MALICIOUS — 7d18fff7b88f96be68f4862a87ab6991f5163ea2893d94f85b27e58504c3015d

MALICIOUS — 7d18fff7b88f96be68f4862a87ab6991f5163ea2893d94f85b27e58504c3015d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the DCOM family. 5 of 55 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: 7d18fff7b88f96be68f4862a87ab6991f5163ea2893d94f85b27e58504c3015d
SHA-1: 41ac3c0205d4882d656367f8cf072a19f4fcd129
MD5: b2fd67c3e3fbd71c292c56f5d32c482f
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 49152:MlNloD7DAQ6IiImVR6Ibg11FMc8Gok1ZqmNgluOr4lb0nHHrzzeV5MPAhgUP3F5:zD7DKdQ1FMcEk1UmK4ynHw8QF5gKQ
TLSH: T183656CC5A204EF46F2F2CED44C18C7AC1172FADA70BD1E9C46D3941E65B3827B4891A9
Submitted as: 7d18fff7b88f96be68f4862a87ab6991f5163ea2893d94f85b27e58504c3015d
File type: pe · Size: 5910528 bytes
Verdict: malicious (99/100) · Family: DCOM

Detections (5 of 55 engines)

capa (capabilities): capability:credential-access
ClamAV (daily): Win.Exploit.DCOM-5
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/CryptInject!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Exploit.DCOM-5 (rule Win.Exploit.DCOM-5) - engine signal, weight 0.90, confidence 0.95
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Terminates Browser, Office or Security Processes [medium] (rule tl-process-kill) - dynamic signal, weight 0.40, confidence 0.90
Contacted 58 external host(s) at runtime (28 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

51785 behavior events · 2 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Windows\lsasetup.log - 212f30fea1fd2ed1d65e7a2940a574c2e4da829da9b34b9a930c1e49b3a0ac1b
C:\Windows\System32\vccorlib140.dll - a132b7053d35551e0412c1e417f58bfbe3feb58e2dd41133672cb52d96c1c397
C:\Windows\Professional.xml - 20e7a00b70385a50b6c60c64903c0cd67a09ee08dd76a14d84f3ac0b1676afe8
C:\Windows\System32\vcruntime140.dll - d283af5022501075518c0e79ba9d797fb39d1046963d0058d9b734ffc4137722
C:\Windows\setuperr.log - dcdaabc22aa9ac45124185bae15bb5c63f905c6b6f1df68ba115e675d0fc379a
C:\Windows\System32\concrt140.dll - 002c5caed6c9aa018c6f34fd25247326bbb4f66bf7036f99f6414fcaae5186c1
C:\Windows\System32\vulkan-1.dll - c7500d75935cacfdfa5a475d2bcb4c393ea369902e6d26a25acb0e7006066bb8
C:\Windows\System32\vcruntime140_threads.dll - a3db2c42363e8dc3a543c96cb9c18f92fd22aca998f64d161c5bccf9011f8013
C:\Windows\System32\NOISE.DAT - a5798379209972a32c1473385cf8c6fd40361e4a830eb66885af174fffe504d8
C:\Windows\System32\msvcp140_1.dll - 11f680ecb9d8fed7e705e1a7a87a8b30daafee4ed69a737d7bbf193789b2da80
C:\Windows\SysmonDrv.sys - 432f8691dae12bd26e81ed5508491089793b38a2677a89eb2b5f43315bcd51e2
C:\Windows\System32\msclmd.dll - 623171392fc592c088ef0c01ab158ef6561631b7cb8c2494ec38e5ead9c8639e
C:\Windows\win.ini - f584ed1995781bc92f7855b6c8cd3fa509fdf8f88e805fe478ed085f6b20d099
C:\Windows\DtcInstall.log - 0b5893cd8f68e3b85e8fb221c30dff46422f0e30d3c3894ea786ed354df39814
C:\Windows\WindowsUpdate.log - 31505af2e2a3075e4434e7fe30e5bcfdec8f4c6b52b9012033f5a2c186d18ff6

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/windows0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.microsoft.com/pki/certs/CSPCA.crt0
http://www.microsoft.com/pki/certs/tspca.crt0
http://schemas.microsoft.com/xps/2005/06
http://tempuri.org/
http://xml.org/sax/properties/declaration-handler
http://xml.org/sax/properties/lexical-handler
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787872567&P2=404&P3=2&P4=S9yjLK1f49FwEwKSxnI89vVT5gGibBkhqSGfSf9sXYEazS7hbNzfcFiAXs8UEi6%2f464ZoBDqYKfbDu9hhnshIw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787872671&P2=404&P3=2&P4=higmup%2fo2Fx10k%2fajIL6gWk%2bxPL0IknB4t31kQVEA3MJ2eSF8HZLkTkdmlqlOKrOMXdFByGii3%2bGyhDqMHjFyA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
www.microsoft.com
crl.microsoft.com
q.sh
r.pw
q.pw
r.sh
q.ws
schemas.microsoft.com
q.jp
t.it
tempuri.org
xml.org
www.avira.com
script.crazyegg.com
assets.adobedtm.com
nexus.ensighten.com
t.nc0.co
doh.cq0.co

Embedded IP addresses

212.33.237.86
102.37.64.169
20.247.185.124
4.230.171.124
40.84.97.4
135.233.95.144
40.79.167.10
135.232.92.97
4.150.223.110
20.112.250.133
52.123.128.14
52.123.129.14
203.26.79.13
172.178.240.163
92.223.78.30
52.123.252.239
74.178.76.44
52.148.114.188
4.150.223.108
48.192.143.121
20.184.175.12
52.168.112.67
52.58.28.12
20.11.121.11
4.237.188.71

Registry keys

HKEY_LOCAL_MACHINE\Software\Classes\{0}.

File paths

C:\Program
C:\\Program
C:\\$SysReset\Scratch\csrss.exe
C:\\cpzjgyoc\bin\is32bit.exe
C:\\cpzjgyoc\bin\execsc.exe
C:\\Windows\Microsoft.NET\Framework\v3.0\Windows
X:\:`:d:h:l:p:t:x:
X:\:`:
T:\:d:l:t:
C:\\Windows\assembly\GAC_MSIL\ComSvcConfig\3.0.0.0__b03f5f7f11d50a3a\ComSvcConfig.exe
f:\dd\Tools\devdiv\FinalPublicKey.snk

More DCOM samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report