MALICIOUS — 6680ec573e69d63dcbdee8e2645ed99839143857bd5719a2173c6bc2218a7efa

MALICIOUS — 6680ec573e69d63dcbdee8e2645ed99839143857bd5719a2173c6bc2218a7efa is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Bladabindi family. 2 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 6680ec573e69d63dcbdee8e2645ed99839143857bd5719a2173c6bc2218a7efa
SHA-1: 4a53e64344310e42ff6a0073d4210dad45f9fd0d
MD5: fd95374d4da070ed16a2a48130c84fc4
imphash: 771106f54fcc51d1aa3989e528332f80
ssdeep: 6144:9ldk1cWQRNTBDRoPgr6ZUJpQSGqyVVA27VlD:9cv0NTB8ZUnQbVm2X
TLSH: T14442E12283921349E5EFF6F78A64AE5D4003B1B4127C45C9964BDC2D22E2C377BBB095
Submitted as: 6680ec573e69d63dcbdee8e2645ed99839143857bd5719a2173c6bc2218a7efa
File type: pe · Size: 211968 bytes
Verdict: malicious (99/100) · Family: Bladabindi

Detections (2 of 56 engines)

Microsoft Defender: flagged
Kaspersky (KVRT): UDS:Backdoor.MSIL.Bladabindi.bqyt

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 12 weighted signals:

Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. process hollowing in zylrl.exe (pid 9148) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Backdoor.MSIL.Bladabindi.bqyt (rule UDS:Backdoor.MSIL.Bladabindi.bqyt) - engine signal, weight 0.55, confidence 0.85
1 IDS alert(s): ThreatLens ngrok tunnel C2 - network signal, weight 0.50, confidence 0.80
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted Njrat config (0 C2) - engine signal, weight 0.45, confidence 0.60
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

22701 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\t7pb6zct.out - 96102d2514dadb8b97df4db43fddbd2cc64e1f5e4ab80995423ab66e8d386fab
C:\Users\analyst\AppData\Local\Temp\CSC88D2.tmp - 2859812cbfbdb17253574708abbec044da4c27b02631da27fbdf6c56b9b1442d
C:\Users\analyst\AppData\Local\Temp\RES88E3.tmp - 0e77a1c508fb045d0fbd4ae3bf0874093652553fe57beb106c03862d88f0c7c4
C:\Users\analyst\AppData\Local\Temp\EF90.tmp\EFB0.tmp\EFD0.bat - bf16c54746f5ab6cb77912afa8197b5b769cb6e9f91d0c3c69a1bcc13792cdee
C:\Users\analyst\AppData\Local\Temp\tmp508C.tmp.txt - 1a32fa5b1604d1afed61db834819709b80da586adf26f8c7ba1cbf2176ffa62d
C:\Users\analyst\AppData\Local\Temp\zylrl.exe - eb15d5249a898a730fb34f29795dfd23c4557f74437a6b5af36a74c47b5e5818
C:\Users\analyst\AppData\Local\Temp\t7pb6zct.dll - f2e9e970d673e5e63fd239344685ec2c7c428e2d72ce80399f47ab414cdf07b1
C:\Users\analyst\AppData\Local\Temp\t7pb6zct.cmdline - 4e8b26b881f8c9bae9ab76cfb48f28cf876c15432669455e95d39c6fc65c4cf5
67288c83b919c6cb9cefdaaf93b39fbb1e2696df0b89c97c70011de8afbd00e0 - 67288c83b919c6cb9cefdaaf93b39fbb1e2696df0b89c97c70011de8afbd00e0
2a06447df834cdfcf3cd35a33fe65e1271c619f7e1c5e37728f7d074105b1667 - 2a06447df834cdfcf3cd35a33fe65e1271c619f7e1c5e37728f7d074105b1667
f3b518bad18d39352129105bcdb3085e53d342e9a53612cb40233a4194b32174 - f3b518bad18d39352129105bcdb3085e53d342e9a53612cb40233a4194b32174
5a7607ee4a81bc8c276388bb59342ce7e8102b11a91c3732167cee213e89fd9e - 5a7607ee4a81bc8c276388bb59342ce7e8102b11a91c3732167cee213e89fd9e
83d071d2040bf85563ab1bf54d0531f15a09cd852e1d27b5acb939098ad5eb79 - 83d071d2040bf85563ab1bf54d0531f15a09cd852e1d27b5acb939098ad5eb79
b8d53eb3013d39e1e926d78563c813416d1532d8465220f3b255eb7c72f17ef7 - b8d53eb3013d39e1e926d78563c813416d1532d8465220f3b255eb7c72f17ef7
f51c8c700ec284fbd6da440d4bfa872810a045a12f1b4c756962bdc561378652 - f51c8c700ec284fbd6da440d4bfa872810a045a12f1b4c756962bdc561378652

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
0.tcp.ap.ngrok.io

Embedded IP addresses

20.184.175.19
52.123.252.232
4.230.171.124
4.247.188.233
57.154.63.210
20.247.184.142
20.165.94.63
20.184.175.0
74.178.240.51
104.18.33.89
104.208.16.94
52.110.12.3
52.110.12.26
13.228.171.119
18.138.220.214
92.223.78.30
13.213.213.17
4.150.223.113
20.42.73.24
52.148.114.188
72.145.35.104
52.110.12.52
52.110.12.4

More Bladabindi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report