MALICIOUS — 40393e4401bfc75697b7fe6a07cd6f1011633f0219adc65582a6ad6533d8ef33

MALICIOUS — 40393e4401bfc75697b7fe6a07cd6f1011633f0219adc65582a6ad6533d8ef33 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Vindor family. 9 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 40393e4401bfc75697b7fe6a07cd6f1011633f0219adc65582a6ad6533d8ef33
SHA-1: d44feb6c0217b843e322f5181ffbb1362b3b7055
MD5: b49ace8362fed7b9ce669271d1ae132a
imphash: 45fd9b63a881719b9b56f34ef23b9c19
ssdeep: 6144:cVxGED9DU+Z1M6Zqh7zLnrmHos9OYDL1HiIPBMvgqgF8XW4MbYVrOigVNo:czL9tZ7IkVX86avEF8JMkKVN
TLSH: T12A567C88D963367FEA72BA45181A5AFF0093E8F5F13C05899342F01A73A6B735431326
Submitted as: 40393e4401bfc75697b7fe6a07cd6f1011633f0219adc65582a6ad6533d8ef33
File type: pe · Size: 1431805 bytes
Verdict: malicious (100/100) · Family: Vindor

Detections (9 of 55 engines)

capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Worm.Vindor-9886047-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Vindor.B
Emsisoft (Emergency Kit): Gen:Heur.Mint.Autorunner.1
Kaspersky (KVRT): Worm.Win32.AutoRun.vx

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Worm.Vindor-9886047-0 (rule Win.Worm.Vindor-9886047-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 32 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.symauth.com/cps0, http://www.symauth.com/rpa04, http://www.symauth.com/cps09 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 26 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

25847 behavior events · 1 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\klist.exe - d5e24dc76f7cb0b9c51c1d44b50676fe646e1c5faa7f4cd633dbdfd8a0b6d835
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccesswalker.exe - b79fc3d3304d35a11ea4cb142a5c059f8eab8f8b6ffacbb2f8ed8f0b7af0b0fe
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - fc6f107c60e3ae4f704afd45d24da499f41e856310e762832474b34c9b699bfa
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jwebserver.exe - 6d1d6faf5feace67cad9679b5802516a63e70ea6cf95ce1e768b9a8c816a8ab2
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jaccessinspector.exe - a7487ee88d94f322148489c818cc861ee1e77ec31ce5b5e7b5e999c0d5acf6f6
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\javaw.exe - 00293b1fc4c093b570c7a9433fb5b16b188e938061cacf6f7a35721a6f346acb
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - c199c0ed197e6336bc72c0801247ba51d88ea6fcfe3cb5e9ed0c98757164d4d7
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 4f27c7b7e161a6a8f80f01d1c717fc641450bf3b1e41a8205751754bade12aec

Embedded URLs

https://github.com/dotnet/corefx/tree/8136b3dd606b08acc749645401fdf719b7c5e05c
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://crl.thawte.com/ThawteTimestampingCA.crl0
http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
http://crl.verisign.com/pca3.crl0
https://www.verisign.com/cps0
http://logo.verisign.com/vslogo.gif04
http://www.symauth.com/cps0
http://www.symauth.com/rpa04
http://crl.verisign.com/pca3-g5.crl0
http://www.symauth.com/cps09
http://evcs-crl.ws.symantec.com/evcs.crl0
http://evcs-aia.ws.symantec.com/evcs.cer0
http://office.microsoft.com/0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787863902&P2=404&P3=2&P4=a7%2fmj3BDq7wz7PfKf6yPvGZ5FqPat9BnQl3FizOeOWZyys5ctZvIwmsWf9aXyZ%2fnGCDSnfZ3tp9MayNEycMGxg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

github.com
www.microsoft.com
crl.microsoft.com
crl.thawte.com
ts-aia.ws.symantec.com
ts-crl.ws.symantec.com
crl.verisign.com
www.verisign.com
logo.verisign.com
www.symauth.com
evcs-crl.ws.symantec.com
evcs-aia.ws.symantec.com
office.microsoft.com

Embedded IP addresses

1.1.5.131
5.1.5.131
11.0.07.79
51.105.71.136
20.247.184.197
57.155.101.212
4.230.171.124
40.79.167.10
135.233.95.144
74.178.76.54
20.76.201.171
40.104.4.2
52.123.128.14
52.123.129.14
20.184.175.20
135.234.160.244
52.123.252.223
52.110.12.15
203.26.79.13
52.110.12.48
52.148.114.188
92.223.78.30
135.233.95.80
52.123.252.247
72.154.7.111

Registry keys

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WinFirewall
HKEY_CURRENT_USER\Software\Adobe\Adobe
HKEY_CURRENT_USER\Software\Adobe\Acrobat

File paths

C:\Program
e:\bt\1118478\client\onedrive\product\filecoauth\filecoauth\syncenginefileinfoprovider.cpp
e:\bt\1118478\client\onedrive\product\filecoauth\filecoauth\storageproviderfinder.cpp
e:\bt\1118478\client\onedrive\product\ux\shared\runningobjecttablehelper.cpp
e:\bt\1118478\client\onedrive\product\ux\shared\utilities.cpp
X:\:`:d:h:l:p:t:x:
D:\:l:p:
J:\:
X:\:@=D=H=L=P=T=X=\=`=d=h=l=p=t=x=
P:\:
c:\vbvirus\ownerprotect.ptt
C:\905c0769f9a06c95a24ddf945\
C:\905c0769f9a06c95a24ddf945\patcher.exe

More Vindor samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report