MALICIOUS — 86e038d9fb1bb8e60915593a3f0ebb053408825037bf13767856d1c5a21f9d42

MALICIOUS — 86e038d9fb1bb8e60915593a3f0ebb053408825037bf13767856d1c5a21f9d42 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wapomi family. 9 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 86e038d9fb1bb8e60915593a3f0ebb053408825037bf13767856d1c5a21f9d42
SHA-1: cbc916843cff6a64edcaa224cf2002d89fc3bf4d
MD5: 6cff24312e6ac8cb0ce4429d6f739931
imphash: 52ebbd38de84b5686dedb97db5bace2b
ssdeep: 3072:esL7FycSLIQIXonALCfYuM5W2l5duhqfWGCH:esX1XQJAj5TX
TLSH: T1A93C8D8E03057346EA6787607D450F6EE052F0DAA1BD294C4D43C02F37AB85BEB7194A
Submitted as: 86e038d9fb1bb8e60915593a3f0ebb053408825037bf13767856d1c5a21f9d42
File type: pe · Size: 120320 bytes
Verdict: malicious (100/100) · Family: Wapomi

Detections (9 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!6CFF24312E6A
Kaspersky (KVRT): Virus.Win32.Nimnul.f

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (Madeba): fBHcaO.exe - dynamic signal, weight 0.62, confidence 0.90
Microsoft Defender flagged Virus:Win32/Mikcer.B (rule Virus:Win32/Mikcer.B) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.VJadtre.3 (rule Win32.VJadtre.3) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FVWC!6CFF24312E6A (rule Trojan-FVWC!6CFF24312E6A) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Nimnul.f (rule Virus.Win32.Nimnul.f) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 27 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60

Dynamic analysis (windows)

9325 behavior events · 2 ATT&CK techniques · 49 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_acro.exe - b8a9d5807917687ab25ef2c5759f7f1520fda63f734924b93c86e5524d0e7f68
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
C:\Users\analyst\AppData\Local\Temp\fBHcaO.exe - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
C:\Program Files\Adobe\Acrobat DC\Acrobat\NGL\cefWorkflow\adobe_licensing_wf_helper_acro.exe - 377693e2ca6eefba36f61373194f572541a409cb10808b8c71d52897a6df3e8f
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\Adobe\Acrobat DC\Acrobat\RDCNotificationClient\FullTrustNotifier.exe - f72ae9e2704e97d9c31b3128003296ae46b20acdda49bf2e85d5b6799085bb4f
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - 698f79937dc7b693633e00453acea137673a666e8b98c796d14fb8a41df1fdac
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\k3[1].rar - 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
C:\Program Files\7-Zip\Uninstall.exe - 1d79305d2016ab94c650b31d294e89bc9c73cc37232589ed782b7e5d495f2766
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADNotificationManager.exe - 79671bf6759f645dfeb021e3fcece87abe20b7c6be7ee7bf9c362603056a23ee
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://ddos.dnsnb8.net:799/cj//k1.rar
http://ddos.dnsnb8.net:799/cj//k2.rar
http://ddos.dnsnb8.net:799/cj//k3.rar
http://ddos.dnsnb8.net:799/cj//k4.rar
http://ddos.dnsnb8.net:799/cj//k5.rar
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ddos.dnsnb8.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.91
4.230.171.124
57.155.101.212
20.247.184.142
74.178.240.51
20.89.1.9
74.178.240.61
104.18.33.89
135.233.95.144
3.229.117.57
92.223.78.30
52.110.12.55
52.110.12.5
125.56.205.65
125.56.205.26
20.42.179.192
20.42.65.85
51.116.246.106
72.145.35.110
52.148.114.188
52.110.12.47
52.110.12.53

File paths

D:\work\cuckoo\CAPE\capemon\Release\loader.pdb
T:\:d:l:t:

More Wapomi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report