MALICIOUS — d8bd6d01504e5a899d4ad6207703db79c4d2babc954b9d576357be4c70d3296f
MALICIOUS — d8bd6d01504e5a899d4ad6207703db79c4d2babc954b9d576357be4c70d3296f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Plyromt family. 6 of 29 detection engines flagged it, exhibiting 6 ATT&CK techniques.
Identification
- SHA-256:
d8bd6d01504e5a899d4ad6207703db79c4d2babc954b9d576357be4c70d3296f - SHA-1:
a065f43ba8beb26c58ff50be1de684e19970ddcc - MD5:
6e280d479c50d16c1f8ab6a5585c4843 - imphash:
9f150b6d0052108b420ed080c89ce0f7 - ssdeep:
49152:UpCjKqFmKqFmKqF5pCjKqFmyI8boQhfD6UDvxvykXk1rBsgyegFKvc4clwYqpCjg:8C/CNDmlC/CNDmpC - TLSH:
T1F06A7BC5067770E1D1B6AA149E788CBD8403F15E52380E8C92C7F46EE4F4A37EAB15A4 - Submitted as: d8bd6d01504e5a899d4ad6207703db79c4d2babc954b9d576357be4c70d3296f
- File type: pe · Size: 9155603 bytes
- Verdict: malicious (98/100) · Family: Plyromt
Detections (6 of 29 engines)
- capa (capabilities): capability:collection/keylog
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win32/Plyromt!atmnm
- Emsisoft (Emergency Kit): Trojan.Agent.FEAY
- Kaspersky (KVRT): HEUR:Trojan.Win32.Fsysna.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 12 weighted signals:
- Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 2 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - capture keystrokes (rule
capture keystrokes) - capa signal, weight 0.40, confidence 0.80 - Contacted 21 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001, T1497 - dynamic signal, weight 0.40, confidence 0.75
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://www.blackievirus.com, http://repository.certum.pl/ctnca.cer09, http://www.certum.pl/CPS0 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Dropped 31 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
44245 behavior events · 2 ATT&CK techniques · 32 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- www.blackievirus.com
- ctldl.windowsupdate.com
- desktop-hsgcbep
- login.live.com
- ocsp.digicert.com
- v20.events.data.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- oneocsp.microsoft.com
- odc.officeapps.live.com
Dropped files
- C:\Program Files\LibreOffice\program\spsupp_helper.exe -
da8a91718b2edb6f89f68b7bf7044783814261a2c092cc5511374dd6b172bf7f - C:\Program Files\LibreOffice\program\swriter.exe -
e31149abcbca77d629d0ec6bac1942dedef63d2b23d07c8bfae9c87e6c56a89e - C:\Program Files\LibreOffice\program\uno.exe -
f1942b125a3962fc9e8e83d36522b6843107d099993579f26a75ffe779eb6f0c - C:\Program Files\LibreOffice\program\mar.exe -
56f0e7c2f34eaacf115fcfdf6fa08e745e245dbb0b8954426c1604de08aada79 - C:\Program Files\LibreOffice\program\twain32shim.exe -
6b14e510283e38d61f0c6c6117834e354fdf623c7958b8cb38b00fbeca1dab80 - C:\Windows\Êý¾Ý¿â.ini -
a7d672125f7cfff2208e0f647d64c35de67e495dd1b258e72837846a75ac9bc7 - C:\Program Files\LibreOffice\program\sdraw.exe -
260d1175074a96a53759b76c62c73c1247777011118fbec71375e23920effcc7 - C:\Program Files\LibreOffice\program\minidump_upload.exe -
31f0b9473fd9b5f868b953554f7dd1ad153b86bcd9f8cea825f95fea088fe628 - C:\Program Files\LibreOffice\program\opencltest.exe -
3b453b192ba7147a1de56b8ea22c1f92c686662e700e6a77448f350bf4d7aaca - C:\Windows\IE2.EXE -
ab0f22e8139168c0cdf68ffada87429d751399052fba1bc0a8698ee8520cfbb2 - C:\Program Files\SumatraPDF\SumatraPDF.exe -
dcd4136e9037270eebc1bbaa32d512b229c6e3ad470d3bb88dfe20e568ab5d73 - C:\Program Files\LibreOffice\program\soffice.exe -
f10d089ae91a19fe97a1fe10a0a41aebe322ba0bc6f91d5aac480f4f978afed3 - C:\Program Files\LibreOffice\program\soffice_safe.exe -
9e0553ae27a6ca983a5929724ade5faeb45dd2a2a07ac30982fe0a7c4d8c8a82 - C:\Program Files\LibreOffice\program\smath.exe -
e9e9800170125f280bd52c561da7ea6ae1a08fc6deaf6e6e9ec44520e4d378ee - C:\Program Files\LibreOffice\program\sweb.exe -
ece0bbe51fa9ec15c8a842fe873a0d613c2679a035e9048c413f431a96cf8aed
Embedded URLs
- http://www.blackievirus.com
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://crl.thawte.com/ThawteTimestampingCA.crl0
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- https://www.verisign.com/rpa
- http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
- https://www.verisign.com/rpa0
- http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
- https://www.verisign.com/cps0*
- http://logo.verisign.com/vslogo.gif04
- http://crl.verisign.com/pca3-g5.crl04
- http://crl.certum.pl/ctnca.crl0k
- http://repository.certum.pl/ctnca.cer09
- http://www.certum.pl/CPS0
- http://crl.certum.pl/cscasha2.crl0q
- http://repository.certum.pl/cscasha2.cer0
- https://www.certum.pl/CPS0
- http://repository.certum.pl/ctnca.cer0@
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://www.blackievirus.com/
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787910444&P2=404&P3=2&P4=N%2bguCmXqhJgLR4FoPyBQZBL%2f1LV1H7lEYh6B2XdDr%2bbkwB9Lrq%2fyWkRcVm0sMnMfgFMVA%2bnP8Os7mLu%2bkOCb4A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- www.blackievirus.com
- www.dywt.com.cn
- schemas.microsoft.com
- crl.thawte.com
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- www.verisign.com
- csc3-2010-crl.verisign.com
- csc3-2010-aia.verisign.com
- logo.verisign.com
- crl.verisign.com
- crl.certum.pl
- repository.certum.pl
- www.certum.pl
- lists.wku.edu
- ftp.info-zip.org
- gmail.com
Embedded IP addresses
- 4.150.223.98
- 52.253.84.76
- 20.42.179.192
- 135.233.95.144
- 74.179.77.164
- 4.150.223.111
- 4.230.171.124
- 4.150.223.106
- 52.123.129.14
- 20.76.201.171
- 135.234.160.246
- 50.16.27.236
- 203.26.79.13
- 52.148.114.188
- 135.232.92.34
- 52.168.112.66
- 92.223.78.30
- 57.155.104.224
- 72.145.35.104
- 52.110.12.15
- 52.110.12.50
File paths
- C:\WINDOWS\IE2.EXE
- C:\WINDOWS\123.EXE
- C:\WINDOWS\HELP2.VBS
- C:\re\jdk7u45\229\build\windows-amd64\tmp\sun\launcher\tnameserv\obj64\tnameserv.pdb
More Plyromt samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report