MALICIOUS — a756b64714d41b6a6202fc42cc34d039823c99ca29e2b84363788eb1899c43f9

MALICIOUS — a756b64714d41b6a6202fc42cc34d039823c99ca29e2b84363788eb1899c43f9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the CryptInject family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: a756b64714d41b6a6202fc42cc34d039823c99ca29e2b84363788eb1899c43f9
SHA-1: 5c9efdeed3ad3a9e36a51ba9c433d1de0f884144
MD5: 2285026594a9c7e521f4ed4d05152f89
imphash: a9192bab5c7c795c7488b69a1853f9c2
ssdeep: 1536:MEsyxfoGbtk9NL1vtpun4OWd2Xl2rqQGdjWeIlvU:MEsmgGbtkz1vtpun4OK84
TLSH: T18D38CFD9716A1610EDF1F0A8EE04E91C7093D955A3792BCC310AD83B72EA5FB1279098
Submitted as: a756b64714d41b6a6202fc42cc34d039823c99ca29e2b84363788eb1899c43f9
File type: pe · Size: 81920 bytes
Verdict: malicious (100/100) · Family: CryptInject

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Rootkit-6683
Microsoft Defender: Trojan:Win32/CryptInject!pz
Trellix Stinger (McAfee): Trojan-FULM!2285026594A9
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Rootkit-6683 (rule Win.Trojan.Rootkit-6683) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/CryptInject!pz (rule Trojan:Win32/CryptInject!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FULM!2285026594A9 (rule Trojan-FULM!2285026594A9) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.pinkworld.com, http://www.youporn.com, http://www.redtube.com - static signal, weight 0.35, confidence 0.60
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

43886 behavior events · 2 ATT&CK techniques · 37 dropped files.

Dropped files

C:\Windows\System32\vccorlib140.dll - 787864d3321407f1d2e65b50ed62fc9df5527febf08f63fe3bd983d67aef0d46
C:\Windows\pyw.exe - a16f91f89a3d4a971a94cdc4a81aa72cb1822b7fc89ffd5b0c26a79a55344bba
C:\Windows\System32\dssec.dat - aae1ff66cb12b335b5f685bd9d154e338d4f689296b73aa33c519c3b16509a17
C:\Windows\lsasetup.log - ee71a0fa2b852a91c61e0bf58ae800a30370270e1eabf860709443ad41494932
C:\Windows\System32\msclmd.dll - fb383c90ae328f5799aba6878e04bab61dca5a43448843b045d1bbe375d04319
C:\Windows\System32\vcruntime140.dll - 137edd4705af6470e8417a4bc14331db3e0d700ae8813ecb743296b7176e7c6f
C:\Windows\pyshellext.amd64.dll - 640934e5ae15d0db0df299a34e9ece806d41524f15a10c7b0cd988c1385d7fdc
C:\Windows\System32\debug.log - 24c5f6091c866bc929a1482358c82198427e798f2d4e1c602b3030e54be41f23
C:\exc.exe - 545d080c198e8e08ffb51c8a182581c1ffd6366031ab2b265b34ba0ba42e4df6
C:\Windows\System32\mfc140.dll - 3e1673601b7c65dbe6c69f9d269c2c08330c5304c03fa902ded1eb6c92687476
C:\Windows\System32\license.rtf - fde14693ebcee7b9952a02dd9f2cffa6decfe445f29670b1f5a106eb33ef201b
C:\Windows\Professional.xml - 0f0cb0672ce9d0d2ab3245abad968fe77d76596a830b489c0d7334e0d219c0b9
C:\Windows\PFRO.log - 66f707170bcab0a460449baeaf4bd323c4a56fa56f14d9a13d333a53b3ebc85b
C:\Windows\DtcInstall.log - 4f45be9e2897dab0ca63697a99bc3dc7ed2662649b2553d31c391727e5d6b876
C:\Windows\System32\mfcm140u.dll - fb3968011fe98f37a87347f742b1952b619e9217bde92cbf478a8e079e16db65

Embedded URLs

http://www.pinkworld.com
http://www.youporn.com
http://www.redtube.com
http://www.assparade.com/
http://www.freeav.com/
http://www.antispyware.com/
http://www.antivirus.com/
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.microsoft.com/windows0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.pinkworld.com
www.youporn.com
www.redtube.com
www.assparade.com
www.freeav.com
www.antispyware.com
www.antivirus.com
crl.microsoft.com
www.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.175
4.230.171.124
57.155.104.224
20.247.185.124
74.179.77.204
20.165.94.54
20.89.1.12
20.165.94.63
20.42.179.192
20.42.65.91
172.178.240.162
125.56.205.24
125.56.205.17
52.148.114.188
52.110.12.55
52.110.12.33
72.154.7.108

File paths

C:\Windows\system32\d3dx10_36.dll
C:\Program
C:\Progr

More CryptInject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report