MALICIOUS — f1d0ad9cecca23459f73e032cfa80cfe8a8a6390d4799b36cc207c385933ca57
MALICIOUS — f1d0ad9cecca23459f73e032cfa80cfe8a8a6390d4799b36cc207c385933ca57 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Amnesia family. 10 of 55 detection engines flagged it, exhibiting 7 ATT&CK techniques.
Identification
- SHA-256:
f1d0ad9cecca23459f73e032cfa80cfe8a8a6390d4799b36cc207c385933ca57 - SHA-1:
05e5f0b17c2d6ea384c2154b2588df43d9fead81 - MD5:
12bfbcc1658f5dba2661147b0d482187 - imphash:
3aaf46fe417dde7985c17bf9311368bf - ssdeep:
49152:qZIV8G9HN52lhqXChFciXZbDsD49XpzK4Hy0kBkzCym7PjcHGWMRDt56DAZ7ikU3:AeT6lJR95axyOP5WsOIgoI - TLSH:
T12C658DD6F63F2322E27ECE146C5C799CC465B198187DE7CCBB83646A00DA53BE960019 - Submitted as: f1d0ad9cecca23459f73e032cfa80cfe8a8a6390d4799b36cc207c385933ca57
- File type: pe · Size: 5770187 bytes
- Verdict: malicious (100/100) · Family: Amnesia
Detections (10 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Trojan.Generic-7135733-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Detect It Easy (packer/type): DIE:Turbo Linker
- Microsoft Defender: Trojan:Win32/Downloader.CH!MTB
- Emsisoft (Emergency Kit): Gen:Variant.Ransom.Amnesia.1
- Trellix Stinger (McAfee): Packed-KS!12BFBCC1658F
- Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 18 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Generic-7135733-0 (rule
Win.Trojan.Generic-7135733-0) - engine signal, weight 0.90, confidence 0.95 - 2 behavioral detection(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Memory forensics: 2 finding(s), e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85 - Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 31 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule
STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70 - YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule
DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: http://hoohoo.ncsa.uiuc.edu/docs/tutorials/imagemapping.html, 3.0.1.0, 3.0.1.3 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
- enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 29 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
47349 behavior events · 3 ATT&CK techniques · 38 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Program Files\LibreOffice\program\odbcconfig.exe -
2580c4fc322f764ebdd4f9abc85fcdd7df382f0e29665dc78c2b0aea709530a5 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w32.exe -
5e298176d45e170da8aed3651a8448c8703304a4c0ee32b0ccb612b0d9b90774 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\jfr.exe -
28a51187fc023fb12a01899c686ef01dc5ed960ccf036bac82fa4c831a98cb2d - C:\Program Files\LibreOffice\program\gpgme-w32spawn.exe -
7c28aa25b26070656006bdc6cec759ee18948e522366db9aa535551063d13cf2 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pkg_resources\api_tests.txt -
5c476fcb88a01c7aeadaa34734c1e795f3ba5d240a36a3b22c76e5e907297c02 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\ktab.exe -
1bbe1ed8cf2ff37a2ad2f94e52e54be70073b4fadeb94f0a26c9b4a7e6e0bd31 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64-arm.exe -
a441075d5ab8fcd04849aa1ce8520a734f895a926046a089c1e13ae5d09af4d8 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\lib2to3\Grammar.txt -
508e62e787dd756eb0a4eb1b8d128320ca02cd246ab14cc8ce0a476dc88cc5b6 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\lib2to3\PatternGrammar.txt -
ee5ba5db3b6722a0e2fbe2560ebc1c883e72328ef9c3b4da1c7c5d1cc649bce3 - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\conf\security\policy\README.txt -
