SUSPICIOUS — 52e64074632c52e7a6090f9bf6c08f077b452916a77fb8d7b5c6333e356decdb
SUSPICIOUS — 52e64074632c52e7a6090f9bf6c08f077b452916a77fb8d7b5c6333e356decdb is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
52e64074632c52e7a6090f9bf6c08f077b452916a77fb8d7b5c6333e356decdb - SHA-1:
754cd645028bf5b88e84e912bf438549271bdb6d - MD5:
4090b3f23b9daa912707de799200acba - imphash:
8300463f05292fea2e60b982d3c5a81a - ssdeep:
196608:DXC9B19UimSkHfXO0zCNp5nwy5/jEbNeSmp0Js3zQhv9MT3XCXhgDghWCQGhuug:DC9BLULSkHfe0kp5nw6ymp02UnSHCXh - TLSH:
T1F46CE194B2BB2513C7BF4B609727AB7FF5A70458A0E20D8A4917E60C9146E373670D23 - Submitted as: 52e64074632c52e7a6090f9bf6c08f077b452916a77fb8d7b5c6333e356decdb
- File type: pe · Size: 11141120 bytes
- Verdict: suspicious (54/100)
Detections (2 of 55 engines)
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Kaspersky (KVRT): Trojan.Win64.Donut.dtu
MITRE ATT&CK
Why this verdict
The suspicious score of 54/100 is the fusion of 5 weighted signals:
- Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 33 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
425 behavior events · 2 ATT&CK techniques · 4 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- kaceloj.com
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- config.edge.skype.com
- v20.events.data.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- 4ed7f38a2df36ec0ba759ba24899e116353d48bbc54b06384ea2576c4b78c294 -
4ed7f38a2df36ec0ba759ba24899e116353d48bbc54b06384ea2576c4b78c294 - 311a4dd63a81093fe001be603de14b5f7d19300e81a1bd99d822979fc392f05d -
311a4dd63a81093fe001be603de14b5f7d19300e81a1bd99d822979fc392f05d - 81d04edc341a96715d59e1efb918b2cf6d9ea404f926ab74079a39a3e98a5e2d -
81d04edc341a96715d59e1efb918b2cf6d9ea404f926ab74079a39a3e98a5e2d - 8d9fd16ce635b0fbffc08f43d27d238442b41cce1a307e2c1e9bb65817abc83e -
8d9fd16ce635b0fbffc08f43d27d238442b41cce1a307e2c1e9bb65817abc83e
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787809607&P2=404&P3=2&P4=V781FXyDuGWu2JtaZRwLbuytaTpUlL9wRUobDHQGRntjmDiqvTAUEOCscy4lZab9rT7F7jqTzlkI%2bgBXlQgD1Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787809619&P2=404&P3=2&P4=XE2xCNCsyeIoABXZRlPiJFk9wGzVffVrTwmDFlqxafT2kPKni%2fJGegC%2bygDb%2fu0buZKAmrgK7QA2VofyZa%2byTA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787206316&P2=404&P3=2&P4=gMZTulo7PKri%2flvxdLfj5t7b%2bXnzWr9Dd1QSKyZGuklgr1jlJCK9ZX8GIDkhGAAsQb17iO4NAoKuaD0z%2fccFUg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787205834&P2=404&P3=2&P4=GFVHco4REoVEy92oauD6qC%2bK1AVvR4d5ifeZiMkTWMfVxFCjfDxj0y0kllquLsWnBnaYU3eyg8sPtmw7VT%2bwkA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- ta.kr
- 9y.pl
- n.tk
- 0o.fr
- github.com
- kaceloj.com
Embedded IP addresses
- 52.123.252.235
- 20.184.175.3
- 172.215.188.225
- 4.230.171.124
- 4.144.132.223
- 20.165.94.63
- 74.178.240.51
- 20.42.65.90
- 52.123.129.14
- 20.236.44.162
- 52.123.128.14
- 20.50.201.206
- 172.178.240.163
- 52.110.12.47
- 52.110.12.37
- 52.123.252.194
- 74.178.232.29
- 203.26.79.13
- 52.148.114.188
- 172.66.2.5
- 125.56.205.34
- 125.56.205.51
- 4.150.223.102
- 20.42.73.28
- 172.175.111.170
File paths
- B:\`
- B:\`15
- j:\`
- B:\l
- c:\h+
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\fmt\moxksf
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\num\moxksf
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\ptr\moxksf
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\char\moxksf
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\core\src\slice\moxksf
- C:\Users\Administrator\.cargo\registry\src\github.com-1ecc6299db9ec823\http-0.2.5\src\uri\moxksfh
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\thread\moxksffailed
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\io\moxksf
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\sys_common\moxksf
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\..\..\backtrace\src\symbolize\moxksf
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\sys\windows\ranxksf
- C:\Users\Administrator\.rustup\toolchains\nightly-x86_64-pc-windows-msvc\lib\rustlib\src\rust\library\std\src\sys\windows\moxksf
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report