MALICIOUS — 32d7b249ed33feaac2c188c0fba89c9cf431eaff0a6ab6b86c120f72172a0fdb

MALICIOUS — 32d7b249ed33feaac2c188c0fba89c9cf431eaff0a6ab6b86c120f72172a0fdb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AutoitGenome family. 9 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 32d7b249ed33feaac2c188c0fba89c9cf431eaff0a6ab6b86c120f72172a0fdb
SHA-1: 5d1967746cc45c6be90862c07b5e69235c628efd
MD5: c405134da4887a4c1bc00dce61cd56c9
imphash: 1e58427826d059c34cbf4b958693e4c4
ssdeep: 12288:1aWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:EaHMv6Corjqnyz3/06
TLSH: T13750A0A12135A73BD2B2E77868705BCF20B771AC11F919D85283C1EC31F5CAB942259B
Submitted as: 32d7b249ed33feaac2c188c0fba89c9cf431eaff0a6ab6b86c120f72172a0fdb
File type: pe · Size: 755979 bytes
Verdict: malicious (100/100) · Family: AutoitGenome

Detections (9 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Bulz-9940102-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/AutoitGenome!pz
Emsisoft (Emergency Kit): Gen:Variant.Tedy.850583
Kaspersky (KVRT): Trojan-Downloader.Win32.Agent.gpyl

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9940102-0 (rule Win.Malware.Bulz-9940102-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 29 external host(s) at runtime (35 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

28514 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A98697D5B8F6004055813FBF550F3D0F - 029dbf3b06acd0c1e59b11b0724070d20b67c89e159f802691cb3b73329b48b7
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - f125ca75159c6dcadd7ba844cec8541973f581fe5267a8507508ad8bd5e9d9e5
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Program Files\Managemenot\Monitor\tcpscrex.exe - ce8a60ace9029be4597248b5c3db0f07f52a73424eb413d3f732e653a5951aa9
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A98697D5B8F6004055813FBF550F3D0F - 30cf9e986b7d360059646176d2b1a30754f29ab12d996ff8f065e4fe312cb881
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - d60507d96cae2a1c8e78c26ba4995afe3b9d619b6cd943fa096552682a03e9c6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - 0d935bbc0a90f5ef6c5a9ade44ef376a4b657b824b9cb600b55217dd9185e795
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\9G746KYB\getip[1].htm - 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://w347302.s98.ufhosted.com/getip.asp
http://www.aamailsoft.com/getip.php
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye1.c.lencr.org/10.crl
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787807183&P2=404&P3=2&P4=KkGc25k75oREMg3Afi%2b57CTPcml8jtevG7xVahPZatu3MtwhjaKVPHM8yLqKCAkv2iaA%2fTzGgTHHt7cTywUwzQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://W347302.S98.Ufhosted.Com/NC/UP/Down.txt
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787807247&P2=404&P3=2&P4=KG4yybhugUAMX04ud7gIGplSG1bTe9rPIdhf4oZ1S4Wi%2f7aD2s6ryTxPb9X7hR%2b%2f4nAcEGvvjXrvlMIDBcIbDA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

autoitscript.com
w347302.s98.ufhosted.com
www.aamailsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye1.c.lencr.org

Embedded IP addresses

20.42.65.91
20.42.179.192
52.230.60.54
4.230.171.124
20.42.179.204
74.178.240.61
20.184.175.0
74.178.240.51
4.150.223.102
20.231.239.246
52.123.129.14
52.123.128.14
40.99.133.210
101.227.111.7
135.234.160.244
52.123.252.204
20.165.94.46
203.26.79.13
66.175.209.193
104.18.21.213
52.148.114.188
172.178.240.163
125.56.205.65
125.56.205.51
13.89.179.15

More AutoitGenome samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report