MALICIOUS — a07b0ed764d7d1c1ecfc94da0ecd17ff910aa83abd6807d3a939456a999507cf
MALICIOUS — a07b0ed764d7d1c1ecfc94da0ecd17ff910aa83abd6807d3a939456a999507cf is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Antitcpa family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
a07b0ed764d7d1c1ecfc94da0ecd17ff910aa83abd6807d3a939456a999507cf - SHA-1:
ec9aadef58d9622d424e394f6c4b657a6184aa4e - MD5:
f9fb12f733aa4620adb508fc446042db - imphash:
98dfd9b9e184a03c6ea488ca38f4797e - ssdeep:
196608:PUKKA3n9TAn9Tin9Tin9T+n9TBfUefUvn9Tin9Tin9Tin9TffUefU1n9Tin9TIn:M6CccIzFccccFFmcm - TLSH:
T1EA6AF1C5612121F2DDD2CEA40CD07E0E1492A39625FC3ECD4292592E37EA2E7B44F6D9 - Submitted as: a07b0ed764d7d1c1ecfc94da0ecd17ff910aa83abd6807d3a939456a999507cf
- File type: pe · Size: 9235002 bytes
- Verdict: malicious (99/100) · Family: Antitcpa
Detections (5 of 55 engines)
- ClamAV (daily): Win.Virus.Delf-9955432-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Virus:Win32/Antitcpa.A
- Emsisoft (Emergency Kit): Gen:Variant.Razy.666238
- Kaspersky (KVRT): Virus.Win32.HLLP.Atcpa
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Virus.Delf-9955432-0 (rule
Win.Virus.Delf-9955432-0) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s): Credential Access: browser credential store read [high] (rule
tl-browser-credential-access) - dynamic signal, weight 0.60, confidence 0.90 - Memory forensics: 3 finding(s), e.g. RWX/private injected region in _v_11163.exe (pid 4412) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Contacted 24 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://antitcpa.alsherok.net/ - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Dropped 13 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
12522 behavior events · 0 ATT&CK techniques · 13 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveFileLauncher.exe -
2050cbfb942d620a95d4868e070b53c51ebaf4e589b654b70c6c8d71eb73feb5 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\Microsoft.SharePoint.NativeMessagingClient.exe -
eae7618b6c5b0d5215a277caff41962279c065230cd35a8db2bb5b336e5d2633 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncHelper.exe -
d241d1b9caeb46107165fba20196df40a40b3c3a9562092a2cb1c6dee01a0883 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDriveStandaloneUpdater.exe -
17becf7909ffdc629ecc990483bae71ef69d35f6dcbbba8181af9b81d60f9cd6 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.exe -
54e7a2df0c2e2b05aeeeac87646d84c451ef617531acbb26dacf1a67c6229eda - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveActionHelper.exe -
0e1e429d2789d20a75435b2ada28a8b31e11902b1202e23d12d6aa0d438fd80d - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveUpdaterService.exe -
96ca83d338d9c959c05cbd6e2a20c54adf6586356c15ab404f0cc80f3be04b10 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDriveLauncher.exe -
cb4d7a8a22f715362f160fa5e9054175be118e59753808c09509ab6010981d4c - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrive.Sync.Service.exe -
e127fde706cf2f178eea2b6ee4a9f94da34a64d64bc016d46667ea198cda745d - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\OneDrivePatcher.exe -
d75cf5700b317adfe09685778002768b4a0eb7988da743b0cb2718ffe4c1579c - C:\_v_11163.exe -
16087fbd9ea2713f24b077d573ca25b1c7ec5dfcab8db90988239d1079c6f414 - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\OneDrive.App.exe -
0fd8b931e59cfded566a3828217c892be7fad3a4fff02e0c7279413420d9eccf - C:\Users\analyst\AppData\Local\Microsoft\OneDrive\26.123.0628.0001\FileSyncConfig.exe -
fe2dd28c99870f08470e27061c874e4c24389bd9f0c2c60140e9cac027c09883
Embedded URLs
- http://antitcpa.alsherok.net/
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- https://www.digicert.com/CPS0
- http://crl3.digicert.com/sha2-assured-cs-g1.crl05
- http://crl4.digicert.com/sha2-assured-cs-g1.crl0L
- http://www.digicert.com/ssl-cps-repository.htm0
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787874996&P2=404&P3=2&P4=inpJ9FqdBg2NUAioxvhrZygVFa%2b%2bImUtmQLtR6Lkz1KyV2jJjPqpUo%2bmcAWexlePdHADbO2m%2fBenmSFROWjweg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787875062&P2=404&P3=2&P4=nMTTLFIkC2Yy8%2f4lJgQxksrw%2bDebxRinKutmnJ1b2QNeoMvNXL2HNHPj0zfUkdjC6%2bLCErkD60bs1ib9xukBHA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- www.debian.org
