MALICIOUS — 4ed8dcd31f3a0c01882abc9aed586af6064dd1048d041491571aee475aa8395d

MALICIOUS — 4ed8dcd31f3a0c01882abc9aed586af6064dd1048d041491571aee475aa8395d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bladabindi family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

• SHA-256: 4ed8dcd31f3a0c01882abc9aed586af6064dd1048d041491571aee475aa8395d
• SHA-1: fd14331caa17ceae5cf2dae0a8de7fb892b10efa
• MD5: 39b6322a47b5fedee352af42555d2f37
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 1536:WibJD/HBZbszKu9AZpd7r1jEwzGi1dDJDRgS:WiqzK4AZ3HCi1dFO
• TLSH: T1F63AF8EC5E1903A9C377ED211D10855EA164ACEED6E2772A1B149B73F085B33BC26036
• Submitted as: 4ed8dcd31f3a0c01882abc9aed586af6064dd1048d041491571aee475aa8395d
• File type: pe · Size: 95232 bytes
• Verdict: malicious (100/100) · Family: Bladabindi

Detections (7 of 56 engines)

• capa (capabilities): capability:execution/powershell
• ClamAV (daily): Win.Packed.Generic-9795615-0
• YARA: InQuest Labs: AgentTesla
• Microsoft Defender: Backdoor:MSIL/Bladabindi
• Emsisoft (Emergency Kit): Worm.Autorun
• Trellix Stinger (McAfee): Trojan-FUTJ!39B6322A47B5
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1059.001
• T1547.001
• T1056.001
• T1543.003
• T1112
• T1562.004

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

• ClamAV (daily) flagged Win.Packed.Generic-9795615-0 (rule Win.Packed.Generic-9795615-0) - engine signal, weight 0.90, confidence 0.95
• YARA: InQuest Labs flagged AgentTesla (rule AgentTesla) - engine signal, weight 0.70, confidence 0.70
• Microsoft Defender flagged Backdoor:MSIL/Bladabindi (rule Backdoor:MSIL/Bladabindi) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Worm.Autorun (rule Worm.Autorun) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FUTJ!39B6322A47B5 (rule Trojan-FUTJ!39B6322A47B5) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• 2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
• Extracted Njrat config (0 C2) - engine signal, weight 0.45, confidence 0.60
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

11887 behavior events · 2 ATT&CK techniques · 14 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• licensing.mp.microsoft.com
• settings-win.data.microsoft.com

Dropped files

• C:\Users\analyst\AppData\Local\Temp\FransescoPast.txt - 91d4008433cf5ca959c43bd718af7f73126c9556136091a4ede523574e6410ff
• C:\autorun.inf - f87e55f1a423b65fd639146f71f6027dbd4d6e69b65d9a17f1744774aa6589e1
• C:\Users\analyst\AppData\Roaming\app - 275918973c23ad700f278c69cc03c9c82ec9f4d9ed0f53111ad22bec197ff440
• 4f70d2c013bc132ebed46e434ee32f3fb78032ebea66b8e83f0bec807fb2fb5c - 4f70d2c013bc132ebed46e434ee32f3fb78032ebea66b8e83f0bec807fb2fb5c
• fbac2240fa5ac04387ebd9bb3ae15f62a4e27ede91338494e530dbadef6eb494 - fbac2240fa5ac04387ebd9bb3ae15f62a4e27ede91338494e530dbadef6eb494
• 0c1ce4b7c2f3aaf207d04bb4085af6eebfef8a56a1ca7eb9e7a6ec91fc81da42 - 0c1ce4b7c2f3aaf207d04bb4085af6eebfef8a56a1ca7eb9e7a6ec91fc81da42
• dc056e846922bb4630548e68780b9479020cac863ce72203495ca3ae72a77162 - dc056e846922bb4630548e68780b9479020cac863ce72203495ca3ae72a77162
• 0c446fdac1ae27a072a5ef35876c9cdaabc2e4bc021fb423f0f3a260a92af537 - 0c446fdac1ae27a072a5ef35876c9cdaabc2e4bc021fb423f0f3a260a92af537
• acfe98d550071d6e6c263bcbe2b747ca05cf1038cb3c4d4bfd4de170148122fe - acfe98d550071d6e6c263bcbe2b747ca05cf1038cb3c4d4bfd4de170148122fe
• a5873007f0b011228e6f69f1c007c7045b72131ef53f893519b5a33981fb81be - a5873007f0b011228e6f69f1c007c7045b72131ef53f893519b5a33981fb81be
• 24acb5385a64572532f50d6558c8decb8ba6c012bf4b69415b531bc64f6bb665 - 24acb5385a64572532f50d6558c8decb8ba6c012bf4b69415b531bc64f6bb665
• 1f0ae83e4510042c1a953ef74678422ffa061b4cae71487f28b6da838f062c5d - 1f0ae83e4510042c1a953ef74678422ffa061b4cae71487f28b6da838f062c5d
• 97bf0f35b3024ba09345966104595b921518559a676e3acc3779659bf857730c - 97bf0f35b3024ba09345966104595b921518559a676e3acc3779659bf857730c
• faef6ada1eec49858c808426ceca3099911784d03667abe2b8a7131b3988c64a - faef6ada1eec49858c808426ceca3099911784d03667abe2b8a7131b3988c64a

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 52.168.112.66
• 216.218.185.162
• 4.144.132.114
• 20.42.179.192
• 4.230.171.124
• 135.232.92.97
• 135.233.95.144
• 172.64.154.167
• 74.179.77.204
• 162.159.142.9
• 92.223.78.30
• 20.184.175.5
• 20.42.65.94
• 172.215.188.232
• 72.154.7.110
• 135.234.160.245
• 52.148.114.188
• 52.110.12.46
• 52.110.12.14

Registry keys

• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\
• HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
• HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\BIOS

File paths

• C:\WINDOWS\system32\drivers\etc\hosts

More Bladabindi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report