MALICIOUS — CPWBRN.exe

MALICIOUS — CPWBRN.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Aenjaris family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 6fa1b1bb8d48230324f7508681129913720b78b992f875dc8206e7e82b60f17d
SHA-1: c6a6c8f2ffedfa10a2003e13a8cc3e23057633b5
MD5: ecd97b567484da0c2a0b8f0c283f22cc
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 6144:LPhCJuWhZ1dhI8rixOluRAvRQu4rQEj1:rhCJRhZ1vTiMMAZQuMQC
TLSH: T186429EDC0E3F019ACD35D25D2F72E90DA299A4C6203C399DC1979236C5E705F6AB087A
Submitted as: CPWBRN.exe
File type: pe · Size: 212992 bytes
Verdict: malicious (99/100) · Family: Aenjaris

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Trojan.Agent.DCBC
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Zusy): KKXBZ.exe - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 29 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

40929 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\KKXBZ.exe - 954cace2aa2d71da26d874b5b050d0b97432843bac56d5099600be95f8d6bdb8
C:\Windows\System32\PUWUM.exe - c74196dc50881d43a9cba727860712516d4978de37be3c99e4a5147d68aa1cf2
C:\Windows\OZT.exe - 309424b3bf9c3cd155343ed1f5c478ffbf8ef3b7747009373381bd3583992845
C:\Windows\System\IYJZ.exe - 5c1db2abd3e630a6ecae1d00af49aa245c7f9c9279fc3516ad738b0d47d72a70
C:\Windows\System32\WEGGM.exe - dd775509d5df3aafe367c3cc3f61ae33f3e7bbc099a8f46af336266e5bcb0ea3
C:\Windows\System\IAHPKJ.exe - ae39d78f870a903f4b42329956536d58b8f7b582319f70f895a9e8db06b2c33e
C:\Windows\DIFKK.exe - b502180a9514c894020dbe1bdab906d37acd008dbe700a44a881a3351f9540e3
C:\Windows\System\JFNED.exe - d106531608f4b3f7ac9f30ac7b80a203eea9644533812e93b5d0c5d8b743cdbf
C:\Windows\System\FPDBQ.exe - 97182e8d0c17a57d8bc0f513dbd1779927834e032eb2d85b6e742c08f92a0a53
C:\Windows\System32\RFKOI.exe - db9017b9683d7c2c590bb25f724360299842020c57425f659ff5035a85d934fb

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787643023&P2=404&P3=2&P4=SFlV14SdJc%2fHUA2kcHJLLOzuku6sov5Ul7FYK8qdjmCcz3ZSgh8dL%2bRuvbHIslpFAngLzHCHLqVGfTq2klTHfA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787643132&P2=404&P3=2&P4=BOsg14mBbNd31c4HoIbeYqeDs6q5LEbiFqspGdlAWqQ7kB2VneINATa0M6BstXu%2fxIlOWVDQ4SQ8AXRY6QErVg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.123.252.239
20.52.64.201
4.230.171.124
4.144.132.223
85.210.196.11
74.178.76.128
20.184.175.4
20.165.94.54
20.76.201.171
52.123.128.14
52.123.129.14
135.232.92.34
135.233.45.222
135.234.160.245
52.123.252.231
203.26.79.13
52.148.114.188
135.234.160.244
172.178.240.161
135.233.45.223
172.178.240.162
52.123.252.198
20.165.94.46
52.123.252.194
72.154.7.113

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Aenjaris samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report