MALICIOUS — 1491ee21bb6c4ea324ebd14b0819818229ad9b3f69ab0a148d284cd71d287305

MALICIOUS — 1491ee21bb6c4ea324ebd14b0819818229ad9b3f69ab0a148d284cd71d287305 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AddUser family. 8 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 1491ee21bb6c4ea324ebd14b0819818229ad9b3f69ab0a148d284cd71d287305
SHA-1: 80cd7012785af94dabee72d0e5a522f3823677e4
MD5: 25f7917acf8d1434e1620d1ccdc6500d
imphash: 68864e2c52b98624974843d1b22a695b
ssdeep: 12288:CzCr6D+2OkeG9F1xk1kwZRo5FbDFBQX6f6AkdIAELARixZFDuV:Cza2OkeG9jxyTo5Fbz/zkOLLARixXDuV
TLSH: T1E64A23D806A6B310E1FA3777DB48D98D10D165F3686D203512C7532FA2F609BAE5A323
Submitted as: 1491ee21bb6c4ea324ebd14b0819818229ad9b3f69ab0a148d284cd71d287305
File type: pe · Size: 441288 bytes
Verdict: malicious (100/100) · Family: AddUser

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Malware.Ulise-9806872-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:ASProtect SKE 2.72+
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/Tonmye!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.AddUser.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9806872-0 (rule Win.Malware.Ulise-9806872-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 924) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Tonmye!pz (rule Trojan:Win32/Tonmye!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.AddUser.gen (rule HEUR:Trojan.Win32.AddUser.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 32 external host(s) at runtime (13 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:ASProtect SKE 2.72+ (rule DIE:ASProtect SKE 2.72+) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.360.cn, http://www.eyuyan.com, http://www.360.cn/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, ASProtect SKE 2.72+, ASPack 2.12-2.42 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

30413 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9560/files/e0f5c6954f32dc29206b290787b33194819c7079f4e9299db55f5e99025bc112 - e0f5c6954f32dc29206b290787b33194819c7079f4e9299db55f5e99025bc112
/opt/CAPEv2/storage/analyses/9560/files/f15e00e3a29cffe9b3e73006fe12b91ead93a58e607f11d613d2788c1a731c64 - f15e00e3a29cffe9b3e73006fe12b91ead93a58e607f11d613d2788c1a731c64
14f8c6a29a7edaa749a7b59420bc1160d4437f06308aca6bd00aa296f2f9e81c - 14f8c6a29a7edaa749a7b59420bc1160d4437f06308aca6bd00aa296f2f9e81c
17fc29cb1840e9d7755b2abae843d68b3dd23cbd5e4dd41083335a822adbad13 - 17fc29cb1840e9d7755b2abae843d68b3dd23cbd5e4dd41083335a822adbad13

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/rpa0
https://www.verisign.com/cps0*
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.360.cn
http://www.eyuyan.com
http://www.360.cn/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786422698&P2=404&P3=2&P4=KKN9z%2bD1ALyfi9A0MAoPHRCvpwWCVF%2bedkvoNn%2fpNrea2LZ509B6dJXHY3XLRzrGUFZI7qd6axFwNcV7D6vtqw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786422788&P2=404&P3=2&P4=Q4VoK9%2fQ8Ena8qHiIYB36zrvr7RvvAaV%2bg6xNPVIqpU5sK42MsLT5BjVUnUclJ%2bBPCueEKgUUeP493C18QlTNA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.verisign.com
www.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
logo.verisign.com
www.360.cn
www.eyuyan.com

Embedded IP addresses

52.168.117.174
52.123.252.245
57.154.63.210
4.230.171.124
52.230.60.54
20.165.94.63
74.178.76.54
4.150.223.98
135.232.92.137
135.234.160.244
135.234.160.246
135.233.45.222
203.26.79.13
52.123.252.241
74.179.71.159
72.153.5.141
52.148.114.188
52.110.12.49
52.110.12.33

More AddUser samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report