MALICIOUS — a048be21d3e4be8735cbee10f515cdb08e9b2bea5e9116e13e26e79300c86299

MALICIOUS — a048be21d3e4be8735cbee10f515cdb08e9b2bea5e9116e13e26e79300c86299 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 8 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: a048be21d3e4be8735cbee10f515cdb08e9b2bea5e9116e13e26e79300c86299
SHA-1: 95e54ea281d3faf2630d1a9dbe4a43c04c6aceb5
MD5: ba81373854cbf5279324f87f3e058f98
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 6144:BtfDwsjPThT5zL2RJLk+9cYWy4DswMtV+55oWmE6TusW:B5hVOLP2swnfoWmE1sW
TLSH: T1BC47C5CD466DA741DF3ACA356941BAED8061F0E42172B61D1E06C13E16A303BFDB70A9
Submitted as: a048be21d3e4be8735cbee10f515cdb08e9b2bea5e9116e13e26e79300c86299
File type: pe · Size: 340144 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (8 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Trojan.Delf-1564
YARA: delivr.to detections: DLV_Maldoc_VBA_AutoExec
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Trojan.Delf-1564 (rule Win.Trojan.Delf-1564) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Dropped a malicious payload (GameThief): virDll.dll - dynamic signal, weight 0.62, confidence 0.90
YARA: delivr.to detections flagged DLV_Maldoc_VBA_AutoExec (rule DLV_Maldoc_VBA_AutoExec) - engine signal, weight 0.70, confidence 0.70
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

59483 behavior events · 1 ATT&CK techniques · 101 dropped files.

Dropped files

C:\Program Files\Google\Chrome\Application\151.0.7922.174\Installer\setup.exe - 547759c365733328fe4166675af641474cd4ec13022d1c45956cb474dd9a84c6
C:\Program Files\LibreOffice\program\opencltest.exe - 5eba27661d957e8ec3d7a818330307c6374a60c3e9eade407fa5369f541fdf1c
C:\Program Files\LibreOffice\program\minidump_upload.exe - 2635cf5db9a0b17cc045d5acbd64ac3ab5ea9bce505cc7bb045f10d0a72e2f98
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroCEF\AcroCEF.exe - a8eedd51e5202cfb69c25f2f0599c4b579f8ad855f3433e391ce82ad9d1667eb
C:\Program Files\LibreOffice\program\python.exe - 13d9a613a55fef8a9683bf2a2508a442003197f5c35418559db338758ec8e5ed
C:\Program Files\Adobe\Acrobat DC\Acrobat\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe - ddb33ff14ab47a3e0a7f68fdc8ea9a82473e6feed6d51cc3a227e82d5b116ac6
C:\Program Files\LibreOffice\program\regview.exe - 6613712cc7647b2ec74fa0d6e30fccc1d9b6e1ddf97e367ad975c1c84d1d6ab7
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Google\Chrome\Application\151.0.7922.174\chrome_pwa_launcher.exe - 0c6ef2b3b8d8324e37d07ce389e1a4839a1bc50dc18ef4515cd587623ad5c2f6
C:\Program Files\Adobe\Acrobat DC\Acrobat\x86\Acrobat\Acrobat.exe - cb729c721da4b481ca38ea07f6e2b5df7e5ae0f5e2a79a144a5e829026141428
C:\Program Files\Adobe\Acrobat DC\Acrobat\LogTransport2.exe - a0cd2ee243710deff65ed5edb919ee156376de75850b891993f1d9470d34977c
C:\Program Files\Adobe\Acrobat DC\Acrobat\CRWindowsClientService.exe - 58c21c1844c549c43ebd289402ead888ffc4645ef2233d6deef13fcb91ca88f8
c:\users\analyst\appdata\local\temp\tsk_bde9ce7c104e4b58.exe - dccfe745956a388c064bf933b4793671a94aaf480d90a83e56f8466795cdd948
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 014c4967e6ce154ebadd03567cff27d01af941af7b3c3947d34af2ed6a3a1f03
C:\Windows\virDll.dll - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
outlook.network
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

192.168.0.30
192.168.8.1
20.184.175.7
52.123.252.247
57.155.104.224
4.230.171.124
135.232.92.137
135.232.92.97
13.69.116.105
52.253.84.76
4.150.223.101
104.18.33.89
92.223.78.30
125.56.205.32
125.56.205.24
52.148.114.188
72.145.35.111
125.56.205.42
52.110.12.33
52.110.12.28

File paths

d:\dbs\el\oc\target\x86\ship\postc2rcross\x-none\msohtmed.pdb
X:\:`:d:h:l:p:t:x:
T:\:h:
T:\:d:l:t:

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report