MALICIOUS — ee16e0af3e7b216e93b5007aec1ce729a9a4aad35d74e6e3d005101be27c13f7

MALICIOUS — ee16e0af3e7b216e93b5007aec1ce729a9a4aad35d74e6e3d005101be27c13f7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Blocker family. 6 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: ee16e0af3e7b216e93b5007aec1ce729a9a4aad35d74e6e3d005101be27c13f7
SHA-1: 38299b436cd7f02327b098df389841958503dc78
MD5: f2e2e879f975399711018d3ca178a6b1
imphash: ea28f662ab831803e9a8c823439760d0
ssdeep: 6144:Wt8IhVYFVED7l08BkjIf0r9b5if7/F0ZiCs+9O8IKOCzHDA6qMgqTHX/:Wt8vVED3Bk0Mr9Vif7/F1hIIabDA6JgS
TLSH: T14546C0794A083399C8A0FE54CC3A69BE5F3A2DA65BB7134D7E5B5039D980943C06E0D3
Submitted as: ee16e0af3e7b216e93b5007aec1ce729a9a4aad35d74e6e3d005101be27c13f7
File type: pe · Size: 310738 bytes
Verdict: malicious (100/100) · Family: Blocker

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Trojan.Blocker-391
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
Microsoft Defender: Worm:Win32/Drolnux!pz
Trellix Stinger (McAfee): W32/Worm-FFX!F2E2E879F975
Kaspersky (KVRT): Trojan-Ransom.Win32.Blocker.jgb

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 19 weighted signals:

ClamAV (daily) flagged Win.Trojan.Blocker-391 (rule Win.Trojan.Blocker-391) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s) across 3 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.66, confidence 0.90
Microsoft Defender flagged Worm:Win32/Drolnux!pz (rule Worm:Win32/Drolnux!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Worm-FFX!F2E2E879F975 (rule W32/Worm-FFX!F2E2E879F975) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Ransom.Win32.Blocker.jgb (rule Trojan-Ransom.Win32.Blocker.jgb) - engine signal, weight 0.55, confidence 0.85
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://www.ibayme.eb2a.com/dwn.dmp, http://www.ibayme.eb2a.com/ad.php, 1.9.0.5 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 17 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

126492 behavior events · 3 ATT&CK techniques · 90 dropped files.

Dropped files

C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\Focus0_48000Hz.raw - f68442c0ecae1d1d3bd435b25f1507cc74a4582c10f9567cf3e61d10d2d0d991
C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-en-us-onecore_31bf3856ad364e35_10.0.26100.1_none_f8f09a49f1697814\M1033Zira.keyboard.RAD - 47e33f4fa62eb9177512383aabbb6ff75ca7486d8db4dc5d2e26816712073dcc
C:\Program Files\Windows Media Player\Media Renderer\DMR_48.jpg - e010cdbed55de0c5e76f5431efbb898c8092ca72e3c5a2ad62798956791494ba
C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-c..ragethelpdiagnostic_31bf3856ad364e35_10.0.26100.1_none_a80d3d319006b4ee.manifest - a4a75456e6b5486dbe0a9bd9b882f0da5d27fa32c8770ae96fd0c0d2fba5e5ec
C:\Windows\WinSxS\amd64_microsoft-windows-t..peech-en-us-onecore_31bf3856ad364e35_10.0.26100.1_none_f8f09a49f1697814\M1033David.keyboard.RAD - c28e46bd33f2129cf37cad01715d1ac24156013a0cf5acd6f94b2053e9116261
C:\ProgramData\Microsoft\Windows\AppRepository\Microsoft.RawImageExtension_2.5.24.0_neutral_~_8wekyb3d8bbwe.xml - fe7491bf7fa0d8c16977f76066c296ecb3040b43b1e9d0d676ca280ac2c737da
C:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63045.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\29.jpg - 401005eb862c6ac5a57cba6ef3e91b380fe4b0a0810aa079e378f384c0f18a53
C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.26100.8246_none_fc849c86024680fc\Windows.Devices.Radios.dll - fe507242f22060f86c3bcef4c34473dfe46fd8421b01d2086f4e4447eb0ba900
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\GoBack_48000Hz.raw - b3c5a4d6099c4af9f4d8c3df3b4bef2e9a9193bc8c2ede7544e4c6ab4a618b6e
C:\Windows\WinSxS\amd64_microsoft-windows-devices-radios_31bf3856ad364e35_10.0.26100.7920_none_fc37734802807af8\r\Windows.Devices.Radios.dll - b0450f85ceb8c2f01557684133504a0967a3d753b1bf79a6e4979eb6417b6120
C:\Windows\WinSxS\Manifests\amd64_microsoft-windows-a..rarydialog.appxmain_31bf3856ad364e35_10.0.26100.8115_none_69a9721261f79982.manifest - 81473a8d4c7eb9d9e769b85aa2d9b77a83df8882530f3eb39756559c5576c376
C:\Program Files\WindowsApps\Microsoft.BingWeather_4.54.63045.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\15.jpg - eb17b99a4f8478b2da389343391ebcffaf389256dce178b7a692c00437df9dae
C:\Program Files\FoxitReader\bin\COM7.EXE - 441cb3fb46479b6ff2729872098673fcf9ae75738732c2621cb03928e8f5a122
C:\Windows\WinSxS\amd64_microsoft-windows-user-action-sounds_31bf3856ad364e35_10.0.26100.1_none_0d00fa0434e4eab8\Focus2_48000Hz.raw - 57ab9c8a42c55a1a84b3b5e8c7fb15d723bbfb69fafb834002e3228636d8c108
C:\Users\analyst\AppData\Local\Temp\Rar$EX7.src777\achsv.exe - c10efc4b537586a39798548f87ae8d53dc2457c7c8153dc45d2d64c583fb3fc5

Embedded URLs

http://www.ibayme.eb2a.com/dwn.dmp
http://www.ibayme.eb2a.com/ad.php
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.ibayme.eb2a.com
s.com

Embedded IP addresses

1.9.0.5
51.116.253.170
52.123.252.204
52.230.60.54
4.230.171.124
52.110.12.19
172.178.240.163
52.110.12.5
184.84.165.136
4.150.223.98
51.104.15.252
4.247.188.224
172.215.188.232
52.148.114.188
52.110.12.4

Registry keys

HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run

File paths

c:\windows\system32\syssh32.dll
C:\RECYCLER\bilbilal.exe
C:\MusicMP3
c:\WINDOWS\system32\shell32.dll

More Blocker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report