MALICIOUS — bb8db1a5f16af7b28037d1ac71260019b7b8fa07c0d5d32ce11b97054bd80c81

MALICIOUS — bb8db1a5f16af7b28037d1ac71260019b7b8fa07c0d5d32ce11b97054bd80c81 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the NanoCore family. 4 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: bb8db1a5f16af7b28037d1ac71260019b7b8fa07c0d5d32ce11b97054bd80c81
SHA-1: 8c335b50cfe98290d6e8299b89a72546f7374098
MD5: 8cddd44ea4e6ce185fdc048719013d5c
imphash: 4bfde1223391e32fec766cd1d41fa3e7
ssdeep: 96:SZwlgQU2UfoXoXvpkoule9figymmb04yCGd0ZdO55vuJy6bT4qTOkWYvGWv3aLl:dlgQULRkc9f3kbKd0ZIv+Iq3WGGWvaY
TLSH: T1EE2B95FD8396D1C6D1EC8D431E5E88CC005374B604649B29B2BFE5742A690BBDA1339B
Submitted as: bb8db1a5f16af7b28037d1ac71260019b7b8fa07c0d5d32ce11b97054bd80c81
File type: pe · Size: 22528 bytes
Verdict: malicious (100/100) · Family: NanoCore

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Generic-9907911-0
Microsoft Defender: Trojan:Win32/Tnega.C!MTB
Emsisoft (Emergency Kit): Gen:Variant.NanoCore.359
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907911-0 (rule Win.Trojan.Generic-9907911-0) - engine signal, weight 0.90, confidence 0.95
4 behavioral detection(s) across 4 rule(s): PowerShell Encoded / Download Cradle [high] (rule tl-powershell-encoded) - dynamic signal, weight 0.69, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Tnega.C!MTB (rule Trojan:Win32/Tnega.C!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.NanoCore.359 (rule Gen:Variant.NanoCore.359) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
1 IDS alert(s): ThreatLens Discord CDN payload/exfil - network signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

37163 behavior events · 2 ATT&CK techniques · 23 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_0livtey2.tp3.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - ef4203d5aeeae20d13ba1da4661629e64abcba833cd6f3e42995040578df8540
3d2fde52cb7ad9cbc2b693bcd7dc6ce33bf76f484a6fd885e03d38c2d5fc8be7 - 3d2fde52cb7ad9cbc2b693bcd7dc6ce33bf76f484a6fd885e03d38c2d5fc8be7
bbc424e6b83daaff7567c4364edb16670b0d98eced83103dd772ad10868a1239 - bbc424e6b83daaff7567c4364edb16670b0d98eced83103dd772ad10868a1239
21d23f4fc20d26f6e5abad3a3167545ecd1964977e7134e9605d87d41bd88f16 - 21d23f4fc20d26f6e5abad3a3167545ecd1964977e7134e9605d87d41bd88f16
6d74199532f88537b9a2e338857c755006983362694c62719639d06f8ec237a3 - 6d74199532f88537b9a2e338857c755006983362694c62719639d06f8ec237a3
691ce044493667936985a93a54e26272d1052405d94672e5bb9849bb6014fb33 - 691ce044493667936985a93a54e26272d1052405d94672e5bb9849bb6014fb33
547b0f2910f8f516b817cfb07b7001ea325007be1dc5aaba15302f0445336a1e - 547b0f2910f8f516b817cfb07b7001ea325007be1dc5aaba15302f0445336a1e
0e14e4440b37386c20acd821abcac406c67231b65d80cfcba22c1761cd4b3c0a - 0e14e4440b37386c20acd821abcac406c67231b65d80cfcba22c1761cd4b3c0a
8c184fef806baec885073391b4e7acf61882df17454ef91992d3304454c5b5cc - 8c184fef806baec885073391b4e7acf61882df17454ef91992d3304454c5b5cc
6fe5a746c7ca696c254b39be5136dfeef7120cd339658582bef667e8baa2149f - 6fe5a746c7ca696c254b39be5136dfeef7120cd339658582bef667e8baa2149f
0de6ac32f5a173081b5ac6f472a7abb25ef15dbcff462777f2e2c53d2c0ac573 - 0de6ac32f5a173081b5ac6f472a7abb25ef15dbcff462777f2e2c53d2c0ac573
1519e3d2e902856c29d92b5eb731a567534d28195e9921115148cbf51ce87539 - 1519e3d2e902856c29d92b5eb731a567534d28195e9921115148cbf51ce87539
4d5bd668dbcb9fde11d51bbe9f82aa2a0beac15508831313af94347f8812ee28 - 4d5bd668dbcb9fde11d51bbe9f82aa2a0beac15508831313af94347f8812ee28
3634e6712778e54b27ffb10715dad0edb9e4e46a6e6c311cb8f1a93080fb9e02 - 3634e6712778e54b27ffb10715dad0edb9e4e46a6e6c311cb8f1a93080fb9e02

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

cdn.discordapp.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.67
20.247.185.124
52.123.252.219
4.230.171.124
162.159.133.233
4.150.223.102
20.42.73.25
135.234.160.244
57.154.63.210
20.42.179.192
72.145.35.104
52.148.114.188
52.110.12.28
52.110.12.1

More NanoCore samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report