MALICIOUS — af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98

MALICIOUS — af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lamer family. 7 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98
SHA-1: c482938964d51ab91706631cd096146dba336e46
MD5: f26100bdee10062dae6bc8a2ce88ea72
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 12288:B5hVu7+6VkVwfxabOeu4qHYus//ZTh+D+lSQMSXu1:B5hVu71VkKfxabtnq6Jh+ql3B+1
TLSH: T1C64D9E5A081B2123E5B6D914BC109DDC8032F475A539E29D9743CC2EB1EADB7EAF00E5
Submitted as: af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98
File type: pe · Size: 594248 bytes
Verdict: malicious (100/100) · Family: Lamer

Detections (7 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Kaspersky (KVRT): Virus.Win32.Lamer.xe
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

Dropped a malicious payload (Viking): 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 5 finding(s), e.g. RWX/private injected region in svchost.exe (pid 932) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

56077 behavior events · 2 ATT&CK techniques · 65 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9244/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9244/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9244/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9244/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9244/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9244/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9244/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9244/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9244/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9244/files/7f632cc3b7ee162f994575e5240423c2b7ee3022759a99f7766aaf6f67268357 - 7f632cc3b7ee162f994575e5240423c2b7ee3022759a99f7766aaf6f67268357
/opt/CAPEv2/storage/analyses/9244/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9244/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73
/opt/CAPEv2/storage/analyses/9244/files/713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210 - 713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210
/opt/CAPEv2/storage/analyses/9244/files/c210222aa6920708541ef37fe530810d36d81cfafdf020275cccc0aad9398a35 - c210222aa6920708541ef37fe530810d36d81cfafdf020275cccc0aad9398a35
/opt/CAPEv2/storage/analyses/9244/files/897dd89490f168caeac5385c487d6c9b16966d5aa88716b2be35335291ea5253 - 897dd89490f168caeac5385c487d6c9b16966d5aa88716b2be35335291ea5253

Embedded URLs

http://schemas.microsoft.com/SMI/2020/WindowsSettings
https://www.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786399477&P2=404&P3=2&P4=E%2fwFegCnl6KzXy4RGf%2fvr1Dii53Y7WRC3u%2bXF1kyFcIxLoTJE%2b6Rz20C3NNcUkAxJ5CfQBhfCD9pldp3wyE%2bjQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786399534&P2=404&P3=2&P4=HywzuQ5oEik6ogRIs0JHK91ezitODhiTTJ2JzSj%2bbwSy2s6WBpFeWpa9IOZbBUU5YBcsmHDKzyVPiqIt64nsXQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
www.microsoft.com
crl.microsoft.com

Embedded IP addresses

192.168.0.30
192.168.8.1
52.168.112.66
4.144.132.223
4.230.171.124
57.154.63.210
20.165.94.63
20.165.94.54
20.184.175.15
172.178.240.162
203.26.79.13
52.123.252.229
20.165.94.46
135.234.160.245
184.84.165.171
72.154.7.114
20.184.175.6
4.150.223.107
52.148.114.188
74.178.232.29
52.110.12.30
52.110.12.49

More Lamer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report