MALICIOUS — 7e5d462b1138905471a247b2039db755c561e70a4b4349a2c1a6d373b00100e8

MALICIOUS — 7e5d462b1138905471a247b2039db755c561e70a4b4349a2c1a6d373b00100e8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Blocker family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 7e5d462b1138905471a247b2039db755c561e70a4b4349a2c1a6d373b00100e8
SHA-1: a6ebbedf23cf02ae8edd0c13666d0727a4069578
MD5: 729379fdf127a41750564ddca6682ea1
imphash: 8d08b9aff260461badc1821f4f717247
ssdeep: 196608:8Aazg7DSmAazg7DSmAazg7DSmAazg7DSN:eg7uog7uog7uog7uN
TLSH: T1BF69237E130B7403DE2AD62564863FCD08637C6D507D5888553F84BE83F68EB27816AA
Submitted as: 7e5d462b1138905471a247b2039db755c561e70a4b4349a2c1a6d373b00100e8
File type: pe · Size: 8317440 bytes
Verdict: malicious (100/100) · Family: Blocker

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Mbrlock-9779766-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Blocker.EM!MTB
Emsisoft (Emergency Kit): Gen:Variant.Genie.689
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Trojan.Mbrlock-9779766-0 (rule Win.Trojan.Mbrlock-9779766-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. process hollowing in 7D57AD13E21.ex (pid 7040) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Dropped a malicious payload: OScam Collection.htm - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Blocker.EM!MTB (rule Trojan:Win32/Blocker.EM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Genie.689 (rule Gen:Variant.Genie.689) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Agent.gen (rule HEUR:Trojan.Win32.Agent.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

21776 behavior events · 3 ATT&CK techniques · 8 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\top2.gif - 7cb06f8dbfa5f13359e2dcee822fae73ef01a00ff29ce99ec401a73017875aee
C:\Users\analyst\AppData\Roaming\7D57AD13E21.exe - a83ffbfc0a6c78cf34641fc07ad00b76a2c688aa4afea0e3f80230c8ffea3202
C:\Users\analyst\AppData\Local\Temp\OScam Collection.htm - fcd785d06efc594628f2460b3098d5b97633f2e4587be0fa50dd8cd60a447407
C:\Users\analyst\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT - b0715c24eef4c3d20c812bb858a4e50569a836f0217c7652fb350be953e5f50d
C:\Users\analyst\AppData\Roaming\Scegli_nome_allegato.exe - ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5 - 0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5
57b7340e39b0fefe2cd21abb036152c485a0ceb794934af650534ddefacb7481 - 57b7340e39b0fefe2cd21abb036152c485a0ceb794934af650534ddefacb7481

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

hb.za
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
sunray1975.zapto.org
oneclient.sfx.ms

Embedded IP addresses

40.79.167.9
57.154.63.210
52.253.84.76
52.123.252.192
4.230.171.124
172.215.188.232
74.179.77.204
74.178.76.54
51.105.71.137
162.159.142.9
104.18.33.89
52.110.12.49
52.110.12.11
48.211.4.16
20.42.65.85
52.148.114.188
4.150.223.97
57.155.101.212
135.234.160.245
4.150.223.96
40.84.97.4
20.42.179.204
85.210.196.11
52.123.252.233
52.110.12.18

File paths

B:\:t:
X:\:`:d:h:l:p:t:
X:\:`:d:h:l:p:t:x:
J:\:`:d:h:
I:\ba

More Blocker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report