MALICIOUS — c8b6fdeed294b34c4e6b38a15b71b08d697a4603c89bc339a9c0695628c88453

MALICIOUS — c8b6fdeed294b34c4e6b38a15b71b08d697a4603c89bc339a9c0695628c88453 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RpcDcom family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

• SHA-256: c8b6fdeed294b34c4e6b38a15b71b08d697a4603c89bc339a9c0695628c88453
• SHA-1: af4cd192a02a960b49361e2bbbbb7c9fd87366d1
• MD5: 06743b8ca351e724849843a1aeb9dff1
• imphash: c4998075f1324ce0f644f12a548d76b1
• ssdeep: 3072:c7puEEMohqTY9VHPfueN8/VF3DLYpIwoxnEYsnRYbGODbFUJKSFynlE0:IpMM6Vg/f3wo9+ADsFyna0
• TLSH: T1504839A9093776C2DAF49A205D284E3D104EA4A7627C3A4B4ED3606FF2FB47355B0253
• Submitted as: c8b6fdeed294b34c4e6b38a15b71b08d697a4603c89bc339a9c0695628c88453
• File type: pe · Size: 372599 bytes
• Verdict: malicious (100/100) · Family: RpcDcom

Detections (7 of 56 engines)

• ClamAV (daily): Win.Exploit.DCOM-5
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• YARA: Yara-Rules community: YR_AntiDebug_Checks
• Microsoft Defender: Exploit:Win32/RpcDcom!pz
• Emsisoft (Emergency Kit): Trojan.Agent.FRPG
• Trellix Stinger (McAfee): Agent-FQX!06743B8CA351
• Kaspersky (KVRT): Virus.Win32.Lamer.kp

MITRE ATT&CK

• T1547.001
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Exploit.DCOM-5 (rule Win.Exploit.DCOM-5) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Exploit:Win32/RpcDcom!pz (rule Exploit:Win32/RpcDcom!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Agent.FRPG (rule Trojan.Agent.FRPG) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Agent-FQX!06743B8CA351 (rule Agent-FQX!06743B8CA351) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Virus.Win32.Lamer.kp (rule Virus.Win32.Lamer.kp) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: http://www.gnu.org/software/coreutils/, http://translationproject.org/team/, http://gnu.org/licenses/gpl.html - static signal, weight 0.35, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Contacted 2 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
• Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

5633 behavior events · 1 ATT&CK techniques · 0 dropped files.

Runtime network

• time.windows.com
• settings-win.data.microsoft.com
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 188.114.148.52.in-addr.arpa.
• 10.240.0.1
• 52.148.114.188 SG · Singapore · AS8075 Microsoft Corporation
• 20.42.179.204 US · Moses Lake · AS8075 Microsoft Corporation

Embedded URLs

• http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
• http://www.microsoft.com/windows0
• http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
• http://www.gnu.org/software/coreutils/
• http://translationproject.org/team/
• http://gnu.org/licenses/gpl.html
• http://www.gnu.org/gethelp/

Embedded domains

• www.microsoft.com
• crl.microsoft.com
• www.gnu.org
• translationproject.org
• gnu.org
• cygwin.com

Embedded IP addresses

• 212.33.237.86
• 6.0.1.0
• 52.148.114.188
• 20.42.179.204

File paths

• C:\Program
• C:\\Program
• C:\\$SysReset\Scratch\csrss.exe
• C:\\MSOCache\All
• P:\Target\x86\ship\setupexe\x-none\setup.pdb
• C:\\Windows\Installer\{884CF059-9A11-4DF7-A2A7-17EFE90B9278}\_0148EBBC1BEEF5A8067C19.exe
• C:\\cygwin64\bin\unlink.exe

More RpcDcom samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report