MALICIOUS — VESSEL PARTICULARS - MV SM TBN_Scanned.exe

MALICIOUS — VESSEL PARTICULARS - MV SM TBN_Scanned.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Bladabindi family. 8 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 69df3b19d7e8d6efdead03281f2cb9aa262a123260c56171678d592fc264df20
SHA-1: ee58b2776f2863f6c642e16544c4e28d2942a4e8
MD5: e45fe8d1887f01ac4b9582f3e31ed9c4
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:R2HFfyEm22rxnkB4mdqODvzC4Pa9yF/c5Og5zfje:LEoMqODzzt//glfj
TLSH: T13B5103D158344F04C3D56A8B06705B2ED951FBEEC1D063A9A639113C89BFCEB21E2B52
Submitted as: VESSEL PARTICULARS - MV SM TBN_Scanned.exe
File type: pe · Size: 841728 bytes
Verdict: malicious (99/100) · Family: Bladabindi

Detections (8 of 55 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Packed.Bladabindi-10017208-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:MSIL/AgentTesla
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Loki.1701
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Bladabindi-10017208-0 (rule Win.Packed.Bladabindi-10017208-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Scheduled Task / Job [medium] (rule tl-scheduled-task) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

6277 behavior events · 2 ATT&CK techniques · 14 dropped files.

Dropped files

8a5b6adc1746c0f6507d3dc07173b27c5c05255059e59e4b8c04e0928f1857db - 8a5b6adc1746c0f6507d3dc07173b27c5c05255059e59e4b8c04e0928f1857db
aef96b332ef7d16be58409be9ac8a84b06ddd4dde4b17dde4a8e029c8cfd0a51 - aef96b332ef7d16be58409be9ac8a84b06ddd4dde4b17dde4a8e029c8cfd0a51
31e71ba43bcdcd6ccae206443774dbd42f6228bd4dc973e95d7ecd4c3633e9d1 - 31e71ba43bcdcd6ccae206443774dbd42f6228bd4dc973e95d7ecd4c3633e9d1
e5f79c8b5307339433fe546c228ec2884bf7711529df6ce877de9286912d3728 - e5f79c8b5307339433fe546c228ec2884bf7711529df6ce877de9286912d3728
8be2bb2d85a709a8fe322369deec490d0d91bdcb3fad057a361bbd86609136b6 - 8be2bb2d85a709a8fe322369deec490d0d91bdcb3fad057a361bbd86609136b6
c9681b55944731cb097600b41f27a70c870b264dfeee4054db3acd6570c57ade - c9681b55944731cb097600b41f27a70c870b264dfeee4054db3acd6570c57ade
c6323694416bbec2ed0440ed601cbcfe8a6fa71204672c93b337de6f02dd8501 - c6323694416bbec2ed0440ed601cbcfe8a6fa71204672c93b337de6f02dd8501
f89c6b229ba5bd66ddcda21891d08f44b384ceed16d1f0f8c8d0afa6c6a8c021 - f89c6b229ba5bd66ddcda21891d08f44b384ceed16d1f0f8c8d0afa6c6a8c021
520842bbeb7ad2a4741183beca1cdb57cee58e33f23b192b2633737e132af664 - 520842bbeb7ad2a4741183beca1cdb57cee58e33f23b192b2633737e132af664
831049b60f4dac31ff2ccb1f77b2e9b6816c6b6dfa59033c12b35b8f7a6c3854 - 831049b60f4dac31ff2ccb1f77b2e9b6816c6b6dfa59033c12b35b8f7a6c3854
27171ff4cfb11bbef3460d64db6aa92d5f10a4a1eec10d13986e9d5161e775d2 - 27171ff4cfb11bbef3460d64db6aa92d5f10a4a1eec10d13986e9d5161e775d2
0bd5159ff3b310e3c8d3779bafb6812a1a9e99e1aa2c9d8b1013cc49f75f6e0a - 0bd5159ff3b310e3c8d3779bafb6812a1a9e99e1aa2c9d8b1013cc49f75f6e0a
27c96f2d4775db2b077bb5e0579615103b5e16622d4d21f607f3d0d1b35a49c9 - 27c96f2d4775db2b077bb5e0579615103b5e16622d4d21f607f3d0d1b35a49c9
5524f9e719a83c8779679c4e7c2d74d0339120ce2dd4bfcfeadaee38ba589d81 - 5524f9e719a83c8779679c4e7c2d74d0339120ce2dd4bfcfeadaee38ba589d81

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787870751&P2=404&P3=2&P4=PCRVvdCTSoZ7RuU8Ph4xU2b7QMMp1SBD%2f2h0q9Uu5gU%2fXxJ7nnnm5hvI%2bB1ZzccvnP7Jy4WuhILWSvErOa52wA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787870809&P2=404&P3=2&P4=aJOZ5LZ3vh2VkHL%2fCPmP7nzcMhe2b1dH0oSxAOo2DkS46oKClLfxj7NCKIEPEUTUd4z0irhS%2bBouUExcq4TuvA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.16
52.230.59.222
40.84.97.4
4.230.171.124
57.155.104.224
74.179.71.159
20.165.94.63
52.168.117.169
74.178.76.54
203.26.79.13
20.112.250.133
40.99.134.2
52.123.129.14
40.99.134.18
52.123.128.14
4.207.44.76
135.234.160.244
52.110.12.21
52.110.12.32
135.234.160.246
52.148.114.188
4.150.223.111
40.79.150.123
72.145.35.109
52.110.12.55

More Bladabindi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report