MALICIOUS — notis pembayaran.exe

MALICIOUS — notis pembayaran.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the DarkCloud family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 859de3cf69bdc175a91c150ecc23c825bb38d999c6ef4e17955a9a78fa139943
SHA-1: af038b12ca0d58d24556bb81b6bdb549a7420c00
MD5: f060577086b62fa9df2ce231f2221291
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:sr6SXTshfhpgagDZp8MSFvfOjOh3X9o9L5cACQ5fEYYHF7DKGznIeowCE6oSZPw:Omj6Zp8Mkvm6p6ISQ7DTYwCE65E8
TLSH: T15454E0EB24AE6A14C4F5BF017B06C5CEBD0CAA8D22673F590905AD77000BC2F5E6A135
Submitted as: notis pembayaran.exe
File type: pe · Size: 1190400 bytes
Verdict: malicious (99/100) · Family: DarkCloud

Detections (4 of 55 engines)

Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Trojan:Win32/Egairtigado!rfn
Emsisoft (Emergency Kit): Gen:Variant.Inoci.16
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Stealer.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s): Credential Access: browser credential store read [high] (rule tl-browser-credential-access) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (32 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Extracted DarkCloud config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: 4.5.6.7 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

28086 behavior events · 2 ATT&CK techniques · 24 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0139D915EC765B0466751AF4006D6240 - f13baa16e60c910800f30b23f40b1b5c8e218313b1c1c954ce6891541c5ce429
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - 174baa9e09deb8fa5d5e04efd6543918c39bcaa9b32f4891198c0066a5551ad8
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - 5acc38602b40b83ddef14ae7596e823404e616144b97ea3e518c9f32a4b3de70
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - 740adf794e673d819b734ab5a47fc7a106f5c6eef3dd3a78942ecb219ee39c4a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0139D915EC765B0466751AF4006D6240 - f95f068618ecaae2b86d49dc0375293bd687e4284547745a4065e8dcb3b3c92d
11db9deafc03c16107b42ac4f604ab9eb3557c571d26883d694653fc930fca9f - 11db9deafc03c16107b42ac4f604ab9eb3557c571d26883d694653fc930fca9f
a085c6a77f932eb22d9a25344653bdf47dafea4c8d80ed22cb9d9343f14a16f7 - a085c6a77f932eb22d9a25344653bdf47dafea4c8d80ed22cb9d9343f14a16f7
1bd0c398723b8fe51c61914fad08de31878e90619583b40474d49818e4163448 - 1bd0c398723b8fe51c61914fad08de31878e90619583b40474d49818e4163448
0593a05ec9b55dbae2e7faf5f2bbf6dcf7a95265d1eca239416cf097cecb310e - 0593a05ec9b55dbae2e7faf5f2bbf6dcf7a95265d1eca239416cf097cecb310e
1a686e55869b97f641a35a99e379868e6ad9f8932fedfcf8ec5eb8d8f8964cf8 - 1a686e55869b97f641a35a99e379868e6ad9f8932fedfcf8ec5eb8d8f8964cf8
77ceec8266881051f7f2d70e4069901c0ca4a13ef408eb2f2adb7ce7ec3b81b5 - 77ceec8266881051f7f2d70e4069901c0ca4a13ef408eb2f2adb7ce7ec3b81b5
61ff78242dac1103467f570e68c5b52cbd325d509ba9756b6bff88fd33f07492 - 61ff78242dac1103467f570e68c5b52cbd325d509ba9756b6bff88fd33f07492

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787749417&P2=404&P3=2&P4=e9fdNCzxCto8ef2PV5MVMPph6cGisgjbjXskEcRu9uY9cFc3fXNEgIzuLn6o0OWK9DELUdn%2bNNszJ2d2FBm0eA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787749479&P2=404&P3=2&P4=hXbZAUkxPLf4m1iq729PDZQ0%2b32BrKyHXtUHxCbtcPpd3JuFfQZHV24tSX%2fmOPQ07ahIBOsXfO6AmkBtk9lU%2bA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://showip.net/
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye1.c.lencr.org/83.crl

Embedded domains

showip.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye1.c.lencr.org

Embedded IP addresses

0.1.2.3
4.5.6.7
51.116.246.105
4.230.171.124
57.154.63.210
52.230.59.222
135.233.95.144
135.232.92.97
40.79.141.155
52.123.128.14
20.231.239.246
40.99.134.18
4.207.44.69
135.233.45.222
203.26.79.13
135.233.95.80
52.148.114.188
172.178.240.161
162.159.142.9
172.215.188.225
4.150.223.102
13.69.116.109
72.154.7.105
51.105.71.137
48.199.12.1

More DarkCloud samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report