MALICIOUS — bf62bc7410870c095ee645f066b8868355c86690622847fefab65cf4ced5d173

MALICIOUS — bf62bc7410870c095ee645f066b8868355c86690622847fefab65cf4ced5d173 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the AB9A06E4 family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: bf62bc7410870c095ee645f066b8868355c86690622847fefab65cf4ced5d173
SHA-1: f03a805fe63656de9db8f9801b2618ffff2006c0
MD5: a118c1f86ee37648e7d4c9587b73b822
imphash: 532816589b7c9c3bed0fbcc3d1503ba1
ssdeep: 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8mpE:o68i3odBiTl2+TCU/+
TLSH: T1DF417D7D0F273B03C637CA544E055F8E0022B89AA23D54895B53947DA3FFC67AA5029E
Submitted as: bf62bc7410870c095ee645f066b8868355c86690622847fefab65cf4ced5d173
File type: pe · Size: 181014 bytes
Verdict: malicious (100/100) · Family: AB9A06E4

Detections (6 of 55 engines)

ClamAV (daily): Win.Worm.Nupik-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Worm:Win32/Delf.BE!MTB
Emsisoft (Emergency Kit): Dropped:Generic.Malware.SV!p2p!u.AB9A06E4
Kaspersky (KVRT): P2P-Worm.Win32.VB.dz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Worm.Nupik-1 (rule Win.Worm.Nupik-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: BalROK.HTML - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 3.6.1.0, 5.0.3.6 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

9983 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\SHARE_TEMP\Icon12.ico - 67bc1cd876f5059789b0dc8dc16c0b2155e55aca8d1c8439d70c8882e1875740
C:\Windows\bugMAKER.bat - 9f7600572bde6156c57ab63981b3a29c409dab4e15cc323b63338ec6c43ffd41
C:\BalROK.HTML - 3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4
C:\Windows\SHARE_TEMP\Icon6.ico - 0df5c718b7aee9f045f804f6a53cb0727f66e1ac1df612c6ecf342aed81ce130
C:\Windows\SHARE_TEMP\Icon2.ico - 00a339ff5338d0cfe91b262175eef4e5fd07f9d28e8f980a1f5ff43a5a81e597
C:\Windows\SHARE_TEMP\Icon7.ico - 71acc5a88debfdba0eed23272ef4b09fd6609eeb4b1ec457c72444472ad8b3a4
C:\Windows\winhash_up.exe - 32f7e4d3659cf6982e172a32a4daacd98487bf4e96771638298d5bb543dda465
C:\Windows\SHARE_TEMP\Icon3.ico - d2770f68db717c5335ceca3f2b0be1e294839a4904d3525f4c5e9847654d39c2
C:\Windows\SHARE_TEMP\Icon14.ico - adb0b5eb4fcfcc55c40eaa2ba3d142ed413293b2212bb2a1ddd8ed062db004bf
C:\Windows\SHARE_TEMP\Icon10.ico - 76f05dd79b2d3a08baf928e4811b0f179e96ac351ff8007f2e24f5fbb4b95253
C:\Windows\SHARE_TEMP\Icon5.ico - 462d333fc849166df8cb4e9ba6edd8404f4d79ebcd535125ecb5e8fe9d2cc0e0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787888766&P2=404&P3=2&P4=eosPzK305cp5fXKk%2fyZnCPIaMc%2bmY8Tsc7gRqM%2fl30lUTyYn72X8knHpfKIzkiVcoacKqZzTgYQoBvWrlD8vWA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787888837&P2=404&P3=2&P4=DDFrWbumjQcLpSaZq7yNC9jfFGo2cqroN3WR4WBx7p0s0OicXt%2fGRmAHx%2fwQv4cSKUoKPw7vFSfodvBwIC3Rpw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

3.6.1.0
5.0.3.6
20.50.201.203
57.155.101.212
4.230.171.124
52.253.84.76
135.232.92.137
74.178.240.51
20.42.73.31
74.179.77.204
40.99.133.226
20.112.250.133
52.123.128.14
52.123.129.14
40.103.64.242
135.234.160.245
203.26.79.13
162.159.142.9
135.232.92.34
135.233.45.223
52.148.114.188
85.210.196.11
20.42.179.204
172.66.2.5
72.145.35.108

File paths

C:\Programme\eMule

More AB9A06E4 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report