MALICIOUS — 22eaab70c1736c3e02814209323324643853d9a40c3d04b8c6ad1838e20687e9

MALICIOUS — 22eaab70c1736c3e02814209323324643853d9a40c3d04b8c6ad1838e20687e9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the 0B66ABC5 family. 4 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: 22eaab70c1736c3e02814209323324643853d9a40c3d04b8c6ad1838e20687e9
• SHA-1: 45e55e44ae60d4e48892c7fcae6ca788c95dd7df
• MD5: f145b1d7f3e80f9876b8220a97ef43d3
• imphash: 8c2c298ae60f6ec09cbfa7ac4454438b
• ssdeep: 3072:yU4Vq0tQ9nLHbB9WHCS0AgTlhsp3mWFe:34QxL7B9WHK9Jhsp3a
• TLSH: T1D948F6C82DEDD0D2C1B9D1035DA899FC398EEC9BB22B8375899A846720D21FB103557D
• Submitted as: 22eaab70c1736c3e02814209323324643853d9a40c3d04b8c6ad1838e20687e9
• File type: pe · Size: 385024 bytes
• Verdict: malicious (100/100) · Family: 0B66ABC5

Detections (4 of 56 engines)

• ClamAV (daily): Win.Trojan.Acnu-7601993-0
• Microsoft Defender: Worm:Win32/Vobfus!pz
• Emsisoft (Emergency Kit): Generic.Dacic.0B66ABC5.A.6E8C448B
• Kaspersky (KVRT): Worm.Win32.WBNA.jtx

MITRE ATT&CK

• T1547.001
• T1543.003
• T1112
• T1071.004
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Acnu-7601993-0 (rule Win.Trojan.Acnu-7601993-0) - engine signal, weight 0.90, confidence 0.95
• 2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
• Microsoft Defender flagged Worm:Win32/Vobfus!pz (rule Worm:Win32/Vobfus!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Dacic.0B66ABC5.A.6E8C448B (rule Generic.Dacic.0B66ABC5.A.6E8C448B) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Worm.Win32.WBNA.jtx (rule Worm.Win32.WBNA.jtx) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 31 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

49727 behavior events · 3 ATT&CK techniques · 4 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• ns1.musiczipz.com
• ns1.musicmixa.net
• ns1.musicmixa.org
• ns1.musicmixb.co
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 21.175.184.20.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.

Dropped files

• C:\Users\analyst\zqgoeb.exe - 016b0cd057a4c60dbd09da2d427ae650ec29d2c4b45dba673f5fcf1c1c8ca41c
• 0c84179733ff837748b09ba35b78d3c1165fbfb1ef0673e0c330817ca0067c0f - 0c84179733ff837748b09ba35b78d3c1165fbfb1ef0673e0c330817ca0067c0f
• 98f974bda7f5272218b11ad2399c5c27c374e62ba86c7b2a3b767666c6d574e2 - 98f974bda7f5272218b11ad2399c5c27c374e62ba86c7b2a3b767666c6d574e2
• 3ec151e5a0934112fd1d610af41b4914c53892dc0797bc5c262d73bb53420ffb - 3ec151e5a0934112fd1d610af41b4914c53892dc0797bc5c262d73bb53420ffb

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• ns1.musiczipz.com
• ns1.musicmixa.net
• ns1.musicmixa.org
• ns1.musicmixb.co
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 172.215.188.225
• 172.172.255.217
• 20.184.175.15
• 20.184.175.21
• 51.105.71.137
• 57.154.63.210
• 72.145.35.97
• 52.123.252.198
• 51.116.253.169
• 72.153.5.132
• 13.89.179.15
• 52.148.114.188
• 4.150.223.113
• 52.168.117.174
• 52.110.12.46
• 52.168.117.169
• 4.150.223.109
• 20.42.65.84
• 40.84.97.4
• 4.150.223.110
• 85.210.193.152
• 20.42.179.192
• 172.172.255.218
• 57.155.104.224
• 20.42.73.30

File paths

• C:\Program

More 0B66ABC5 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report