MALICIOUS — e3192f8edec672e53336e02545b30bc8ccce384847fa50f953f49f7daf9df208

MALICIOUS — e3192f8edec672e53336e02545b30bc8ccce384847fa50f953f49f7daf9df208 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Wapomi family. 7 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: e3192f8edec672e53336e02545b30bc8ccce384847fa50f953f49f7daf9df208
SHA-1: c37b60d5c72e1e64b1557b759c12d8c3e7439de0
MD5: 180d8a38d50d9cb6dbfe1efbe8810d0c
imphash: e38062877caac65585afa2d2c3200df4
ssdeep: 768:aW29n/P4/C9tY+gJXjAQGPL4vzZq2o9W7GsxBbPr:wPZnYrjLGCq2iW7z
TLSH: T13D2DBFCE0B543D8DD9CAD912F484CE1C1B07AAAC2639758C6907E52F51309AB6C39F4D
Submitted as: e3192f8edec672e53336e02545b30bc8ccce384847fa50f953f49f7daf9df208
File type: pe · Size: 28672 bytes
Verdict: malicious (99/100) · Family: Wapomi

Detections (7 of 55 engines)

ClamAV (daily): Win.Malware.Wapomi-10020301-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Microsoft Defender: Virus:Win32/Mikcer.B
Emsisoft (Emergency Kit): Win32.VJadtre.3
Trellix Stinger (McAfee): Trojan-FVWC!180D8A38D50D
Kaspersky (KVRT): Virus.Win32.Nimnul.f

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Wapomi-10020301-0 (rule Win.Malware.Wapomi-10020301-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Madeba): BsXfya.exe - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13383 behavior events · 2 ATT&CK techniques · 52 dropped files.

Dropped files

C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe - 3e27cc6407fc7d7b6e26495c6ff849c23cf3b6e9c8a885ea742ad7b3109af536
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe - 51e57fdf672acec905dc11fb467293a6c1251683cb92e769d451e46b9e0e92d6
C:\Users\analyst\AppData\Local\Temp\BsXfya.exe - 4354970ccc7cd6bb16318f132c34f6a1b3d5c2ea7ff53e1c9271905527f2db07
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t32.exe - fd0dd2874b0af0432282d5a180e49f505c0b5f228857f37b9c434f0b96c0362e
C:\Program Files\LibreOffice\program\gengal.exe - 0e03675850241d06080af9ec470649ca4a006222c4ff5d1b05029f1751fecf91
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jrunscript.exe - 3c6d62569a6dbad19d57ab33039ea0626a3eaf4386fa8b207c136957b26005ab
C:\Program Files\LibreOffice\program\simpress.exe - 920fb0937f8a9d345830865059b6ae3f35ab6803ad4cffef4447473ec18e17a0
C:\Program Files\LibreOffice\program\sdraw.exe - f19afa9bbf2ef0308f37ce6cb87cb3c59eb2d1685e08d8b15fd197dda813f379
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jabswitch.exe - c4c65264e0d3b9b31c5262259ec4b8af6ec62a1fff918a98910aabf17f015959
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w32.exe - 81b2df6d525f62cdb7464a203985c324dacbbb08a1765030b2f30bc56bbd31f9
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\gui-32.exe - d34df7e41afe7d6f9d5b2868cfb17754b1e4dd2cf42a14431d23f0e9efe02306
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\java.exe - 8c435a45123e88410f42259fcb3b303b5f60ce00e01d8d4a9c5bd342bf51e184
C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\keytool.exe - 599e533da3261e2fc678ccc3393bb90cafa7ce620196168b9c5cb41a4e48099b
C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\setuptools\cli-64.exe - bbb3de5707629e6a60a0c238cd477b28f07f0066982fda953fa6fcec39073a4a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787731977&P2=404&P3=2&P4=lKa3oQa1nCAACF89t6a0rpL78T1XaJcNqApYVeOGdaqOFOK%2fkXJUCzmkmoDHxH0RQSWau4JkyhHlEmfoF%2f7ofg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787732032&P2=404&P3=2&P4=hAmFYmScp7z9vQw7e4GAyvPM%2bBuSEsb4eI0x%2bsBcO2H4p8pC8Dz9RMrcVEQM74ynb3hdNw0p6T32BwzDUjpDgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ddos.dnsnb8.net

Embedded IP addresses

20.42.65.84
57.154.63.210
4.230.171.124
52.230.60.54
74.178.240.61
4.150.223.105
74.179.77.164
20.112.250.133
52.123.128.14
52.123.129.14
40.104.4.2
162.159.142.9
203.26.79.13
3.229.117.57
172.178.240.161
52.110.12.51
51.11.192.51
52.178.17.3
52.110.12.54
20.165.94.46
172.217.25.163
52.148.114.188
92.223.78.30
72.153.5.61
52.110.12.15

More Wapomi samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report