MALICIOUS — 554a09eb99f8dc5418a4e0f9cfb091a61dbe46d6d2cc7d4a0dce03f2c549b900

MALICIOUS — 554a09eb99f8dc5418a4e0f9cfb091a61dbe46d6d2cc7d4a0dce03f2c549b900 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Antitcpa family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 554a09eb99f8dc5418a4e0f9cfb091a61dbe46d6d2cc7d4a0dce03f2c549b900
• SHA-1: ab897e3046007773dc187779ced4ed9707239d78
• MD5: 33f89ef2d6d70093bd8b49bc5123bbad
• imphash: 98dfd9b9e184a03c6ea488ca38f4797e
• ssdeep: 196608:PUKKA0n9Tan9TBfUzn9Tfn9Tin9TBfU1n9TBfU1n9Tqn9Tin9Tin9Tin9Tin9TBD:MLQzMdczmzmccccczmK
• TLSH: T10A6AF195512115F2DA92CEA40DC03D0E1851B39A65FC3DDC8292552E3AFE2F3B44B3EA
• Submitted as: 554a09eb99f8dc5418a4e0f9cfb091a61dbe46d6d2cc7d4a0dce03f2c549b900
• File type: pe · Size: 9651535 bytes
• Verdict: malicious (100/100) · Family: Antitcpa

Detections (5 of 56 engines)

• ClamAV (daily): Win.Virus.Delf-9955432-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Virus:Win32/Antitcpa.A
• Emsisoft (Emergency Kit): Gen:Variant.Razy.666238
• Kaspersky (KVRT): Virus.Win32.HLLP.Atcpa

MITRE ATT&CK

• T1547.001
• T1071.001
• T1555.003
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

• ClamAV (daily) flagged Win.Virus.Delf-9955432-0 (rule Win.Virus.Delf-9955432-0) - engine signal, weight 0.90, confidence 0.95
• 1 behavioral detection(s) across 1 rule(s): Credential Access: browser credential store read [high] (rule tl-browser-credential-access) - dynamic signal, weight 0.60, confidence 0.90
• Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in _v_11722.exe (pid 7888) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Virus:Win32/Antitcpa.A (rule Virus:Win32/Antitcpa.A) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.666238 (rule Gen:Variant.Razy.666238) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.HLLP.Atcpa (rule Virus.Win32.HLLP.Atcpa) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://antitcpa.alsherok.net/ - static signal, weight 0.35, confidence 0.60
• communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
• Dropped 16 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12683 behavior events · 0 ATT&CK techniques · 16 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• officeclient.microsoft.com
• windows.msn.com
• www.msn.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• assets.msn.com

Dropped files

• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe - d91e412cb6af2e3d6c0d52430abc1cb985be7b2573436a8af1a72dc04b73db94
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe - 18014fce91300cfe2a5c1d02e97afdb4edca636938f7fd92de26c8ffecea4265
• C:\_v_11722.exe - 7eda1f422fcc705896e14d27e577f45505eb9a46efc6e2a302f29bb927a42c69
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe - e6ed0bf815332d31c279a702cec9ab24ba7a7f5d78c39e2c4fdb70da34be9e00
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncConfig.exe - f227b0bf56ea201dbbc61343fc26be9031987c165a0c7c87f6b2f76226c6e6a3
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe - 1a4209bf209cdae7fca8249145e1a7900ac227bcf47cefc9a2aa3d3ff580844d
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe - 61e7548a77637b785740a6b71fe729b8687aebdcc75cd6e2c0acc1a3c318d431
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe - a79a1abe596120cecef40c14748bac961cb2e5547e29312f372151e66b7d5297
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe - 1cf2bbd1ade6cdf658b93f8ea30b3e2693760b0d8d6bb07b6b6098147abcc3ac
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe - f06c5d70da484673c7fc597c7d227b9971c14b19bde77deb2818c06c444574d4
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\Microsoft.SharePoint.NativeMessagingClient.exe - 7116bbc6b64bd7c3e7d55b4e702e604bc96e775c3aa9353d144a641dcc0b9e1e
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe - 9c1ccbc1ff7e1916d5a7acab2555a6eecf33a09f896c9a339c75029ebccfca9b
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe - cbb35159235559d8095fc1dafc2f2000e4b292bc0661b5368972dd0ec8eeae45
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe - 38bdb1fdf044d9b61e16925d7cda86459f531baca8fe52f4c9f02c3c44f85086
• C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.139.0720.0007\FileSyncHelper.exe - ce7280c735a8699c8910161aa377bb8c7317085ee2d9c0c121386ead86dc7beb

