69) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Nobady.gen (rule Trojan.Win32.Nobady.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 19 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

76249 behavior events · 2 ATT&CK techniques · 19 dropped files.

Dropped files

C:\Windows\System32\YSIMJOS.exe - 0d8b5554bc1586c8c433b621d08a44dad7a22f155a9b0cad1c8466aa07b73e20
C:\Windows\UVEXT.exe - b75f8374fd39e989d08cbd4a131648dd12320e0abf5c064f03d631b35b961242
C:\Windows\UGQJEZ.exe - d7d81a2ffac1e261dbc590ea420c5a1712dd7ff354d2d2a0007a3d75d9c434f1
C:\Windows\System\WBAEC.exe - 06cd37687f4db14d8ebb7b343a296711d55b6bcf995ee779d1dcf4f48bd99732
C:\Windows\System\ZHAKIM.exe - 96d3ec9c9a1fac791f9b6bbeebc6407fa3ba295dcf010ccf70bab6e4edc9423d
C:\Windows\System32\TTGL.exe - 4403e690f3bdfc13d230f4074f2c0f2e9293342d603f68319ca8d1b7762cbed0
C:\Windows\System32\HNTBTEE.exe - 2732a6f80b846fb4d3d802139e685396c97e46853faaec31fbcf6bf92a1499e5
C:\Windows\System\VHU.exe - de5ed42c675b24b6b060c691fb0341ab6718a6edf5b97b58c86dcf8cf2bf7da6
C:\Windows\RRVTEIX.exe - 1e3f8341036d3a7cd52a0146e53cf159d47039570fcaca749d3035f8c28f0a81
C:\Windows\System\DEM.exe - f864c919e655af670a791b087f1e6bc323cb5cacc260e59007e06926350c5d07
C:\Windows\KTJ.exe - 7423a6c99dbcb67db9edf4e76d730553c6cf63698af1a644afa12305c4ed9523
C:\Windows\System\IAHPKJ.exe - f70e81f9ac66add2997230d1df26e8e37364cc5324b98cd24c3f25832288b814
C:\Windows\System\YTQAWJ.exe - 7bb1f982db93654120790431002c4d87b164656c320b8ee3164c6c647fbb7006
C:\Windows\COCHOJE.exe - 95fa2fdedfec6e17b4aa7909cf5066d67976dd0c28bdf12cb891dc39bd30d97c
C:\Windows\OFNV.exe - 03d20d616a0defe308bbef855f910c574c5283f05162aff14c96972ed6402427

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

52.168.117.170
52.123.252.215
4.230.171.124
52.230.59.222
40.84.85.40
135.232.92.97
20.165.94.63
52.178.17.232
74.178.240.61
135.233.45.221
135.233.45.222
172.178.240.162
135.234.160.245
172.178.240.163
172.178.240.161
135.234.160.244
135.234.160.246
72.154.7.100
52.148.114.188
52.110.12.38
52.110.12.30

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report