MALICIOUS — 27e0ded61192cb5e3882c9d88d788442e57f619d46dd215a28e70695102621c2

MALICIOUS — 27e0ded61192cb5e3882c9d88d788442e57f619d46dd215a28e70695102621c2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 27e0ded61192cb5e3882c9d88d788442e57f619d46dd215a28e70695102621c2
SHA-1: a2bfa6081a48ab036d88dabe74bd0dd02fc316dc
MD5: 33bd80285d0931660c51ebabad169655
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:vKtfDEsjPhczE0Dpv5tFA25ZA1J6Ho87kO/HdqQ:StfDEsjPhczjpvrlA1r81/9
TLSH: T18C408D6847276793F5B2CB149C50AB9D4032F47C647A588D624BCC6FF3E8C7789A4228
Submitted as: 27e0ded61192cb5e3882c9d88d788442e57f619d46dd215a28e70695102621c2
File type: pe · Size: 167936 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.JX
Emsisoft (Emergency Kit): Dropped:Generic.Malware.PWB!dld!Pk!.69063F94
Kaspersky (KVRT): Virus.Win32.Delf.62976

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload: MicrosoftEdge_X64_150.0.4078.105_150.0.4078.65.exe - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.lookde5.com/1.exe - static signal, weight 0.35, confidence 0.60
1 behavioral detection(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

55876 behavior events · 2 ATT&CK techniques · 82 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 1443b76498233379b36beeac7032a997de9bf9be0602a66a0e3f5f3b55f6abc8
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 74d2f51a93e74af88af6b11defd692a023013fda14c1db40c0155a6365f2b6f5
C:\ThreatLens\agent.exe - 5c9e472554934a9027cedc8559154bdd306da1dedc82247cdeeb8047817c3d6c
C:\Windows\Logo1_.exe - cc3a04575d2f08e6060422ac228c40c7c1472f70ff2393d9deb66a3335e089ad
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\DefenderSessionHelper.exe - ab5d22f519736b54af7b62803bd46046cdcb587b0371b7f2c6d9b2474ce9ddd9
C:\Program Files\SumatraPDF\SumatraPDF.exe - da93b8cc6bdafabed408abe27747f9f5fb1c7539164d1b2a4a7dc9f97d6f948b
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64-arm.exe - eb38bccdaeb90d45c0974805164ad3aa7a2222e2532ad997060cfcd0dbc1f9e6
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\cli-arm64.exe - aa57e2c20621ad7e821f57e9427414345cd60a9f998fbd5fec689e38f57a86a7
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\150.0.4078.105\MicrosoftEdge_X64_150.0.4078.105_150.0.4078.65.exe - 0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f
C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper.exe - 455e2788f62d387c8e9216d48b09ab2807f75f6ebacd033606a860aeba1feb58
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Python310-32\Lib\site-packages\pip\_vendor\distlib\t32.exe - febff46b9707a0858d27be614af0e25b70b36ca698dd664222ebc4853d38ef58
C:\Program Files\LibreOffice\program\regview.exe - f13c41c2da7b43066a7477b212730fd7c27555bfa1bb55d0a1b7b3a33a97e615
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - 7dbc2af30b284bd9557e16f520027febd42e12720db1a22197177d2c127dba7d
C:\Program Files (x86)\Microsoft\Edge\Application\PlatformExperiencesHelper\platform_experiences_helper.exe - ee4bebaf860215f9b09d9988daae2074af38120894f5874d1641fbb02c32f526

Embedded URLs

http://www.lookde5.com/1.exe
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787806551&P2=404&P3=2&P4=cMeGAF63QdgYAl%2bphH1fivPAVUIfaFAr8uzS%2fM1hYjiFGtNkBc48yvqiPqnCIesjf7ops%2bWX4QEQVuwXzl6oyg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787806680&P2=404&P3=2&P4=EUca4gauxCK29fmlb38aZpCCVl0XdMJhR%2fIwS3O7ft0DRLwUoj%2bWZ3KA3%2b5KzjwRyyrQLiV6SreWZ7KHAmoUpw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.lookde5.com

Embedded IP addresses

192.168.0.30
192.168.8.1
4.150.223.107
4.230.171.124
40.84.85.40
20.247.185.124
57.155.101.212
135.232.92.137
85.210.193.152
74.178.76.54
52.168.112.67
20.165.94.63
4.150.223.105
203.26.79.13
20.231.239.246
52.123.129.14
52.123.128.14
172.178.240.163
52.123.252.192
74.178.232.29
52.110.12.33
52.110.12.52
52.148.114.188
135.234.160.246
125.56.205.65

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report