MALICIOUS — 650e1922f188d2400dfe27a4c941a978964ed11bc39ddd45d586520fb03dc4ab

MALICIOUS — 650e1922f188d2400dfe27a4c941a978964ed11bc39ddd45d586520fb03dc4ab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Blocker family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 650e1922f188d2400dfe27a4c941a978964ed11bc39ddd45d586520fb03dc4ab
SHA-1: 9270dd3684b37e1f622a5f06946ead85b228359c
MD5: 9619e6f97d758b45e3bf59ad80530828
imphash: 8d08b9aff260461badc1821f4f717247
ssdeep: 196608:05azg7DS85azg7DS85azg7DS85azg7DSv:xg7u5g7u5g7u5g7uv
TLSH: T1086923BE131B7403DE2AD62964852FCD04337C6D507D6888467B84BD83F6CEB26817A9
Submitted as: 650e1922f188d2400dfe27a4c941a978964ed11bc39ddd45d586520fb03dc4ab
File type: pe · Size: 8316928 bytes
Verdict: malicious (100/100) · Family: Blocker

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Mbrlock-9779766-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Blocker.EM!MTB
Emsisoft (Emergency Kit): Gen:Variant.Genie.689
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Mbrlock-9779766-0 (rule Win.Trojan.Mbrlock-9779766-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hollowing in 7D57AD13E21.ex (pid 8212) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Dropped a malicious payload: OScam Collection.htm - dynamic signal, weight 0.62, confidence 0.90
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

18953 behavior events · 3 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\top2.gif - 7cb06f8dbfa5f13359e2dcee822fae73ef01a00ff29ce99ec401a73017875aee
C:\Users\analyst\AppData\Local\Temp\OScam Collection.htm - fcd785d06efc594628f2460b3098d5b97633f2e4587be0fa50dd8cd60a447407
C:\Users\analyst\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT - b0715c24eef4c3d20c812bb858a4e50569a836f0217c7652fb350be953e5f50d
C:\Users\analyst\AppData\Roaming\Scegli_nome_allegato.exe - ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
C:\Users\analyst\AppData\Roaming\7D57AD13E21.exe - 93c076da6d4cf4fb020312b134f3eb39865ff149a2d8d1ecbb1436c8ddf5abda
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5 - 0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5
f647ad5887b1993d77bf5e2e6ab9f8ea77328ccf8f68fb78ffae77c1d8970310 - f647ad5887b1993d77bf5e2e6ab9f8ea77328ccf8f68fb78ffae77c1d8970310

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787858497&P2=404&P3=2&P4=YNoFX9Lqb%2f%2fIEjC2UE%2fF5Ds6vnjh2tIIfG40Yqf52ukCwgd0Fas1KAAPfTbh0Mo4%2brn8ZYMsRf6V5%2bN%2bh30HlA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787858544&P2=404&P3=2&P4=D7ownm9pRMQlk%2faw9FRru7xBgIn8oLUzIniReZikMkGbxazGo460Qyx5HBXytJRS8k2o8W8netnXv2PnvMBrQQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

hb.za
sunray1975.zapto.org

Embedded IP addresses

4.150.223.97
20.247.185.124
4.230.171.124
40.84.85.40
74.178.240.61
52.178.17.233
74.178.240.51
40.103.64.242
20.112.250.133
52.123.128.14
52.123.129.14
20.89.1.9
203.26.79.13
172.178.240.162
52.110.12.49
52.110.12.20
135.232.92.34
52.148.114.188
135.234.160.244
72.145.35.102
13.89.179.12
51.11.192.49
52.110.12.24
92.223.78.30

File paths

B:\:t:
X:\:`:d:h:l:p:t:
X:\:`:d:h:l:p:t:x:
J:\:`:d:h:
I:\ba

More Blocker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report