MALICIOUS — 9d96165cf2a52ed821566f7f501c3782d83f8b5969dea157a9d9c34470062823

MALICIOUS — 9d96165cf2a52ed821566f7f501c3782d83f8b5969dea157a9d9c34470062823 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the DangerousObject family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 9d96165cf2a52ed821566f7f501c3782d83f8b5969dea157a9d9c34470062823
SHA-1: d1d0074abb34a3c6551fcfc5446b5331b0408f52
MD5: 6f1e2600197650d639e81bc41c94822e
imphash: eb5bc6ff6263b364dfbfb78bdb48ed59
ssdeep: 98304:R1QTsUm3I5Tk1MxEfb/SZ6ZqjYWMyLNAnEERJ5lXnvIQwcuNX/5kvcjdYWSXm3mh:X8zTXxEfWZ6uNuEe5hngNcuNX/5OcjdC
TLSH: T18F6502F5722B1822CBA7734055A6B47E89D7B4D352B7851C50E7C72EC9E23CB20B5288
Submitted as: 9d96165cf2a52ed821566f7f501c3782d83f8b5969dea157a9d9c34470062823
File type: pe · Size: 5789114 bytes
Verdict: malicious (100/100) · Family: DangerousObject

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Filerepmalware-9908417-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_UPX_Packed
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Filerepmalware-9908417-0 (rule Win.Malware.Filerepmalware-9908417-0) - engine signal, weight 0.90, confidence 0.95
Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser community pack flagged TL_UPX_Packed (rule TL_UPX_Packed) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline - static signal, weight 0.35, confidence 0.60
Dropped 9 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

51690 behavior events · 2 ATT&CK techniques · 20 dropped files.

Dropped files

c:\program files (x86)\ckhunter\unins000.exe - 8a7cc1641c3187811c2a6695de5fe7265b0238686e3566325238a432daf7820c
C:\Users\analyst\AppData\Local\Temp\is-SN6AE.tmp\_isetup\_setup64.tmp - 388a796580234efc95f3b1c70ad4cb44bfddc7ba0f9203bf4902b9929b136f95
C:\Users\analyst\AppData\Local\Temp\is-5E5JK.tmp\tsk_f790ea69946e4480.tmp - 0e4c8658b174aa18e1f135a1fcb640a820ecf44efa8055309db1d5ddebc2251d
C:\Program Files (x86)\ckHunter\unins000.dat - 06f2def4f42e6d98e7b3d757750e7c5abf21e89721c0c0b7ab79f62c3fed4ab2
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000023.db - 991b3e3317c4f0ba4771a942f824ce1909b0fd153cbe8c8e86255592259116c5
c:\program files (x86)\ckhunter\crdllunload64.dll - 0b28d446fdd3eae2c6532cf4611765fa4ca9fedfba6fb564ad1e4eb46420613a
c:\program files (x86)\ckhunter\history.txt - 59df86ecd4822f5fe077ca078dae25bfd19d052b6bb375c8e9010c7b86244ee2
c:\program files (x86)\ckhunter\usrfindhandle64.sys - b288dfec2bb19509eca5b659c022db1ac80534c2eb06f6f792d563e655cd5a71
C:\Users\analyst\AppData\Local\Temp\is-SN6AE.tmp\_isetup\_iscrypt.dll - 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db - e0a75cfcd58560bd4d7cece48b07f862843ca9948bf592e5c7d919aeed251cd6
c:\program files (x86)\ckhunter\crdllunload32.dll - 6468cb2a3d578efba32239c1c2c4676b4ddc3af4da59c8a3cec1adb6adf76930
c:\program files (x86)\ckhunter\lhshellext32.dll - d0894fb05471025253d7d002678157ace15d5e1d960a2470ee1f83f2d9a9a4d5
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\cversions.3.db - 9813cd88b46107c4dc38d1a8786afe1f1ce06795774f2b72ce7647b444134b63
c:\program files (x86)\ckhunter\lhshellext64.dll - b18e15ba181c0ded42e179babad2900ec54e410329cdd4bf67e9f64bb6f3d1bf
c:\program files (x86)\ckhunter\ckhunter.exe - e38703696b446ddfcd860dfe94ebb5b0cdb6fd73055e645a2402c383c8b60369

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.jrsoftware.org/ishelp/index.php?topic=setupcmdline
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
w.de
www.jrsoftware.org
olustgtapi.live
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.90
4.230.171.124
4.247.188.224
20.247.185.124
74.178.240.61
20.42.65.94
74.178.240.51
4.150.223.114
52.110.12.55
52.110.12.14
92.223.78.30
172.178.240.163
40.84.97.4
20.184.175.3
4.150.223.113
135.234.160.246
72.154.7.107
52.148.114.188
52.110.12.15
52.110.12.19

File paths

p:\p
x:\dirname

More DangerousObject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report