MALICIOUS — 1d07b34ed0014d9b6c8bdde925e1a537cb79df78245e081c93059a87f64a9a46

MALICIOUS — 1d07b34ed0014d9b6c8bdde925e1a537cb79df78245e081c93059a87f64a9a46 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Doina family. 3 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 1d07b34ed0014d9b6c8bdde925e1a537cb79df78245e081c93059a87f64a9a46
SHA-1: 1dbd3c5e3129b7fbfa2c3da1afca4a96ec57e3ca
MD5: 73f48ad1ba0ef14a04a47497c13ee75c
imphash: 1ff847646487d56f85778df99ff3728a
ssdeep: 98304:KD06FOznLo0+Dd6uxcbmC1RZBz7UD19Vm10:KD3F6n80W6uGSCnTCE0
TLSH: T1607123EB81996385F5939B442D510FAD7463E0AAA07E485C73D3C06E27FACC3D16068E
Submitted as: 1d07b34ed0014d9b6c8bdde925e1a537cb79df78245e081c93059a87f64a9a46
File type: pe · Size: 18796031 bytes
Verdict: malicious (99/100) · Family: Doina

Detections (3 of 56 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Emsisoft (Emergency Kit): Gen:Variant.Doina.1655
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 14 weighted signals:

Emsisoft (Emergency Kit) flagged Gen:Variant.Doina.1655 (rule Gen:Variant.Doina.1655) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 IDS alert(s): ThreatLens Pastebin exfil/stager lookup - network signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 23 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: https://secure.comodo.net/CPS0B, http://www.indigorose.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

30510 behavior events · 2 ATT&CK techniques · 25 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\_ir_sf_temp_1\irsetup.dat - 0f193aa6323a15a807971dc2198ea81820e6af1ddba5ba88a7ce509e32db74b7
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
C:\Users\analyst\AppData\Local\Temp\_ir_sf_temp_1\IRIMG2.JPG - f35985fe1e46a767be7dcea35f8614e1edd60c523442e6c2c2397d1e23dbd3ea
C:\Users\analyst\AppData\Local\Temp\_ir_sf_temp_1\IRIMG1.JPG - 54f4fd4c4243ca60bbdeec5469b526b5ca77fb85c1acf7ebb5d736ae09efff80
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8 - fb5e31f0607bef6d317e0fc6b217826ba2147503349ceda900f849afdbc8333c
C:\Users\analyst\AppData\Local\Temp\_ir_sf_temp_0\irsetup.dat - 972bc45d6ac5d32213e254e2e837ae38d4771bcb15fb82d1349c310e63ab8593
C:\Users\analyst\AppData\Local\Temp\timy.exe - 93205d5c2bc29df0a842c0dcaaf4aa83b211f5e2bc2a62fc9abb77dfdf56b8f6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
C:\Users\analyst\AppData\Local\Temp\_ir_sf_temp_0\timy.enc - 509df9448bf54219c8d78001c26871747aaea70fd6fade44f33b311a322f3633
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D03E46CD585BBE111C712E6577BC5F07_C6577129F114742C87B1DF8E687FA4EC - 3ae11c311ee189d5c127c2a7a37ec52aef78c4d256dbf9dbe4a702816a57012e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 5b6cd42c8a2e0ae4eb7a9ae61f9166b989244d5593f8572c0189db8509256809
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\75CA58072B9926F763A91F0CC2798706_B5D3A17E5BEDD2EDA793611A0A74E1E8 - 48df00de9d8db82af2ef63f754359697f31997f70292fa9b813d54f73cc0be5c
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\VB5HMN51\NewErrorPageTemplate[1] - 77b138ab5d0a90ff04648c26addd5e414cc178165e3b54a4cb3739da0f58e075
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 - 3cfb24cd5e07c8e1afea80ffdc132c199e7ce0946fde78e62550ecbff5bbde97
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\9G746KYB\dnserrordiagoff[1] - a705d1e0916a79b0d6e60c41a9ce301ed95b3fc00e927f940ab27061c208a536

Embedded URLs

https://secure.comodo.net/CPS0B
http://www.indigorose.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/pl4XiTjSDSk.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

z.to
sa.gg
www.lua.org
crl.usertrust.com
secure.comodo.net
www.indigorose.com
pastebin.com
bit.ly
mobilekey.pw
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.97
57.155.101.212
4.230.171.124
85.210.196.11
74.178.76.54
74.179.77.204
51.116.253.169
52.110.12.4
20.247.184.197
135.233.45.222
104.20.29.150
125.56.205.25
125.56.205.123
104.18.33.89
52.148.114.188
52.110.12.30
18.67.98.168
18.65.242.141
72.154.7.17
67.199.248.10

File paths

c:\temp
X:\:`:d:h:l:p:t:x:
c:\P.gram
f:\dd\v
J:\:t:
X:\:`:d:h:l:p:t:P;T;
j:\DY^c

More Doina samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report