SUSPICIOUS — aa32b9158d29f4df27c377112d859aa0338bb4bdba14a0e12d83f50ff6ca60b7

SUSPICIOUS — aa32b9158d29f4df27c377112d859aa0338bb4bdba14a0e12d83f50ff6ca60b7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 2 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: aa32b9158d29f4df27c377112d859aa0338bb4bdba14a0e12d83f50ff6ca60b7
SHA-1: 06c247e136dcf141ab759a0823cc0cf3dd48606a
MD5: edb74336ca0dded7b1c2439ed5f3aacf
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 3072:KbuHm5W6sytXY8pUkZW0ceZNXK1xNohvw0NPH9ryw6UpeHuAtC3kxExeH7LoY2d:Kbq
TLSH: T1D04F6E0555CC2F23C7A00199043ADE4F5EDEAA387AE90E07173DBF7582ABD8149A5F60
Submitted as: aa32b9158d29f4df27c377112d859aa0338bb4bdba14a0e12d83f50ff6ca60b7
File type: pe · Size: 719872 bytes
Verdict: suspicious (54/100)

Detections (2 of 55 engines)

Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.30600
Kaspersky (KVRT): UDS:Backdoor.MSIL.Crysan.gen

MITRE ATT&CK

Why this verdict

The suspicious score of 54/100 is the fusion of 7 weighted signals:

Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: https://dl.dropboxusercontent.com/s/s6gagou5cask4i5/2.txt - static signal, weight 0.35, confidence 0.60
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

48710 behavior events · 2 ATT&CK techniques · 40 dropped files.

Dropped files

C:\Users\Public\Music\run.ps1 - b08d6ea43308db6eedeaa8496990f651de8f5cfb84110e776ac98334ee0cd6c2
C:\Users\Public\Intel.bat - 9cc216ec5df136e428e9e24e3e1fd981ad3cb21cfcb608ee07f322ace833db84
C:\Users\Public\Run.ps1 - 06fc0ad7668f03d155ff224e7bb34aa40d616e2af4e2bff060b3e5f7daebeea6
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - 24b84becca9bfa2f94d8e319cfff88c3108c216c6b2caa3e73a10f2df3f6bec3
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_i0a0g2z2.0ws.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\ProgramData\Core\Intel.vbs - a402a6cf3abf113969164467615322420fc34c3f75d16fe45bf9f804564b4fee
C:\Users\Public\Music\vb.vbs - 0d8ff2574f7c48e5c6a34b78dca233dd984e8e2ce70c655c76cedf4e37bd7d5b
C:\Users\Public\Music\vb.bat - 12187ca5ca29b6ddc6a72c8bf25b4e51fe2b0cf11f9d546480c62dacfcf0a4d0
C:\Users\Public\Music\alosh.ps1 - f35aecee6bb70f1aa56dfb9134a73b994033cd9e250cdb6ea4019a0e0f8e6961
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - c0927980ac993202e5c5c634ce6cb0db5f096a8d2fbf769061c3c2be54fce604
e831a98ee2167e5feebd1a5bc35b87a87d7c7121fc9155442428fc01c1a496d7 - e831a98ee2167e5feebd1a5bc35b87a87d7c7121fc9155442428fc01c1a496d7
6e5f5edc118f3882701f07af5b527845625426ae2173d1adb0eb732317dc7b5e - 6e5f5edc118f3882701f07af5b527845625426ae2173d1adb0eb732317dc7b5e
ee1600a8c3aece842e35498bba964799c316ac1f5841cc8ec0d7a45373081c58 - ee1600a8c3aece842e35498bba964799c316ac1f5841cc8ec0d7a45373081c58
64ef81a915ff6e129766b73b7fe24f077a74385c54e1f90e1fa0927ffb8f1519 - 64ef81a915ff6e129766b73b7fe24f077a74385c54e1f90e1fa0927ffb8f1519
5cff8e52758eec86fff9ac9fa74c8c4e276633ae5921a3c9e4aea6f2cee75e66 - 5cff8e52758eec86fff9ac9fa74c8c4e276633ae5921a3c9e4aea6f2cee75e66

Embedded URLs

https://dl.dropboxusercontent.com/s/s6gagou5cask4i5/2.txt
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787859661&P2=404&P3=2&P4=PUzMcfVzcFQBv2lhIoYlMqrSMGnMQkQEJT2QAAqXEeEEE3ONdIlM0EJfBmV91kOKllGXZnQGL4yXUqn08st2lg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787859753&P2=404&P3=2&P4=TTF%2bBUhXJX178eMjhzt7DWPUANSZjkSelqFLfMcTFBdLd3AbNCBf4S9zQ2gLTWpXdg6ufqWMLy%2bjJjRMfxkQsw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

dl.dropboxusercontent.com

Embedded IP addresses

52.123.252.203
4.150.223.113
52.123.252.226
20.247.184.142
4.247.188.224
4.230.171.124
74.178.76.128
20.42.65.90
135.232.92.97
74.179.77.204
20.112.250.133
52.123.129.14
52.123.128.14
203.26.79.13
135.234.160.244
162.125.83.15
52.148.114.188
172.178.240.163
52.123.252.242
74.178.232.29
52.123.252.239
72.145.35.99
92.223.78.30
52.110.12.28
52.110.12.3

Registry keys

HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Security

File paths

C:\Users\Visual\Desktop\ALL\iphone\iphone\obj\Debug\iphone.pdb
C:\Users\Public\Run.ps1
C:\ProgramData\Core\
C:\ProgramData\Core\Intel.vbs
C:\Program
C:\Users\Public\Intel.ps1
C:\Users\Public\Music\vb.bat
C:\Users\Public\Music\vb.vbs
C:\Users\Public\Music\alosh.ps1
C:\Users\Public\Music\run.ps1

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report