MALICIOUS — 38c90260a44e54102b13eae8926ff11a0404de38d59a5bc16797c22aeee709d2

MALICIOUS — 38c90260a44e54102b13eae8926ff11a0404de38d59a5bc16797c22aeee709d2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the SelfDel family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 38c90260a44e54102b13eae8926ff11a0404de38d59a5bc16797c22aeee709d2
SHA-1: 878a38c8b05e42b99ba4767e36bb6505e218b0f8
MD5: 0fc07d48721544c5b3eb3c2cb1db5c73
imphash: 1aea4bdc5e11fd8048eec1b9442c47a0
ssdeep: 12288:hLr3icqPJRWJryFK3xrj5gxWZNBrO6W6Ow8Cv:JYWIun86Wlw8Cv
TLSH: T1CF5D28C50D74A2C5DCF972248FBB8D3D29094854E13A086F96F67225D6F14B3EC38A92
Submitted as: 38c90260a44e54102b13eae8926ff11a0404de38d59a5bc16797c22aeee709d2
File type: pe · Size: 2712192 bytes
Verdict: malicious (100/100) · Family: SelfDel

Detections (5 of 56 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/Tnega!MSR
Emsisoft (Emergency Kit): Gen:Variant.Lazy.6299
Kaspersky (KVRT): UDS:Trojan.Win32.SelfDel.hvcr

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

Memory forensics: 2 finding(s) attributed to the sample across 2 technique(s), e.g. process hollowing in tsk_76eacd8d18 (pid 3292) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.75, confidence 0.85
3 behavioral detection(s) across 3 rule(s): Credential Access: browser credential store read [high] (rule tl-browser-credential-access) - dynamic signal, weight 0.66, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tnega!MSR (rule Trojan:Win32/Tnega!MSR) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Lazy.6299 (rule Gen:Variant.Lazy.6299) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.SelfDel.hvcr (rule UDS:Trojan.Win32.SelfDel.hvcr) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
1 IDS alert(s): ThreatLens DGA-style .top C2 lookup - network signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Extracted CryptBot config (0 C2) - engine signal, weight 0.45, confidence 0.60
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

39219 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\UPpaJHssVYAA\_Files\_Screen_Desktop.jpeg - 233bd146211225c0dcef0bc7ee81dc6e1dd704948cc707414dd402e7381368bd
C:\Users\analyst\AppData\Local\Temp\UPpaJHssVYAA\ErRNAPgcvGXx.zip - d86293cf2fca7366fba97acdf2c2a3c70c27c3b0d67af2eaf09e67a3c1ac69aa
C:\Users\analyst\AppData\Local\Temp\UPpaJHssVYAA\files_\system_info.txt - 0eb121a4c5ba75f144ef6f25f4e522fbdedb6f72aab90e9d143ca4d7bef639fd
ec3176764dd2f0855afc3af57aa6d39ce61245d6dd14737ce7ecd72d78bce4f4 - ec3176764dd2f0855afc3af57aa6d39ce61245d6dd14737ce7ecd72d78bce4f4
d87ae426cb5cd815ab176ac90c0ccfe5f834bf41595e7ce90e8a699cadd981cf - d87ae426cb5cd815ab176ac90c0ccfe5f834bf41595e7ce90e8a699cadd981cf
d2a14cc6ff472f7db1e922a53db96260c7a088582d60a286075802235320d1f5 - d2a14cc6ff472f7db1e922a53db96260c7a088582d60a286075802235320d1f5

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/cps0*
https://www.verisign.com/rpa0
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.verisign.com
www.verisign.com
logo.verisign.com
crl.microsoft.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
lekxyb54.top
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.12
85.210.196.11
20.247.184.142
57.154.63.210
135.233.95.144
74.178.76.54
4.150.223.101
20.184.175.15
20.247.184.197
4.230.171.124
172.66.2.5
52.110.12.38
52.110.12.24
20.42.179.204
72.154.7.98
52.148.114.188
92.223.78.30
52.110.12.44
52.110.12.16

More SelfDel samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report