- antitcpa.alsherok.net
- mb.fi
- www.microsoft.com
- crl.microsoft.com
- schemas.microsoft.com
- cacerts.digicert.com
- crl4.digicert.com
- crl3.digicert.com
- www.digicert.com
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
Embedded IP addresses
- 51.104.15.252
- 52.230.59.222
- 4.247.188.224
- 4.230.171.124
- 20.165.94.63
- 74.179.77.164
- 51.11.192.48
- 20.236.44.162
- 40.103.64.242
- 52.123.128.14
- 52.123.129.14
- 20.42.73.26
- 203.26.79.13
- 74.178.232.29
- 172.178.240.161
- 52.148.114.188
- 172.66.2.5
- 57.154.63.210
- 72.145.35.97
- 20.42.65.89
- 20.42.73.28
- 52.123.252.213
- 52.110.12.18
- 52.110.12.2
File paths
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System\37a1d51f35918dd36a0d4e34cc91732e\System.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wad78daf4#\8f73bd36654fa77803c3167f39ead17e\Microsoft.Windows.Diagnosis.SDHost.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wed3937f9#\3dae65a1b718d3a083094b67e1413e9a\Microsoft.Windows.Diagnosis.SDCommon.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\89bc329e8c65a9e13067c9776d925d78\System.Core.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Manaa57fc8cc#\f02732d562721457afde5c189a906d17\System.Management.Automation.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W0bb5dac4#\4c396dcf426dbba8eddd04adc0b562fe\Microsoft.Windows.Diagnosis.Commands.UpdateDiagRootcause.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W69ef49d2#\9dcd27fe1c298162f13c6bdb7c0cfe88\Microsoft.Windows.Diagnosis.Commands.GetDiagInput.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Wd518ee0d#\e9bd08c5c1a8c5fdef45c7025b262edc\Microsoft.Windows.Diagnosis.Commands.UpdateDiagReport.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W708fc392#\3c226a9afdce13116b1fdfa9e92b4152\Microsoft.Windows.Diagnosis.Commands.WriteDiagProgress.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.W79a81d80#\2efe3e39ab8a210a684558961ff266d2\Microsoft.Windows.Diagnosis.Commands.WriteDiagTelemetry.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P1706cafe#\16ab851088227b0798b233d026a1019e\Microsoft.PowerShell.Commands.Diagnostics.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Confe64a9051#\29c26981c4b4347ca371002934f6f2ac\System.Configuration.Install.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pb378ec07#\dac77e2bdc0040a1a2a446cbf77b6bae\Microsoft.PowerShell.ConsoleHost.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P521220ea#\29b929ef5de7ccdae8f74f1083a729c8\Microsoft.PowerShell.Commands.Utility.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.Pae3498d9#\a78370d535d159d2691edea0727e654d\Microsoft.PowerShell.Commands.Management.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.P6f792626#\4b6994043bbc39d9e47433716afb9e98\Microsoft.PowerShell.Security.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.We0722664#\a2e162c411e7960d3320a700179232fc\Microsoft.WSMan.Management.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Data\dcffb1d4b51a427f7c054b15597ef269\System.Data.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Xml\1fb6db2ce6d2887fe6f8f620cb092343\System.Xml.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Management\dee95ca75ccebe1cc18b31dca334cd53\System.Management.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Dired13b18a9#\4ac88f62ef161467f8e9dd4985837e51\System.DirectoryServices.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Configuration\b5152c3c02957bbe4459505a39afde20\System.Configuration.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Transactions\0935f5dce0a38689b9507cb1938fe436\System.Transactions.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Numerics\568282207f7c6c41d18e9e38637dbe77\System.Numerics.ni.dll
- C:\Windows\assembly\NativeImages_v4.0.30319_64\System\08f69c55e9284eaab92075159503c897\System.ni.dll
More Antitcpa samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report