MALICIOUS — bc5224e02c24b0eae1fde234c5e9878df54cda9d3f2fc14be619982a55d050d8

MALICIOUS — bc5224e02c24b0eae1fde234c5e9878df54cda9d3f2fc14be619982a55d050d8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Blocker family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: bc5224e02c24b0eae1fde234c5e9878df54cda9d3f2fc14be619982a55d050d8
SHA-1: e7dd2c8b1b5db3c30d18a18729afc280a1d6aa30
MD5: 9acb402b38d4c6fff350242563886278
imphash: 8d08b9aff260461badc1821f4f717247
ssdeep: 196608:0Xazg7DS8Xazg7DS8Xazg7DS8Xazg7DSv:vg7uXg7uXg7uXg7uv
TLSH: T1666923BE131B7403DE2AD62964852FCD04337C6D507D6888467B84BD83F6CEB26817A9
Submitted as: bc5224e02c24b0eae1fde234c5e9878df54cda9d3f2fc14be619982a55d050d8
File type: pe · Size: 8316928 bytes
Verdict: malicious (100/100) · Family: Blocker

Detections (6 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Mbrlock-9779766-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Blocker.EM!MTB
Emsisoft (Emergency Kit): Gen:Variant.Genie.689
Kaspersky (KVRT): HEUR:Trojan.Win32.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Mbrlock-9779766-0 (rule Win.Trojan.Mbrlock-9779766-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 5 finding(s), e.g. process hollowing in 7D57AD13E21.ex (pid 3108) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Dropped a malicious payload: OScam Collection.htm - dynamic signal, weight 0.62, confidence 0.90
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 25 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

34114 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\top2.gif - 7cb06f8dbfa5f13359e2dcee822fae73ef01a00ff29ce99ec401a73017875aee
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db - 723ef109024a7d1b03e6335ee53d0140027b2224765fe5fed23d1b07906a03a6
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db - d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
C:\Users\analyst\AppData\Local\Temp\OScam Collection.htm - fcd785d06efc594628f2460b3098d5b97633f2e4587be0fa50dd8cd60a447407
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db - a87402eefbc4625ced6e89433215eabe5a39f33e29ad868da483d2e1860a9a93
C:\Users\analyst\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT - b0715c24eef4c3d20c812bb858a4e50569a836f0217c7652fb350be953e5f50d
C:\Users\analyst\AppData\Roaming\7D57AD13E21.exe - 4e878364be78d4c90fadb45f3e97e4f16f1a65462b02b79d5299de5cbf9ef331
C:\Users\analyst\AppData\Roaming\Scegli_nome_allegato.exe - ab01a333f38605cbcebd80e0a84ffae2803a9b4f6bebb1e9f773e949a87cb420
ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49 - ca517a62cc4bd322c4afb74599b3f4a6f414d0fb6f750eae56a0d9c95d997f49
0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5 - 0367653f24003fae1324a91b98f41caabdd5d8578a49132aa0222f02d2a106c5
f647ad5887b1993d77bf5e2e6ab9f8ea77328ccf8f68fb78ffae77c1d8970310 - f647ad5887b1993d77bf5e2e6ab9f8ea77328ccf8f68fb78ffae77c1d8970310

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787943098&P2=404&P3=2&P4=NQ4Mz2Domvbap2rZS6ayaMUILzpwqc4HiAUCXXuzJ7n8g5f6uBynRlQqoOoQKfO2IhGX4em%2fmt1yb1ZSZ86ZRg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787943143&P2=404&P3=2&P4=MuDFPlt%2bUFunxyBeT0g4HmFEzuECNlh6A6bHKrO5hpbBOoGTgdUXzMAKyvjZOh2YGa3KKyLMuDgArwuaCxdAiA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

hb.za
sunray1975.zapto.org

Embedded IP addresses

51.116.246.106
20.247.184.197
74.179.77.204
172.215.188.232
4.150.223.96
4.230.171.124
135.232.92.97
20.231.239.246
52.123.129.14
52.123.128.14
52.123.252.218
203.26.79.13
74.178.232.29
4.150.223.101
52.178.17.235
52.110.12.53
162.159.142.9
52.110.12.31
135.233.45.222
52.148.114.188
135.233.45.223
92.223.78.30
52.123.252.219
72.154.7.112
52.110.12.28

File paths

B:\:t:
X:\:`:d:h:l:p:t:
X:\:`:d:h:l:p:t:x:
J:\:`:d:h:
I:\ba

More Blocker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report