MALICIOUS — Lista de comenzi este atasata.exe

MALICIOUS — Lista de comenzi este atasata.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the DelfInject family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: c902cb038d194ee56e728c30a1e1b8121cd76781ebc4e71b5627f094fdd0e707
SHA-1: e2e9518d3c8ee125f51f7d61e5f7095c9727fcf6
MD5: 9d232fab426753a42f42869060f5714e
imphash: e688ba6827fe39f64f376141d0a77d43
ssdeep: 12288:tfN+uElN7JkOAn0vf9XuvvTsEIMw048gkc6fMFvjzZrpvze5EJAMJVRFSl5liL6:tFoN7KnUvzeyvVRFSl5liLEe/wA6
TLSH: T1D7538DEA05D6BE77C3D4D25CC3275AAE040F58A219F56D48029FD83DD6B80EB1F82285
Submitted as: Lista de comenzi este atasata.exe
File type: pe · Size: 1082880 bytes
Verdict: malicious (100/100) · Family: DelfInject

Detections (5 of 56 engines)

capa (capabilities): capability:collection/keylog
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/DelfInject.AM!MTB
Emsisoft (Emergency Kit): Gen:Variant.Strictor.265519
Kaspersky (KVRT): HEUR:Backdoor.Win32.Remcos.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_9158b56a46 (pid 3296) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/DelfInject.AM!MTB (rule Trojan:Win32/DelfInject.AM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Strictor.265519 (rule Gen:Variant.Strictor.265519) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Remcos.gen (rule HEUR:Backdoor.Win32.Remcos.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
1 IDS alert(s): ThreatLens Discord CDN payload/exfil - network signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 external host(s) and 8 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

11106 behavior events · 2 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D744C9621913B92E124E007C87A1EE30 - 20123a9998e5e223747fcb132c5091bd0c263134dfcaca49837fab53f8abe9d3
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - f4a0b0f4c4fdd55fc2daca2e08de6e33131abfd890e2d6267770dcfd09230592
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D744C9621913B92E124E007C87A1EE30 - 5ca15d92e5269917d6f0816e02ea7e8217ff50b0c3e18cd640df08b16a8a4ddc
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 - af79a7532945fcab2668ba736bd17da37ef2ae3925d66e219a85122eb5ba5380
fb3853cc5e8658dc13641ee44ce890da3b1b4677a1e84ef5c3fbd8a57680ab14 - fb3853cc5e8658dc13641ee44ce890da3b1b4677a1e84ef5c3fbd8a57680ab14

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/vpMVCCR8pGU.crl

Embedded domains

cdn.discordapp.com

Embedded IP addresses

20.50.201.206
20.247.185.124
4.230.171.124
20.42.179.192
162.159.142.9
52.110.12.1
52.110.12.40
4.247.188.224
72.154.7.16
52.148.114.188
162.159.130.233
52.110.12.16
52.110.12.2

File paths

X:\:`:d:h:l:p:t:x:
X:\:`:d:h:l:p:~:
T:\:d:l:t:

More DelfInject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report