6da0747334b0fea7592fd92614b2bbc8b126535e129b1fee483774d914e98eb5 - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\vendor.txt -
116f84ddc1395c402d545cc62278a402b38c0f118fd032d45b35e96384597c56 - C:\Program Files\LibreOffice\program\minidump_upload.exe -
f76904a3189509c42c01a470ae20d9c3d5b716129cf189be96d2257e9894d43f - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\w64.exe -
3a9a6f74ae3f6a861287128bcef565768709147d3707fc45e5e370457f7e039f - C:\Program Files\Eclipse Adoptium\jdk-21.0.5+11-jre\bin\rmiregistry.exe -
70f5db4ce7e8adbfaa8916c96f6a90611a8c8b87a14eeb14d160820ae8080eda - C:\Program Files\LibreOffice\program\python-core-3.12.13\lib\pip\_vendor\distlib\t64.exe -
d59ce6a4c846ef31c8051000db548444770e113bb658ea0422d048833a4c9630
Embedded URLs
- http://go.microsoft.com/fwlink/?LinkId=9996
- http://crl.verisign.com/tss-ca.crl0
- https://www.verisign.com/rpa
- https://www.verisign.com/rpa01
- http://crl.verisign.com/pca3.crl0
- http://CSC3-2004-crl.verisign.com/CSC3-2004.crl0D
- https://www.verisign.com/rpa0
- http://office.microsoft.com
- http://ocsp.verisign.com/ocsp/status0
- http://hoohoo.ncsa.uiuc.edu/docs/tutorials/imagemapping.html
- https://www.verisign.com/cps0
- http://logo.verisign.com/vslogo.gif04
- http://csc3-2010-crl.verisign.com/CSC3-2010.crl0D
- http://csc3-2010-aia.verisign.com/CSC3-2010.cer0
- https://www.verisign.com/cps0*
- http://crl.verisign.com/pca3-g5.crl04
- https://plusone.google.com/_/+1/confirm?hl=en&url=http//efigureout.com/
- http://www.microsoft.com/pki/certs/MicCodSigPCA_2010-07-06.crt0
- http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
- http://www.microsoft.com/pki/certs/MicTimStaPCA_2010-07-01.crt0
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787941911&P2=404&P3=2&P4=kyrM9m8u6LRO4P60qdCr0Ru0Ba3pZppTY5%2bxRNUuD3nh3X81WHdUltyp9f7Knuga3gRlmAzhgVBja88cz4ExHg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- go.microsoft.com
- crl.verisign.com
- www.verisign.com
- crl.microsoft.com
- office.microsoft.com
- ocsp.verisign.com
- hoohoo.ncsa.uiuc.edu
- logo.verisign.com
- csc3-2010-crl.verisign.com
- csc3-2010-aia.verisign.com
- plusone.google.com
- efigureout.com
- www.microsoft.com
- pandora.be
- outlook.network
- microsoft.sharepoint.com
- nleditor.osi.office.net
- messaging.office.com
- storage.live.com
- microsoft-my.sharepoint.com
- autodiscover.microsoft.com
- microsoft-my.sharepoint-df.com
- autodiscover-s.outlook.com
- ols.officeapps.live.com
- odc.officeapps.live.com
Embedded IP addresses
- 3.0.1.0
- 3.0.1.3
- 2.1.4.0
- 9.2.0.124
- 51.105.71.137
- 52.123.252.203
- 4.144.132.114
- 57.155.104.224
- 4.230.171.124
- 74.178.240.61
- 4.150.223.106
- 135.232.92.97
- 20.112.250.133
- 40.103.64.242
- 52.123.128.14
- 52.123.129.14
- 52.182.143.212
- 135.234.160.244
- 85.210.193.152
- 162.159.142.9
- 92.223.78.30
- 52.110.12.48
- 52.110.12.53
- 203.26.79.13
- 52.148.114.188
Registry keys
- HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows
- HKCU\Software
- HKCU\Software\Policies
- HKLM\Software
- HKLM\Software\Policies
File paths
- P:\server\source\mapprogs\winnt\imagemap.pdb
- C:\Development\VBProj\QDiff\VBGraphics.tlb
- C:\WINDOWS\System32\MSVBVM60.DLL\3
- C:\Program
- g:\Acro_root_at\Acrobat\Viewer\Win\output\acrobat\AcroRd32Exe.pdb
- d:\dbs\el\dec\Target\x64\ship\postc2r\x-none\msoadfsb.pdb
More Amnesia samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report