MALICIOUS — 47f271a9ef34722953ba40f84e0c41a9357617f9179da5210c614710a178feaf

MALICIOUS — 47f271a9ef34722953ba40f84e0c41a9357617f9179da5210c614710a178feaf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AddUser family. 8 of 52 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 47f271a9ef34722953ba40f84e0c41a9357617f9179da5210c614710a178feaf
SHA-1: 74cbc395710b83d49a5971bf71839104fb92b58f
MD5: 593a442013cc975df6d8ed7bfa43c682
imphash: 68864e2c52b98624974843d1b22a695b
ssdeep: 12288:CzCr6D+2OkeG9F1xk1kwZRo5FbDFBQX6f6AkdIAELARixZFDuC:Cza2OkeG9jxyTo5Fbz/zkOLLARixXDuC
TLSH: T1784A23D806A6B310E1FA3777DB48D98D10D165F3686D203512C7532FA2F609BAE5A323
Submitted as: 47f271a9ef34722953ba40f84e0c41a9357617f9179da5210c614710a178feaf
File type: pe · Size: 441288 bytes
Verdict: malicious (100/100) · Family: AddUser

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Malware.Ulise-9806872-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:ASProtect SKE 2.72+
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/Tonmye!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.AddUser.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9806872-0 (rule Win.Malware.Ulise-9806872-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 924) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Tonmye!pz (rule Trojan:Win32/Tonmye!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.AddUser.gen (rule HEUR:Trojan.Win32.AddUser.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:ASProtect SKE 2.72+ (rule DIE:ASProtect SKE 2.72+) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.360.cn, http://www.eyuyan.com, http://www.360.cn/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, ASProtect SKE 2.72+, ASPack 2.12-2.42 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

32247 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9554/files/8c665e29c717c8b0231e6b2c0d381f25bf27af1c0e88ee7f6dd9121682c81f70 - 8c665e29c717c8b0231e6b2c0d381f25bf27af1c0e88ee7f6dd9121682c81f70
/opt/CAPEv2/storage/analyses/9554/files/2e7216fecffb70e319d3867acc70110361e6b6b2b9937b495f9d46580d72f7ca - 2e7216fecffb70e319d3867acc70110361e6b6b2b9937b495f9d46580d72f7ca
941a6687d125d8713ffec461b0d193bb9698eaacdfc11be4d2614fa4071aed5d - 941a6687d125d8713ffec461b0d193bb9698eaacdfc11be4d2614fa4071aed5d
416057f6e94bb317ebe4fce57b9d16e01a802ade1d3f25cc048be7329a20ee96 - 416057f6e94bb317ebe4fce57b9d16e01a802ade1d3f25cc048be7329a20ee96

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/rpa0
https://www.verisign.com/cps0*
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.360.cn
http://www.eyuyan.com
http://www.360.cn/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786422209&P2=404&P3=2&P4=G30yNBXcKj%2fecdUCiG7kbyj80UfiYuuVzqVUAOwaoKqcg4E5enC0jsihSWzvIlTcZ%2btskYQ4hPtx5CrVJetPhg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786422298&P2=404&P3=2&P4=abNc4GApxVlqIeyN88F%2fgymo%2fZrTI2jO0nnl%2fmrq5O8oxjj81eQ%2fc%2bYVHMK9xtPeAL%2bEbwo6U7094uz3vfDteA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.verisign.com
www.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
logo.verisign.com
www.360.cn
www.eyuyan.com

Embedded IP addresses

20.50.201.200
52.123.252.242
52.253.84.76
4.230.171.124
172.215.188.232
74.179.77.204
104.208.16.94
135.233.45.223
74.179.77.164
20.165.94.63
135.233.45.221
40.84.97.4
172.178.240.161
203.26.79.13
172.178.240.162
20.165.94.46
20.184.175.17
51.116.253.169
52.148.114.188
72.154.7.105
52.110.12.5
52.110.12.18

More AddUser samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report