MALICIOUS — 7cc147e15c5135e6e7f37ce6709383a0e766fed3224e302ea2c30d273893faea

MALICIOUS — 7cc147e15c5135e6e7f37ce6709383a0e766fed3224e302ea2c30d273893faea is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AB9A06E4 family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7cc147e15c5135e6e7f37ce6709383a0e766fed3224e302ea2c30d273893faea
SHA-1: 18792f10514e346508dd15affc5a8428996be5c3
MD5: fb84f491202281799b54b2cc2f2212cb
imphash: 532816589b7c9c3bed0fbcc3d1503ba1
ssdeep: 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8QpjBFy11Aw2:o68i3odBiTl2+TCU/xhuhuIpRLy
TLSH: T167436DBE4B277B43D132C7580D095E9F0032B49EA13D64CC5A63942DA7FBC27B64819A
Submitted as: 7cc147e15c5135e6e7f37ce6709383a0e766fed3224e302ea2c30d273893faea
File type: pe · Size: 222467 bytes
Verdict: malicious (100/100) · Family: AB9A06E4

Detections (6 of 55 engines)

ClamAV (daily): Win.Worm.Nupik-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Worm:Win32/Delf.BE!MTB
Emsisoft (Emergency Kit): Dropped:Generic.Malware.SV!p2p!u.AB9A06E4
Kaspersky (KVRT): P2P-Worm.Win32.VB.dz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Nupik-1 (rule Win.Worm.Nupik-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: BalROK.HTML - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 3.6.1.0, 5.0.3.6 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10779 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\SHARE_TEMP\Icon12.ico - 67bc1cd876f5059789b0dc8dc16c0b2155e55aca8d1c8439d70c8882e1875740
C:\BalROK.HTML - 3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4
C:\Windows\winhash_up.exe - ae9a4be52523803b312a7dbdc094b37bce54990c41f174d608fab723d75010f7
C:\Windows\SHARE_TEMP\Icon6.ico - 0df5c718b7aee9f045f804f6a53cb0727f66e1ac1df612c6ecf342aed81ce130
C:\Windows\bugMAKER.bat - 3058dd7cf3e819033729bbb82e76be7c5d2fc7b5e2fbfdf94656967f25728562
C:\Windows\SHARE_TEMP\Icon2.ico - 00a339ff5338d0cfe91b262175eef4e5fd07f9d28e8f980a1f5ff43a5a81e597
C:\Windows\SHARE_TEMP\Icon7.ico - 71acc5a88debfdba0eed23272ef4b09fd6609eeb4b1ec457c72444472ad8b3a4
C:\Windows\SHARE_TEMP\Icon3.ico - d2770f68db717c5335ceca3f2b0be1e294839a4904d3525f4c5e9847654d39c2
C:\Windows\SHARE_TEMP\Icon14.ico - adb0b5eb4fcfcc55c40eaa2ba3d142ed413293b2212bb2a1ddd8ed062db004bf
C:\Windows\SHARE_TEMP\Icon10.ico - 76f05dd79b2d3a08baf928e4811b0f179e96ac351ff8007f2e24f5fbb4b95253
C:\Windows\SHARE_TEMP\Icon5.ico - 462d333fc849166df8cb4e9ba6edd8404f4d79ebcd535125ecb5e8fe9d2cc0e0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787938861&P2=404&P3=2&P4=JayaHlwtYIQXbAZl3iwnCYjmBXcVvh4CjpXNZMAsxxzjXAve2qy4po6HKZ9Sm8SBoo2mGNSYdSZ96Ekgi1X%2fng%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787938966&P2=404&P3=2&P4=jW033ptkWcyZ5SJvTi16qXjEwFg%2fTfFfUpWi4qjWveLIpsjohz2qJrOyL4VRE%2b9OlVopMQi6eUA6N2rWw4XLCw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

3.6.1.0
5.0.3.6
4.207.44.68
52.123.252.192
20.42.179.204
4.230.171.124
52.253.84.76
135.232.92.137
20.42.65.93
74.178.76.54
20.236.44.162
52.123.128.14
40.99.133.210
172.66.2.5
52.123.129.14
74.178.76.128
172.178.240.161
203.26.79.13
52.148.114.188
135.234.160.245
135.233.95.80
72.154.7.16
40.79.167.10
20.42.65.91
92.223.78.30

File paths

C:\Programme\eMule

More AB9A06E4 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report