MALICIOUS — b13a3146b04555fef0676283f8610f25607cfa97b280648c20e7ab17b6cd97fb

MALICIOUS — b13a3146b04555fef0676283f8610f25607cfa97b280648c20e7ab17b6cd97fb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Msilzilla family. 3 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: b13a3146b04555fef0676283f8610f25607cfa97b280648c20e7ab17b6cd97fb
SHA-1: 12b494a07799a985a3a21606889b3c106914fb1a
MD5: a9b4420a47de930910b550683a127abf
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 49152:FtMihw9rD11BY7Ojp0zdXlU+bggttvQHOpizI67CvvQZyRlmX:FaX9rD11BY7I0ZXlptczI67Cv
TLSH: T1A463414CC93D1A29E3978DD52F33C08D49F250B21EF9A191450A6BA29083DE7D48FDE9
Submitted as: b13a3146b04555fef0676283f8610f25607cfa97b280648c20e7ab17b6cd97fb
File type: pe · Size: 5068288 bytes
Verdict: malicious (99/100) · Family: Msilzilla

Detections (3 of 55 engines)

ClamAV (daily): Win.Packed.Msilzilla-10015963-0
Emsisoft (Emergency Kit): IL:Trojan.MSILZilla.10411
Kaspersky (KVRT): HEUR:Trojan.MSIL.Crypt.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Msilzilla-10015963-0 (rule Win.Packed.Msilzilla-10015963-0) - engine signal, weight 0.90, confidence 0.95
Emsisoft (Emergency Kit) flagged IL:Trojan.MSILZilla.10411 (rule IL:Trojan.MSILZilla.10411) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Crypt.gen (rule HEUR:Trojan.MSIL.Crypt.gen) - engine signal, weight 0.55, confidence 0.85
3 behavioral detection(s) across 3 rule(s): Scheduled Task / Job [medium] (rule tl-scheduled-task) - dynamic signal, weight 0.46, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Dropped 5 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

56975 behavior events · 2 ATT&CK techniques · 17 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\4658b084-a5f0-7ce2-94f9-07d7442f04db\COM Surrogate.exe - 95422fef089455a94e804ab17b2b71af61ece3e7a81d7701add8b6094225204f
C:\Users\analyst\AppData\Roaming\4658b084-a5f0-7ce2-94f9-07d7442f04db\4658b084-a5f0-7ce2-94f9-07d7442f04db.vbs - f39f61e5eadab50cbba0f1182883aa24ed7fe76a7907e21c6b3c9c9a3f91bc38
C:\Users\analyst\AppData\Local\Temp\huhtmuu5\huhtmuu5.cmdline - fe55169400f9bc44c114f791201e59e1c5833a5d995d621ffed0ed31749730e1
C:\Users\analyst\AppData\Local\Temp\huhtmuu5\huhtmuu5.out - 97d3855b96c27655d4c10c421b2f88b6e990df2c1f66813b7d0c119c389320d1
C:\Users\analyst\AppData\Roaming\1e6e4118-7170-5773-7ba1-4a9f0e676bcc\1e6e4118-7170-5773-7ba1-4a9f0e676bcct.bin - fade7bad6d9530abc74022d0b0a94c3d2ffb03a52685a354cf1e2a81798f47d6
C:\Users\analyst\AppData\Roaming\1e6e4118-7170-5773-7ba1-4a9f0e676bcc\1e6e4118-7170-5773-7ba1-4a9f0e676bcct.bin - 86f8f796a7694ffe3028d49ec65c79872d689f76d5a94877a9402f0a11b49bbd
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_szcitfmq.gui.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Roaming\4658b084-a5f0-7ce2-94f9-07d7442f04db\gpu - 76f0542e3a8eef6d48f24ed7ecd41045399111d1478c6ecc92ff5ab7bb8a6b0f
C:\Users\analyst\AppData\Local\Temp\huhtmuu5\CSCAB4CED0A63BB4BD4BDA795A764B4FC6.TMP - a16fa72e1b012fa2e9e1843afd9939ed77ceacde54ac7794ca3ae6090b43d7e1
C:\Users\analyst\AppData\Local\Temp\huhtmuu5\huhtmuu5.0.cs - 2382a2b44caea1de0fb68dd68728dbef9504ef187baf1a1d71b126866655b167
C:\Users\analyst\AppData\Local\Temp\RES2C1C.tmp - 1570548b5c7ef823a09e823399b6f67d03f9670b8cc659b65b3f94566800b2ef
C:\Users\analyst\AppData\Local\Temp\huhtmuu5\huhtmuu5.dll - 9a2f9709d880f931ba1dc3b3653dafd43b1573cea01f3f51b043ae4539dc39d1
66ac8510e8a69155e78090e14a92e28b019effbf50b713074aa8771a47df5390 - 66ac8510e8a69155e78090e14a92e28b019effbf50b713074aa8771a47df5390
da3018a52f1689854f99d2a608a20e7bf057fbf4d84ef1979bb94b29e884c530 - da3018a52f1689854f99d2a608a20e7bf057fbf4d84ef1979bb94b29e884c530
d04af6f09019fc1c8b9ab73f4787506e378edddded23dbc4b41343f0c790e7d7 - d04af6f09019fc1c8b9ab73f4787506e378edddded23dbc4b41343f0c790e7d7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788244311&P2=404&P3=2&P4=MEka4jKAR2F4axPtNKkMABiPjz%2fTvvN4ve23nVbbckpOikPH2CoESmJA6K0qMQr9gy3rcRLnDd0nsvEfmBFHHQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

aefd.nelreports.net
proxy-23784689475645.com
proxy-32890763407038497.com
proxy-564165413210694.com
bitbucket.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
oneclient.sfx.ms

Embedded IP addresses

4.150.223.114
20.247.185.124
52.123.252.216
4.230.171.124
52.230.59.222
104.18.33.89
20.42.65.90
52.168.112.67
172.178.240.162
85.210.193.152
104.192.143.21
52.217.165.137
4.150.223.105
57.154.63.210
52.148.114.188
40.79.167.10
85.210.196.11
203.26.79.13
40.84.85.40
40.79.150.123
20.42.179.204
40.84.97.4
52.123.129.14
52.110.12.44
20.165.94.46

File paths

b:\P

More Msilzilla samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report