MALICIOUS — 1cd485877a1be2cc02f819a0f240173f5cce824f9ea329ddafb92bd6cb71c055

MALICIOUS — 1cd485877a1be2cc02f819a0f240173f5cce824f9ea329ddafb92bd6cb71c055 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mintluks family. 5 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 1cd485877a1be2cc02f819a0f240173f5cce824f9ea329ddafb92bd6cb71c055
SHA-1: 9f9a61928b3b0949c09c942848012cb7dbb9ae18
MD5: ac3b30330be8f1bfbec108da98777aa1
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 1536:AuHY6M3xXT0XRhyRjVf3znOJTv3lcUK/+dWzCP7oYTcSQtvd9/y1yP:AuHYn3xSyRxvY3md+dWWZyvd9/n
TLSH: T1F638BE68F6AF9A71E1EEDD9934D0D13D8112A0D5F9EC730C0B8080216971E6778A764F
Submitted as: 1cd485877a1be2cc02f819a0f240173f5cce824f9ea329ddafb92bd6cb71c055
File type: pe · Size: 80384 bytes
Verdict: malicious (100/100) · Family: Mintluks

Detections (5 of 56 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): Win.Malware.Avlj-9877624-0
Microsoft Defender: PWS:MSIL/Mintluks!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Avlj-9877624-0 (rule Win.Malware.Avlj-9877624-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged PWS:MSIL/Mintluks!pz (rule PWS:MSIL/Mintluks!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

24269 behavior events · 3 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\5kge4ohd.cmdline - 4ea652c74a1179ca0aec23fcfb19f163c38cf751c08f9e780832c6cb068f2369
C:\Users\analyst\AppData\Local\Temp\5kge4ohd.out - b538d63b53028067155eec78f72abf5334f878e463e1b59b1e77d4cfee5b535a
C:\Users\analyst\AppData\Local\Temp\RES3718.tmp - 74170a36829d4a3d80cc00050c17cacd8c97180ce6dcf632bc7e88d48ad5e16e
C:\Users\analyst\AppData\Local\Temp\vbc7D992B72B23E4172B695D1FA7738C11.TMP - 26d103853add8c0c8d3a424d831ffa9bd91678a0030c77894d831c1f62588c2c
C:\Users\analyst\AppData\Local\Temp\zCom.resources - e54a257fa391065c120f55841de8c11116ea0e601d90fe1a35dcd340c5dd9cd5
C:\Users\analyst\AppData\Local\Temp\5kge4ohd.0.vb - 8a3e008f83d848470832e6e37ddde77e90afdc746570f6e87ff1b130c4fd6384
C:\Users\analyst\AppData\Local\Temp\tmp1586.tmp.exe - e8ad83764e425b8dfecd72ee5f61d34cfc4e868be68b54a7ea1a6b4cf2c1e65c
8b7baccd3d5c2d190ef5762f1acebbe14be250eaaad195289c67885e9d791fce - 8b7baccd3d5c2d190ef5762f1acebbe14be250eaaad195289c67885e9d791fce
8e8d162f01b0169e0d768056f65b3e7dff1870dc27ae343f705f6e0cb7a56ab6 - 8e8d162f01b0169e0d768056f65b3e7dff1870dc27ae343f705f6e0cb7a56ab6
8b6f9467e5b09229f24d0e7e4e5f0daf1bf5d719f9e7a17c501d64daa5b27e80 - 8b6f9467e5b09229f24d0e7e4e5f0daf1bf5d719f9e7a17c501d64daa5b27e80
67f27dfca4ca9ab8153f22891be997a1339d9d2c47b7d0274c8d600053a343ec - 67f27dfca4ca9ab8153f22891be997a1339d9d2c47b7d0274c8d600053a343ec
2c5263ac24a673c5c2faa4175a1626c337e760390146f62ef875fe85ca11f04d - 2c5263ac24a673c5c2faa4175a1626c337e760390146f62ef875fe85ca11f04d
552dc7df443c1864855270032dbcf3e7987a8dde932bf7f64884e8299ead7147 - 552dc7df443c1864855270032dbcf3e7987a8dde932bf7f64884e8299ead7147
13b8304c5310bbf89269e617d5d45ec2a465a5e4d8729071880398b94e9fe536 - 13b8304c5310bbf89269e617d5d45ec2a465a5e4d8729071880398b94e9fe536
bfbaaa9bfdeaf7126479f2339da0d4121a70f5db9c970af55f9f75ddc70df1bf - bfbaaa9bfdeaf7126479f2339da0d4121a70f5db9c970af55f9f75ddc70df1bf

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788163586&P2=404&P3=2&P4=ORrP0L%2b4tm74qBXFY3lrxcvjBFE%2bdzPByMIEZbyx0kLukdckk3vOqkawW8OKKOi8YDghkuKLDbAexN99P89m5w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://bejnz.com/IP.php
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

bejnz.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.103
52.123.252.213
52.253.84.76
57.154.63.210
4.230.171.124
20.165.94.63
135.232.92.97
52.182.141.63
52.168.117.171
104.18.33.89
203.26.79.13
135.233.95.80
3.229.117.57
172.215.188.232
72.154.7.103
52.148.114.188
52.110.12.44
52.110.12.11

More Mintluks samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report