MALICIOUS — e68689002fa7ac015c56931b1e4e4c37a5dfe8eebb514662acce524b86ff6b88

MALICIOUS — e68689002fa7ac015c56931b1e4e4c37a5dfe8eebb514662acce524b86ff6b88 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bulz family. 9 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: e68689002fa7ac015c56931b1e4e4c37a5dfe8eebb514662acce524b86ff6b88
SHA-1: ad42134712187de31bac9d4436006d9d605c125d
MD5: c6be80864e8ba79d7eece3a399fcd43c
imphash: 1e58427826d059c34cbf4b958693e4c4
ssdeep: 12288:7aWzgMg7v3qnCiMErQohh0F4CCJ8lnyz3/06:OaHMv6Corjqnyz3/06
TLSH: T11A50A0A12135A73BD2B2E77868705BCF20B771AC11F919D85283C1EC31F5CAB942259B
Submitted as: e68689002fa7ac015c56931b1e4e4c37a5dfe8eebb514662acce524b86ff6b88
File type: pe · Size: 755979 bytes
Verdict: malicious (100/100) · Family: Bulz

Detections (9 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
capa (capabilities): capability:collection/keylog
MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Bulz-9940102-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Gen:Variant.Tedy.850583
Kaspersky (KVRT): Trojan-Downloader.Win32.Agent.gpyl

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 21 weighted signals:

ClamAV (daily) flagged Win.Malware.Bulz-9940102-0 (rule Win.Malware.Bulz-9940102-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Tedy.850583 (rule Gen:Variant.Tedy.850583) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Agent.gpyl (rule Trojan-Downloader.Win32.Agent.gpyl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 4 external host(s) and 24 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

28637 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - 4f2ceeb1c1cf95d88e97c23663a921b6b8bde212e2996b223237ffac40e43c98
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - 771757df314b59a0e6fd9054ec9c882b210c7b9f01ca9a62297c1c866188a86f
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - 303faaec9c0986c92807fe939fb5136f5a9ae9efa3063e153c5630ede6f175e5
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\H9BOFF51\getip[1].htm - 9e17cb15dd75bbbd5dbb984eda674863c3b10ab72613cf8a39a00c3e11a8492a
C:\Program Files\Managemenot\Monitor\tcpscrex.exe - b7918c2b366b089dd539e6f91b48d902606c44db3850e00c532e4829b6a6c998
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\17A440B37A6A20289A68E145191710C9 - a13e2d6b2efa0064e32e0e3e896ea53230fdbe49b787f121c92b228711bb54c1
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\17A440B37A6A20289A68E145191710C9 - 9ae01bd58b54a145bd1c1bb9228e518f7d7a6701eff50124c29f64a6675a83b1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://w347302.s98.ufhosted.com/getip.asp
http://www.aamailsoft.com/getip.php
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/22.crl
http://W347302.S98.Ufhosted.Com/NC/UP/Down.txt
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788120390&P2=404&P3=2&P4=l4Pa%2b8RxFq02JhEK8QF0gkXHB9f2tUwnRrgE4mFipSDWtoY9CW6JX3f4t1D46noOCslqruhbh0WMUEHFG7jsjQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

autoitscript.com
w347302.s98.ufhosted.com
www.aamailsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

40.79.163.154
4.230.171.124
48.211.4.16
40.84.97.4
74.178.240.51
104.46.162.230
52.230.59.222
20.165.94.63
101.227.111.7
135.233.45.222
66.175.209.193
104.18.20.213
203.26.79.13
52.123.252.193
135.233.95.80
172.178.240.161
52.148.114.188
72.145.35.100
52.110.12.8

More Bulz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report