MALICIOUS — 67ce14617a72d0f6fa6f8f86fa4d10f8e3ea8f484d5335a1a3bacde4e98e5344

MALICIOUS — 67ce14617a72d0f6fa6f8f86fa4d10f8e3ea8f484d5335a1a3bacde4e98e5344 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Delf family. 6 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 67ce14617a72d0f6fa6f8f86fa4d10f8e3ea8f484d5335a1a3bacde4e98e5344
SHA-1: 012dccbee576d2079d6c75876c45b611b4136eb7
MD5: 9c7ec65b1c594d6c5547580bff58e877
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 1536:p4q8Q1xZtffrb8sjPFNhTYsFFrzckH2fmiteFgf23rP:qKtfDwsjPThTYszDH2fsF22z
TLSH: T102377D391F2A2B83FB71C7221C917B0F0062B979247A444D63A3D46F77EACA35A6415C
Submitted as: 67ce14617a72d0f6fa6f8f86fa4d10f8e3ea8f484d5335a1a3bacde4e98e5344
File type: pe · Size: 71680 bytes
Verdict: malicious (100/100) · Family: Delf

Detections (6 of 55 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload: MicrosoftEdge_X64_150.0.4078.105_150.0.4078.65.exe - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

57416 behavior events · 2 ATT&CK techniques · 82 dropped files.

Dropped files

C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64-arm.exe - fc7f8311df1c6de973e3a65895eae1d07f6d44518093a7c72a413c2490d1caed
C:\Program Files\LibreOffice\program\sbase.exe - adb34717a939f825fede695763310ffb45e96f0d2693e44ea0154c7a4d623b2e
C:\Program Files\LibreOffice\program\scalc.exe - 37fd3455ddb612f43e3a3fed0c1b727cbd25a5eacc567f5d7f2c344eaf18cebe
C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.105\copilotapp.exe - 9550532e5ae22ffe8e74214518cf46678375735f5e6d46e33cdf31f427b78eaa
C:\Program Files\LibreOffice\program\gpgme-w32spawn.exe - 480507489844c8b71025c2e04cca58dbaaa32d3f206eb469f4fb79a080ec92fb
C:\Program Files\LibreOffice\program\soffice_safe.exe - 51ae3e138da089b3776e99dbb3009ea0499e1b0642f3eb738438d198909943e3
C:\Program Files (x86)\Microsoft\EdgeUpdate\Download\{56EB18F8-B008-4CBD-B6D2-8C97FE7E9062}\150.0.4078.105\MicrosoftEdge_X64_150.0.4078.105_150.0.4078.65.exe - 0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f
C:\ProgramData\Microsoft\Windows Defender\Platform\4.18.26060.3008-0\X86\MpCmdRun.exe - 619c26b988d455c0fd10658ed82712f292e327ed7bf8d2f07047a96bcfdc11f2
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\LibreOffice\program\regview.exe - 32b68a2a059bf66482e2a49d205a3b2bbede75e3b98fdaf466e2bc67193564a3
C:\Program Files (x86)\Microsoft\Edge\Application\150.0.4078.105\BHO\ie_to_edge_stub.exe - 616981d515ec20a8b41fd42f111559eb58a7a1297247b7760553edcb224c40aa
C:\Program Files\LibreOffice\program\soffice.exe - 8cef10a1542e44308e268627d883594a8d0280c996cefa81f4380f42c372d971
C:\Program Files\LibreOffice\program\opencltest.exe - d0f76cba71662a3fcd63731a490d41b0e9b71484172ff55d27f5e9e8fd0f69b5
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe - 813abe855943af94ec3ee19cde7c843d34f697562ff6eb9205ea7ff5a791c9b7
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-64.exe - 743ad555a5213aee5a9d643bf5ac43c0e1c0bd6b64efdffbc5af1889ada33921

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787808658&P2=404&P3=2&P4=KYmIt7u%2b80jb3VJNP021vDzd8AlzHvjumApafLsReDkNjNBIltd6uRgoDl7rpBRo07eLoso3%2f%2bcreS2FwfC4pg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787808780&P2=404&P3=2&P4=kMLFX%2f3RW76HCihwdAIphN2SbxXyFkyH5B14ZN0aJiFVDuJj1x%2f1NqXj9mjwjRHlTJZQo7LMglg763FGQjhXaA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

192.168.0.30
192.168.8.1
52.123.252.212
52.168.112.66
4.230.171.124
20.247.184.142
85.210.196.11
20.165.94.63
74.178.240.51
4.207.44.72
20.231.239.246
52.123.128.14
52.123.129.14
172.178.240.163
203.26.79.13
162.159.142.9
4.247.188.233
20.42.65.93
52.148.114.188
135.234.160.244
125.56.205.25
125.56.205.17
52.123.252.243
135.232.92.34
52.123.252.202

File paths

c:\graphviz-ms\bin\gvcolor.pdb

More Delf samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report