MALICIOUS — 1ca3945af366e5ccfd8d82bfe5106ad6a637076fd5ce6352fb8eb6c280f12958

MALICIOUS — 1ca3945af366e5ccfd8d82bfe5106ad6a637076fd5ce6352fb8eb6c280f12958 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wapomi family. 7 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 1ca3945af366e5ccfd8d82bfe5106ad6a637076fd5ce6352fb8eb6c280f12958
SHA-1: 4f373fcca3f55d49bc4bed8ade7514c9a8e28bfd
MD5: 24c6bbac290d298d8a24c8f9a33be304
imphash: 0f049ce24e217892c1b7f2d56270827d
ssdeep: 1536:RfnLq01weW5yX3jFxv49Nu4GhQozGCq2iW7z:Y3ysTGhQSGCH
TLSH: T19A387C518305A2AAEBFACB52AC546F1F50A390EDE0FE394C57C3C00E72E69DBD45410A
Submitted as: 1ca3945af366e5ccfd8d82bfe5106ad6a637076fd5ce6352fb8eb6c280f12958
File type: pe · Size: 82432 bytes
Verdict: malicious (100/100) · Family: Wapomi

Detections (7 of 56 engines)

ClamAV (daily): Win.Virus.Wapomi-9802127-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!24C6BBAC290D
Kaspersky (KVRT): Virus.Win32.Nimnul.f

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Virus.Wapomi-9802127-0 (rule Win.Virus.Wapomi-9802127-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): xFPetM.exe - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Virus:Win32/Mikcer.B (rule Virus:Win32/Mikcer.B) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.VJadtre.3 (rule Win32.VJadtre.3) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FVWC!24C6BBAC290D (rule Trojan-FVWC!24C6BBAC290D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Nimnul.f (rule Virus.Win32.Nimnul.f) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 28 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9327 behavior events · 2 ATT&CK techniques · 49 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
C:\Users\analyst\AppData\Local\Temp\xFPetM.exe - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe - f72ae9e2704e97d9c31b3128003296ae46b20acdda49bf2e85d5b6799085bb4f
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\k4[1].rar - 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 79671bf6759f645dfeb021e3fcece87abe20b7c6be7ee7bf9c362603056a23ee
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://ddos.dnsnb8.net:799/cj//k1.rar
http://ddos.dnsnb8.net:799/cj//k2.rar
http://ddos.dnsnb8.net:799/cj//k3.rar
http://ddos.dnsnb8.net:799/cj//k4.rar
http://ddos.dnsnb8.net:799/cj//k5.rar
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ddos.dnsnb8.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.96
4.230.171.124
20.42.179.204
52.230.60.54
74.178.240.51
20.42.65.89
74.178.76.128
20.184.175.12
135.233.95.144
3.229.117.57
52.110.12.33
52.110.12.47
125.56.205.123
125.56.205.65
52.110.12.54
52.110.12.2
92.223.78.30
52.148.114.188
72.154.7.96
172.64.154.167

More Wapomi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report