MALICIOUS — 4001ff2f73ee327ddbab1bd09e4614be1fa2188b4b946d3bfffa5052eb8fea86

MALICIOUS — 4001ff2f73ee327ddbab1bd09e4614be1fa2188b4b946d3bfffa5052eb8fea86 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Sivis family. 11 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 4001ff2f73ee327ddbab1bd09e4614be1fa2188b4b946d3bfffa5052eb8fea86
SHA-1: 609a63a2a05e9378146449d87b2cce1b172857bc
MD5: 10e0036833c51df7a52ff3a942f817fe
imphash: b10d16eedb1085ef7262dfc4ab03be6f
ssdeep: 49152:9FhNGpWGFhNGpWiKPff0oH/2N60cVmTDp1Pmtjg8aDuljZ2mSdbDUAsHpD+bsxcy:b4nH/Hmn78aDiUbYZfgs0Qlxd
TLSH: T1DA675BCD8A1B7311F2B6D8146C1C6ADC80A6F098107EE78E9753A82F51D3637EDE1066
Submitted as: 4001ff2f73ee327ddbab1bd09e4614be1fa2188b4b946d3bfffa5052eb8fea86
File type: pe · Size: 6828627 bytes
Verdict: malicious (100/100) · Family: Sivis

Detections (11 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Sivis-9908038-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:UPX
Microsoft Defender: Virus:Win32/Sivis.A
Emsisoft (Emergency Kit): Win32.Sivis.A
Kaspersky (KVRT): Virus.Win32.Agent.es

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Sivis-9908038-0 (rule Win.Malware.Sivis-9908038-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 23 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:UPX (rule DIE:UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
Dropped 79 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

11525 behavior events · 0 ATT&CK techniques · 94 dropped files.

Dropped files

C:\$WinREAgent\Rollback.xml - 0cdd8d54fc33e288467ad0a78372b4bb3477df653982e489f6788d55ebe9fde5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-file-l1-1-0.dll - 618474a760de7bee60f440d23a194bedbdc043ead88ce20ebc4eb66fd403b8c5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-errorhandling-l1-1-0.dll - cbdb6ac112e41c7645b120a71a07bf921e00e9e662d6445aecd24b29c73c8dd2
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaaccessbridge.dll - dc2ef2ee0944c47cd9e2b112a8b546efae1009d21fc3b0cd81344a39bcf86114
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-sysinfo-l1-1-0.dll - 042447c4ef1996b9386fd062b8e776fec310537177aa987a8c1a095c2f345976
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\msvcp140.dll - 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
db0d8eb399a45f751add8d04332f8e85686b68acbc1455cb5e37ac016c2a7405 - db0d8eb399a45f751add8d04332f8e85686b68acbc1455cb5e37ac016c2a7405
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-interlocked-l1-1-0.dll - e7dceb66c70c28b6d9c5877a4abc29dc742011d1c1e1f08c13e012703b1aa620
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 6135194d88ae58a662af64c73a16ae0aad12709cb8535b867a179238a9d3c1c3
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\kinit.exe - 6eb525ee8d6174805182df7e45239a039323ccd0c0fa0e8fd89b612897c4ea02
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - 0a8badbb9fad4f642e800a58a893505c4f6b2efd153bc14dad11d84ed10a4cdd
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-timezone-l1-1-0.dll - c59a5942ec06380ed23fe102d469c6f703abf1b1cd9f8b4ddd1ee91539ecf5de
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-datetime-l1-1-0.dll - 4c6ca4d2cbc4adc7a28fa817526a24cd597cb4ea1cbf8266ef2b27f3158d22f8
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-processthreads-l1-1-1.dll - a8f0b667fc027705babdf6f51ccb341c753e74ccbce5209e726f788de25d05c6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\api-ms-win-core-synch-l1-2-0.dll - 62bdaa22b2836104ef6d9dee24b79d8fce7f2f0eaedc395d98711d74f960b9d4

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
https://www.digicert.com/CPS0
http://cacerts.digicert.com/DigiCertEVCodeSigningCA-SHA2.crt0
http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0
http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0@
http://crl4.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
http://www.digicert.com/ssl-cps-repository.htm0
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
https://go.microsoft.com/fwlink/?LinkId=532347
https://go.microsoft.com/fwlink/?LinkId=506565
https://login.salesforce.com
http://office.microsoft.com/0
http://trustlist.adobe.com/tl11.acrobatsecuritysettings
http://trustlist.adobe.com/eutl11.acrobatsecuritysettings
http://www.w3.org/1999/02/22-rdf-syntax-ns#

Embedded domains

crl.microsoft.com
www.microsoft.com
crl3.digicert.com
crl4.digicert.com
www.digicert.com
cacerts.digicert.com
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
go.microsoft.com
login.salesforce.com
www.adventure-works.com
office.microsoft.com
trustlist.adobe.com
ns.adobe.com
www.w3.org
www.adobe.com
failure.digital
found.no
later.no
plug-in.to
button.to
process.to
changes.to

Embedded IP addresses

11.0.07.79
4.150.223.111
40.84.85.40
52.123.252.233
4.144.132.114
4.230.171.124
48.211.4.16
135.232.92.137
40.79.163.154
74.178.76.54
52.123.128.14
20.231.239.246
40.99.133.210
20.184.175.0
135.234.160.244
135.232.92.34
203.26.79.13
52.110.12.14
52.110.12.26
172.178.240.163
52.148.114.188
52.110.12.31
52.110.12.30
72.153.5.139

File paths

I:\:f:z:
G:\:a:y:
H:\:h:v:
X:\:`:d:h:l:p:t:
D:\:l:p:
H:\:d:
P:\:
T:\:d:p:
T:\:d:l:t:
L:\:p:x:
X:\:`:d:h:l:p:t:x:
C:\btvsts\3481\private\softgrid\shared\include\command_line_cleaner.hpp
T:\:h:
d:\dbs\el\oc\target\x64\ship\click2run\x-none\IntegratedOffice.pdb
C:\Windows.old
C:\.
C:\Windows.old\Windows\System32\Config\Software.
C:\\Windows\System32\Config\Software.

More Sivis samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report