MALICIOUS — dabb01de1317476c0bce26ba27173316d80db8460a7b036240e406402f162484

MALICIOUS — dabb01de1317476c0bce26ba27173316d80db8460a7b036240e406402f162484 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Prepender family. 7 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: dabb01de1317476c0bce26ba27173316d80db8460a7b036240e406402f162484
SHA-1: b25d5952ed47c3ea90e3b19f4f3733b5bb17724f
MD5: ddf632f602875ab5f0ffce425f39cf73
imphash: 5144a995e58e9a1dec8b8e0e5ed55aec
ssdeep: 12288:AFgcFBENceHMWq6W1sk38+wdwbeyS2Aw5iJH/6lMn0ZvbPIp:A/vk326W1sLOyyD9wfF0ZvLIp
TLSH: T1DB529DFC6D3F1105E9797BD41850BB4CB016624D7BEB419A9283CFAB10EB93388A4197
Submitted as: dabb01de1317476c0bce26ba27173316d80db8460a7b036240e406402f162484
File type: pe · Size: 963968 bytes
Verdict: malicious (100/100) · Family: Prepender

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Generic-9907165-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Virus:Win32/Pidgeon.A
Emsisoft (Emergency Kit): Win32.Prepender.Gen.1
Trellix Stinger (McAfee): Flyagent.d
Kaspersky (KVRT): Packed.Win32.Krap.g

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9907165-0 (rule Win.Trojan.Generic-9907165-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_fe01ce81dc (pid 6068) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Pidgeon.A (rule Virus:Win32/Pidgeon.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Prepender.Gen.1 (rule Win32.Prepender.Gen.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Flyagent.d (rule Flyagent.d) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Packed.Win32.Krap.g (rule Packed.Win32.Krap.g) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.eyuyan.com - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 18 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

68747 behavior events · 2 ATT&CK techniques · 25 dropped files.

Dropped files

C:\Program Files\7-Zip\7zG.exe.exe - 84376a1b6622d80789b0957365b0d545fe12530ebd3d2b87ace0694d3b94e389
C:\Program Files\7-Zip\7zFM.exe - 777e413ff2b77db712c94e4d18e7e73061622721d5bb374e21831fd921f47c7a
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcrobatInfo.exe - 59ba2282890d23f48f346ec4f42a0f7604d8e05d43c83131a6efb38473d24cc0
C:\Program Files\7-Zip\7zG.exe.ico - 8cad493433ec34a34ca6f4fd49655aaf7cbb4337752743804db83ea6c050d1fe
C:\Program Files\7-Zip\7z.exe - dee39156fda9a0b268b34a10e19151c2f6405420f65f169036ac79c2d2b550b8
C:\Program Files\7-Zip\Uninstall.exe.ico - ea0420b60b078a22fdcfd40d86d589793baa2e0327b37dcdcc5399aac4037d4e
C:\Program Files\Adobe\Acrobat DC\Acrobat\acrobat_sl.exe - 698370fedfed45bdbea09eb60be5a0844ea3dc48abe32c77f441b3397286e594
C:\Program Files\Adobe\Acrobat DC\Acrobat\ADelRCP.exe - 969c10652c89d1a6bdfc7a8ba12ce3eee99f4c8c4660e25be3ab5b3c69859ae0
C:\Users\analyst\AppData\Local\Temp\tsk_fe01ce81dc5c4976.exe.exe - 01e67fc68abc1bf27c51a354b9789c755331709b492032c5f0b5c68908cb97df
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe.exe - d93371f781a847922e6e22a2be9396e78c55907278b6a4b271c2b832c23fc6e3
C:\Program Files\Adobe\Acrobat DC\Acrobat\AcroBroker.exe - 9a100c71767ce52faa31974b04773ffff246c80773adb10edfaedadcaec601e8
C:\Program Files\Adobe\Acrobat DC\Acrobat\Adobe Crash Processor.exe - 2fa1a5de093c209cc02c02b3c1451375c0bd6338908bb426e952c45bc31c7484
276d1f695f744f4194ca3b8aa16a6cd31375581a42ce412a3a5ff98ef3a579a6 - 276d1f695f744f4194ca3b8aa16a6cd31375581a42ce412a3a5ff98ef3a579a6
C:\Program Files\7-Zip\Uninstall.exe - 3b73e22166685bfbb1bc07602303b146917b2c5dce504b6972b29728e791b477
C:\Program Files\Adobe\Acrobat DC\Acrobat\Acrobat.exe - 8a06f938c8f2ebe3c6b5d3f6d40e48b9556c284a29d0a9b029984876f277fa76

Embedded URLs

http://www.microsoft.com/pki/certs/MicrosoftTimeStampPCA.crt0
http://crl.microsoft.com/pki/crl/products/microsoftrootcert.crl0T
http://www.eyuyan.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

crl.microsoft.com
www.microsoft.com
www.eyuyan.com
wtqq.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.16
4.230.171.124
4.247.188.224
52.230.60.54
135.232.92.97
20.184.175.10
74.178.76.128
20.42.65.91
172.178.240.162
4.150.223.110
52.110.12.31
52.148.114.188
52.110.12.56
72.153.5.97
52.110.12.54
52.110.12.42

File paths

v:\.

More Prepender samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report