MALICIOUS — 1dd6003337c697a573f38b6a49bc726b47ad30767bf24ce9392bdb066e906b44

MALICIOUS — 1dd6003337c697a573f38b6a49bc726b47ad30767bf24ce9392bdb066e906b44 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Bulz family. 2 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1dd6003337c697a573f38b6a49bc726b47ad30767bf24ce9392bdb066e906b44
SHA-1: f37a37fb4f8eba44a0bc0905195e5b51aae03054
MD5: 5224bf73f1c70ee0bba3bef137c004f9
imphash: 54abd74cd9f198ef3a2449e93c572f15
ssdeep: 6144:uznlSmt2Aiqc8Jwkk05mt2AiqS2Aiqax:uLlSmgAiqxyv05mgAiq/Aiqax
TLSH: T1DD45DFCF1D25541FC8ABEB47BD495E5CD20598C1A35E1688C3D290BCA8CB87B06BC927
Submitted as: 1dd6003337c697a573f38b6a49bc726b47ad30767bf24ce9392bdb066e906b44
File type: pe · Size: 266240 bytes
Verdict: malicious (99/100) · Family: Bulz

Detections (2 of 56 engines)

ClamAV (daily): Win.Malware.Hoax-6837106-0
Emsisoft (Emergency Kit): Gen:Variant.Bulz.657730

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Hoax-6837106-0 (rule Win.Malware.Hoax-6837106-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.657730 (rule Gen:Variant.Bulz.657730) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: http://purl.org/dc/elements/1.1/, http://www.iec.ch, http://www.facebook.com/ROCKDL - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

750 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~DFEDD5303F91B529CF.TMP - d0e9a260f6b0731497e27b456531fedfb54c54707f54ae2fdb7280504450f3fa

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/xap/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://ns.adobe.com/xap/1.0/sType/ResourceRef#
http://purl.org/dc/elements/1.1/
http://ns.adobe.com/xap/1.0/sType/ResourceEvent#
http://ns.adobe.com/camera-raw-settings/1.0/
http://ns.adobe.com/photoshop/1.0/
http://www.iec.ch
http://www.facebook.com/ROCKDL
http://backdoor.rockdl.net/Download/text1.txt
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.w3.org
ns.adobe.com
rockdl.net
purl.org
www.iec.ch
www.facebook.com
yahoo.com
rockdl.com
backdoor.rockdl.net
gmail.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.110
52.123.252.227
20.247.184.142
4.230.171.124
85.210.196.11
74.178.76.128
135.232.92.97
20.42.65.85
104.208.16.94
92.223.78.30
52.110.12.45
52.110.12.52
125.56.205.56
125.56.205.32
172.215.188.232
13.89.179.15
52.168.117.170
72.153.5.60
52.148.114.188
52.110.12.16
52.110.12.37

File paths

C:\Program

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report