Embedded URLs

• http://antitcpa.alsherok.net/
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• https://www.digicert.com/CPS0
• http://crl3.digicert.com/sha2-assured-cs-g1.crl05
• http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
• http://www.digicert.com/ssl-cps-repository.htm0
• http://www.w3.org/2000/09/xmldsig#
• http://www.w3.org/2001/XMLSchema-instance
• http://www.w3.org/2000/09/xmldsig#sha1
• http://www.w3.org/2001/10/xml-exc-c14n#
• http://www.w3.org/2000/09/xmldsig#rsa-sha1
• http://www.w3.org/2000/09/xmldsig#enveloped-signature
• http://schemas.microsoft.com/windows/rel/2005/reldata
• http://schemas.microsoft.com/windows/pki/2005/Authenticode
• http://crl.thawte.com/ThawteTimestampingCA.crl0
• http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
• http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
• http://appsyndication.org/2006/appsyn
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/

Embedded domains

• www.debian.org
• antitcpa.alsherok.net
• mb.fi
• www.microsoft.com
• crl.microsoft.com
• schemas.microsoft.com
• cacerts.digicert.com
• crl4.digicert.com
• crl3.digicert.com
• www.digicert.com
• www.w3.org
• crl.thawte.com
• ts-aia.ws.symantec.com
• ts-crl.ws.symantec.com
• appsyndication.org
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 20.42.65.94
• 52.123.252.248
• 4.230.171.124
• 40.84.97.4
• 52.230.60.54
• 74.179.77.204
• 104.18.33.89
• 74.179.77.164
• 4.150.223.108
• 52.168.117.169
• 172.66.2.5
• 72.154.7.99
• 52.148.114.188
• 52.110.12.20
• 52.110.12.11

File paths

• C:\Windows\assembly\NativeImages_v4.0.30319_64\System\37a1d51f35918dd36a0d4e34cc91732e\System.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Ga41585c2#\7145367d78cd9d75b5533cec821c7353\Microsoft.GroupPolicy.AdmTmplEditor.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\7e5e0d92b127a5150606d81839f29044\System.Drawing.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\028f9e8b0c8b1820df7bec952b01fe12\System.Windows.Forms.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\89bc329e8c65a9e13067c9776d925d78\System.Core.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\b5152c3c02957bbe4459505a39afde20\System.Configuration.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\1fb6db2ce6d2887fe6f8f620cb092343\System.Xml.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Accessibility\21911640a598b9b50a75e4b9b6330330\Accessibility.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\84e79f0f312051da07c0ef8e03e9b806\Microsoft.Windows.Diagnosis.SDHost.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\eabb9837f5b23a5b8642b1fa55a542f8\Microsoft.Windows.Diagnosis.SDCommon.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System\08f69c55e9284eaab92075159503c897\System.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\c9243edb149eb78c5309c103df69d594\System.Core.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\856ef0c3f77f0e7d984c459a8d14f3d1\System.Management.Automation.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\d6a8893f3487145ebaae571b4687a422\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\329a26f4f856d2a040b8eda57299e41b\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\3e37fa9245061c077bc55becb517178c\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392#\cb8547891bdb8618e887758003fbb2d9\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W79a81d80#\440436d8e5ce19b8f99412ccb9a4a207\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\84bc5f81d4b320ad03725fdf4b83edad\Microsoft.PowerShell.Commands.Diagnostics.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\db14181143f09a81576d6aaee8456d8d\System.Configuration.Install.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\d87d3a123dbd9e276731fecaf1bef78e\Microsoft.PowerShell.ConsoleHost.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\37a9a68365be3de74f8dca6abc84eaab\Microsoft.PowerShell.Commands.Utility.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\7ef1ed20d08c46ad7b5c8fb0e0763b3f\Microsoft.PowerShell.Commands.Management.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\51d0100cd8ab6937069b94a9f69b24f9\Microsoft.PowerShell.Security.ni.dll
• C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664#\81c861103c031d72dcd3ebcaaa3dface\Microsoft.WSMan.Management.ni.dll

More Antitcpa samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report