MALICIOUS — b0b0b47655bb8cfe2acb1f21ac4e9f5fbf49f4ea72328bdb4cdea99989f3f239

MALICIOUS — b0b0b47655bb8cfe2acb1f21ac4e9f5fbf49f4ea72328bdb4cdea99989f3f239 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dqan family. 3 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b0b0b47655bb8cfe2acb1f21ac4e9f5fbf49f4ea72328bdb4cdea99989f3f239
SHA-1: c81cfffdaa579c868691d66cb926cc31d1ff0f25
MD5: 12b21d82697213c27a1f4a52b7bf5f58
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:A7aQEwhT94wHQy5fJ1GLk2mmLEuzYxHIs:dSOwHQy5Sk25LqL
TLSH: T1604B7C8E03157310E763C720AD105E9E98F2B4FA66B9295D1643C03F26F2D6BF8351A9
Submitted as: b0b0b47655bb8cfe2acb1f21ac4e9f5fbf49f4ea72328bdb4cdea99989f3f239
File type: pe · Size: 482718 bytes
Verdict: malicious (99/100) · Family: Dqan

Detections (3 of 56 engines)

ClamAV (daily): Win.Malware.Dqan-9886402-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
YARA: Yara-Rules community: YR_AntiDebug_Checks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Dqan-9886402-0 (rule Win.Malware.Dqan-9886402-0) - engine signal, weight 0.90, confidence 0.95
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

49190 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\ProgramData\Microsoft\Windows\WER\ReportArchive\AppCrash_tsk_c4bc28fee67a_93e474ce145028f3787d94e01638e657b49a78d_00000000_7d78625e-a586-4d54-84e8-48c9aeb7a61d\Report.wer - 7cf338343f08e1e13c8fdb0cc8d11d203dfedc17d745b7027b8cc7b4ebdb7cfd
a8d491a0b2ab8ad959194885e8a1e2cdac81f11e90129ea4ada0fcd9866ecd21 - a8d491a0b2ab8ad959194885e8a1e2cdac81f11e90129ea4ada0fcd9866ecd21
9fea9bf7d9237dd80510fe4ba462c40096036e6eafae8c7fd5cc31a53d6173ae - 9fea9bf7d9237dd80510fe4ba462c40096036e6eafae8c7fd5cc31a53d6173ae

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://www.microsoft.com/pki/certs/MicCodSigPCA_08-31-2010.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://office.microsoft.com/0
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
fsshttpstate.xschema.storage.live.com
progid.xschema.sdx.live-int.com
groupfolder.xschema.storage.live.com
syncghost.xschema.storage.live.com
copysource.xschema.storage.live.com
jumplink.xschema.storage.live.com
mountpoint.xschema.storage.live.com
skydrivesync.xschema.wlx.live.com

Embedded IP addresses

104.208.16.94
52.123.252.194
4.230.171.124
57.154.63.210
52.253.84.76
135.232.92.97
74.179.77.204
20.184.175.1
104.18.33.89
74.178.240.61
172.178.240.163
52.110.12.44
52.110.12.15

File paths

P:\Target\x86\ship\delivery\x-none\ose.pdb
T:\:d:l:t:
e:\bt\1118478\client\onedrive\product\syncengine\clientcore\setuputilities.cpp
e:\bt\1118478\client\onedrive\product\syncengine\include\global.cpp
e:\bt\1118478\client\onedrive\product\syncengine\include\filesystem.cpp
e:\bt\1118478\client\onedrive\product\syncengine\include\mem.cpp
e:\bt\1118478\client\onedrive\product\syncengine\include\buffers.cpp
X:\:`:d:h:l:p:t:x:
V:\:
e:\bt\1118478\client\onedrive\product\syncengine\include\mem.h
e:\bt\1118478\client\onedrive\product\syncengine\include\stringutils.cpp

More Dqan samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report