MALICIOUS — 98e3022fd3d50eb0883fa9ea937a16fd7bbc847f546c95a228b70d545d36fdf1

MALICIOUS — 98e3022fd3d50eb0883fa9ea937a16fd7bbc847f546c95a228b70d545d36fdf1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 98e3022fd3d50eb0883fa9ea937a16fd7bbc847f546c95a228b70d545d36fdf1
SHA-1: 3ef997c07c52c191c3a6a325c38f728b2c6e39b6
MD5: 5b980da28a8b3147a2eb40f97071501a
imphash: 77812cb581f98af0bfd5873c43c70ba4
ssdeep: 3072:EQm23BytoJBytMX5fI+RQm23BytosvrXBDA/C/6MNI+0yyIwg4uh1o6:T3UtoJUtMX5P83UtosvdA/CS+0YSSo6
TLSH: T133497CCB39AA5E8FD1B9C8127900482EAFF355D31679B42C81C1B06E48FEDB7543446A
Submitted as: 98e3022fd3d50eb0883fa9ea937a16fd7bbc847f546c95a228b70d545d36fdf1
File type: pe · Size: 392198 bytes
Verdict: malicious (100/100)

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Agent-1388714
Microsoft Defender: Worm:Win32/AutoRun!pz
Emsisoft (Emergency Kit): Worm.AutoRun.1
Trellix Stinger (McAfee): W32/Autorun.worm.fb
Kaspersky (KVRT): Trojan.Win32.Fsysna.akyk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1388714 (rule Win.Trojan.Agent-1388714) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Worm:Win32/AutoRun!pz (rule Worm:Win32/AutoRun!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Worm.AutoRun.1 (rule Worm.AutoRun.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Autorun.worm.fb (rule W32/Autorun.worm.fb) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Fsysna.akyk (rule Trojan.Win32.Fsysna.akyk) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (HUILoader): Msvbvm60.dll - dynamic signal, weight 0.40, confidence 0.90
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

136585 behavior events · 2 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\.ses - fc637c2f6d95f8623c3dcf70fb6063410f3e793593546af1ebfa0528b61ede5b
C:\Msvbvm60.dll - 898288bd3b21d0e7d5f406df2e0b69a5bbfa4f241baf29a2cdf8a3cf4d4619f2
C:\Users\analyst\AppData\Local\Temp\wct2D2D.tmp - f26da73a2053eda9a2e87d8e756cf4198c93f2f74cb43b229c953509cc55c4df
C:\Windows\AE 0124 BE.exe - f3c1fb3773304edfc80f0bcbd5575cbd0c4dce67cdb54dca5e719e0280bc5256
C:\Users\analyst\AppData\Local\Temp\cv_debug.log - 624ff0124ff1097c61c11a6f0265e516a900cc1aafb44110142df0f8f1aaf69a
C:\Users\analyst\AppData\Local\Temp\MSIf25e.LOG - 4595716f5cca2e854bf573dbf95d9302952045f7876be49b83fbe1ec8af600a4
C:\B1uv3nth3x1.diz - 564815feb9c5bdadb145cd0d16738c4e5fbc6a46cf65c62ac6a985c43d1939e8
C:\Windows\AE 0124 BE.msi - 1effa00a45f80dd3f98b3ac532943cde686e0c247809f7e18757250a789ea571
C:\Users\analyst\AppData\Local\Temp\wct7FF7.tmp - 8741f67f52af57f9b924e0534c51d5658f1fb4e035dd0e3b04f472e454b98d6b
C:\Users\analyst\AppData\Local\Temp\8c500f99-ba3c-4d30-967c-d9bdfa0f501f.tmp - 665934b31c81bbfdd91652855f0e583d73ad4eb0ff05b108a2fe5bd9613b63a3
C:\Users\analyst\AppData\Local\Temp\wct4DA4.tmp - a1864fbd4681dac5ee8f6f1c61bbd5004c71cb2af1ec1006fdbeb55ade536af9
C:\Autorun.inf - bd6ba26ee8245ec0ebc94141554879c59d6aecfca9ba8ce7766b7d949dd3d4ba

Embedded URLs

http://www.w3.org/1999/02/22-rdf-syntax-ns#
http://ns.adobe.com/iX/1.0/
http://ns.adobe.com/xap/1.0/mm/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ns.adobe.com
www.w3.org

Embedded IP addresses

20.42.73.28
52.123.252.204
4.230.171.124
40.84.85.40
57.155.101.212
20.247.184.197
104.46.162.229
172.64.154.167
74.178.76.54
74.178.76.128
172.178.240.161
85.210.196.11
52.168.117.174
52.168.117.175
72.153.5.97
52.148.114.188
52.110.12.51
52.110.12.40

File paths

C:\Program
c:\B1uv3nth3x1.diz

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report