MALICIOUS — 9e3ae9173bff0d05bf6736a811e57eb26fb0ab9ea9ad1b15bbdbd14c89aa3ee8

MALICIOUS — 9e3ae9173bff0d05bf6736a811e57eb26fb0ab9ea9ad1b15bbdbd14c89aa3ee8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Blocker family. 6 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 9e3ae9173bff0d05bf6736a811e57eb26fb0ab9ea9ad1b15bbdbd14c89aa3ee8
SHA-1: ed531ffcea9e4ed69ecfd8f255c9b2b2edd7c268
MD5: dbcf5a66984da643b7d33cb802c5fa22
imphash: ea28f662ab831803e9a8c823439760d0
ssdeep: 12288:wt8vVED3Bk0Mr9Vif7/F1hIIaYHuvAIS2C:wt+gvMpVij/F1hV5HuvAIo
TLSH: T16C49BFB94B083255C860ED58C829F47E5F3E5CA69BA323187DAF143DA9C25D3806E0D7
Submitted as: 9e3ae9173bff0d05bf6736a811e57eb26fb0ab9ea9ad1b15bbdbd14c89aa3ee8
File type: pe · Size: 401606 bytes
Verdict: malicious (100/100) · Family: Blocker

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Blocker-391
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
Microsoft Defender: Worm:Win32/Drolnux!pz
Trellix Stinger (McAfee): W32/Worm-FFX!DBCF5A66984D
Kaspersky (KVRT): Trojan-Ransom.Win32.Blocker.jgb

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Blocker-391 (rule Win.Trojan.Blocker-391) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 31 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.ibayme.eb2a.com/dwn.dmp, http://www.ibayme.eb2a.com/ad.php, 1.9.0.5 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

122729 behavior events · 3 ATT&CK techniques · 83 dropped files.

Dropped files

C:\Program Files\WindowsApps\Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\Assets\GettingStarted\Reimagine.theme-light.jpg - 77cd3f210a852ccb3c67046126c95750e7335af5073be9126218e1033601010d
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\Focus0_48000Hz.raw - f68442c0ecae1d1d3bd435b25f1507cc74a4582c10f9567cf3e61d10d2d0d991
C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-en-us-onecore_31bf3856ad364e35_10.0.26100.1_none_f8f09a49f1697814\M1033Zira.keyboard.RAD - 47e33f4fa62eb9177512383aabbb6ff75ca7486d8db4dc5d2e26816712073dcc
C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg - e010cdbed55de0c5e76f5431efbb898c8092ca72e3c5a2ad62798956791494ba
C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..ragethelpdiagnostic_31bf3856ad364e35_10.0.26100.1_none_a80d3d319006b4ee.manifest - a4a75456e6b5486dbe0a9bd9b882f0da5d27fa32c8770ae96fd0c0d2fba5e5ec
C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-en-us-onecore_31bf3856ad364e35_10.0.26100.1_none_f8f09a49f1697814\M1033David.keyboard.RAD - c28e46bd33f2129cf37cad01715d1ac24156013a0cf5acd6f94b2053e9116261
C:\Program Files\WindowsApps\Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\Assets\GettingStarted\Image-Creator.theme-light.jpg - 4e22b56d6ce3279571e29d5b642a40e8da80506147631ced5c7fe33bb281c0af
C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.26100.8246_none_fc849c86024680fc\Windows.Devices.Radios.dll - fe507242f22060f86c3bcef4c34473dfe46fd8421b01d2086f4e4447eb0ba900
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\GoBack_48000Hz.raw - b3c5a4d6099c4af9f4d8c3df3b4bef2e9a9193bc8c2ede7544e4c6ab4a618b6e
C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.26100.7920_none_fc37734802807af8\r\Windows.Devices.Radios.dll - b0450f85ceb8c2f01557684133504a0967a3d753b1bf79a6e4979eb6417b6120
C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.8115_none_69a9721261f79982.manifest - 81473a8d4c7eb9d9e769b85aa2d9b77a83df8882530f3eb39756559c5576c376
C:\Program Files\WindowsApps\Microsoft.Paint_11.2605.71.0_x64__8wekyb3d8bbwe\Assets\GettingStarted\Object-Select.theme-light.jpg - 568b8a2403e727ccafa123c1c624aeb09a0ce8880ae70df9e885f26a1779bdf6
C:\Users\analyst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PDF FoxitReader.exe - e6a4d9ec38d83f3b05b34d6a67dae6b45b33eb43414f89fd450a9f7af55d05de
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\Focus2_48000Hz.raw - 57ab9c8a42c55a1a84b3b5e8c7fb15d723bbfb69fafb834002e3228636d8c108
C:\Users\analyst\AppData\Local\Temp\Rar$EX7.src777\COM7.EXE - 3a80a47c4e08b200d700aa2d6aae083ad7d2fec78efacf902509a8afe72a44a8

Embedded URLs

http://www.ibayme.eb2a.com/dwn.dmp
http://www.ibayme.eb2a.com/ad.php
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787841945&P2=404&P3=2&P4=PajQHG57eYP9OuUxpdzUXg19lCuCqsUKttVevlINIdXoppuQHRb%2fw7IL94HcGmf%2fX%2f%2fap7rUn3W6BHQertkUVA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787842006&P2=404&P3=2&P4=SVLHgMefG6M4Hg3Y98bKe9gxU%2biMCdeS8%2b0CnBQbZInO2Mv4H01t%2bSQgbbvLKTA9liXw4pnJIF%2fPL%2fNvLoa2kA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

www.ibayme.eb2a.com
s.com
oneclient.sfx.ms

Embedded IP addresses

1.9.0.5
20.184.175.9
48.211.4.16
4.144.132.223
4.230.171.124
40.84.85.40
135.232.92.137
135.233.95.80
20.184.175.19
203.26.79.13
52.123.129.14
20.76.201.171
52.123.128.14
74.179.77.164
20.42.73.24
135.233.45.223
52.110.12.37
52.110.12.45
135.234.160.246
52.148.114.188
172.215.188.232
72.154.7.98
20.184.175.4
57.155.104.224
40.84.97.4

Registry keys

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

File paths

c:\windows\system32\syssh32.dll
C:\RECYCLER\bilbilal.exe
C:\MusicMP3
c:\WINDOWS\system32\shell32.dll

More Blocker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report