MALICIOUS — b73c835b3f88069a628114e937dfe134309292ccf965223def43c15e9f51b71a

MALICIOUS — b73c835b3f88069a628114e937dfe134309292ccf965223def43c15e9f51b71a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AddUser family. 8 of 52 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b73c835b3f88069a628114e937dfe134309292ccf965223def43c15e9f51b71a
SHA-1: 879870b7e26c2bcc6b455a5949e34b327f4c3990
MD5: c548618d5b183cdd0eff577d29deef40
imphash: 68864e2c52b98624974843d1b22a695b
ssdeep: 12288:CzCr6D+2OkeG9F1xk1kwZRo5FbDFBQX6f6AkdIAELARixZFDu9:Cza2OkeG9jxyTo5Fbz/zkOLLARixXDu9
TLSH: T1AA4A23D806A6B310E1FA3777DB48D98D10D165F3686D203512C7532FA2F609BAE5A323
Submitted as: b73c835b3f88069a628114e937dfe134309292ccf965223def43c15e9f51b71a
File type: pe · Size: 441280 bytes
Verdict: malicious (100/100) · Family: AddUser

Detections (8 of 52 engines)

MalwareAnalyser heuristics (entropy/packer): ASPack
ClamAV (daily): Win.Malware.Ulise-9806872-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:ASProtect SKE 2.72+
LIEF (executable format parser): lief:invalid-authenticode
Microsoft Defender: Trojan:Win32/Tonmye!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.AddUser.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9806872-0 (rule Win.Malware.Ulise-9806872-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (AddUser): 55988cdd02203fa690737b6e6aca99ae0aeaff42ae0807ede503918304a182f7 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 3 finding(s), e.g. RWX/private injected region in svchost.exe (pid 932) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Tonmye!pz (rule Trojan:Win32/Tonmye!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.AddUser.gen (rule HEUR:Trojan.Win32.AddUser.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 33 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:ASProtect SKE 2.72+ (rule DIE:ASProtect SKE 2.72+) - engine signal, weight 0.35, confidence 0.70
LIEF (executable format parser) flagged lief:invalid-authenticode (rule lief:invalid-authenticode) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.360.cn, http://www.eyuyan.com, http://www.360.cn/ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: ASPack, high-entropy-sections:.text, ASProtect SKE 2.72+, ASPack 2.12-2.42 - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

14509 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9544/files/55988cdd02203fa690737b6e6aca99ae0aeaff42ae0807ede503918304a182f7 - 55988cdd02203fa690737b6e6aca99ae0aeaff42ae0807ede503918304a182f7
/opt/CAPEv2/storage/analyses/9544/files/a5c5a914600974be1bdf9dc5ca7eb87dab6018acafe96285b5312aeff8d99fc0 - a5c5a914600974be1bdf9dc5ca7eb87dab6018acafe96285b5312aeff8d99fc0
c163f9f2fe07a45800d27be1620eeb7445fba8631713904e2fbd113e27a25842 - c163f9f2fe07a45800d27be1620eeb7445fba8631713904e2fbd113e27a25842
f8b8169e556abd98f831b3e27bfe328412b8090ad6dba8ae9c993873e4c0d17a - f8b8169e556abd98f831b3e27bfe328412b8090ad6dba8ae9c993873e4c0d17a

Embedded URLs

http://crl.verisign.com/tss-ca.crl0
https://www.verisign.com/rpa
https://www.verisign.com/rpa0
https://www.verisign.com/cps0*
http://logo.verisign.com/vslogo.gif0
http://crl.verisign.com/pca3.crl0
http://www.360.cn
http://www.eyuyan.com
http://www.360.cn/
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786421276&P2=404&P3=2&P4=nucPyY1GUvi%2fkqU5hbB%2bVtoVTornGSLVGYTumYox7ncCLvXDK62pzJXx2Xhxn4aw7qj2tD0MQBvRvDbeQpgVGA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786421330&P2=404&P3=2&P4=YNiUempHHOPFpIV9pIB4vmjp%2b3Sifq6quXPEBTaY%2frl0zIFDL6thfnz72sNZ4jNIOh52jcNZGp7Nx0Y1s7ailA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.verisign.com
www.verisign.com
csc3-2009-2-crl.verisign.com
csc3-2009-2-aia.verisign.com
logo.verisign.com
www.360.cn
www.eyuyan.com

Embedded IP addresses

20.184.175.20
4.230.171.124
40.84.97.4
20.247.184.197
74.178.240.61
74.179.77.164
4.150.223.114
4.247.188.224
135.234.160.246
20.184.175.18
20.42.65.85
172.178.240.162
203.26.79.13
52.123.252.246
74.179.71.159
52.148.114.188
52.110.12.56
52.110.12.10
72.145.35.110
92.223.78.30

More AddUser samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report