MALICIOUS — 03216d525ba58e647dfbb00c0ae8528af967047a3783d57975d77682cdfafab6

MALICIOUS — 03216d525ba58e647dfbb00c0ae8528af967047a3783d57975d77682cdfafab6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Lightmoon family. 6 of 56 detection engines flagged it, exhibiting 9 ATT&CK techniques.

Identification

SHA-256: 03216d525ba58e647dfbb00c0ae8528af967047a3783d57975d77682cdfafab6
SHA-1: 184fe75fd8d5563bb677fcb9f2bc174830b2b4aa
MD5: e256cf358c4264c7331ae4d59229f9c8
imphash: c3c45736ce6d65c71a48cac58108083d
ssdeep: 6144:oeHwXUU5EYCTvaBjRjWrLJKuKnGML5Njcxq:oyMUusvalgg5Njaq
TLSH: T1C646BF890A1DFDA3E2EEC70F6940D47C180FA6652D79B20832DB849E81D21FB707556E
Submitted as: 03216d525ba58e647dfbb00c0ae8528af967047a3783d57975d77682cdfafab6
File type: pe · Size: 309780 bytes
Verdict: malicious (100/100) · Family: Lightmoon

Detections (6 of 56 engines)

capa (capabilities): capability:credential-access
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
ClamAV (daily): Win.Worm.VB-663
Microsoft Defender: Worm:Win32/Lightmoon!pz
Emsisoft (Emergency Kit): Win32.Worm.LightMoon.A@mm
Kaspersky (KVRT): Email-Worm.Win32.VB.cp

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 18 weighted signals:

ClamAV (daily) flagged Win.Worm.VB-663 (rule Win.Worm.VB-663) - engine signal, weight 0.90, confidence 0.95
3 behavioral detection(s) across 3 rule(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.86, confidence 0.90
Microsoft Defender flagged Worm:Win32/Lightmoon!pz (rule Worm:Win32/Lightmoon!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Worm.LightMoon.A@mm (rule Win32.Worm.LightMoon.A@mm) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Email-Worm.Win32.VB.cp (rule Email-Worm.Win32.VB.cp) - engine signal, weight 0.55, confidence 0.85
access stored credentials (rule access stored credentials) - capa signal, weight 0.50, confidence 0.80
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1622, T1082 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:credential-access (rule capability:credential-access) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections: (rule high-entropy-sections:) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: high-entropy-sections: - static signal, weight 0.25, confidence 0.55
Dropped 32 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

55953 behavior events · 3 ATT&CK techniques · 37 dropped files.

Dropped files

C:\Windows\OUD4K1V\LOL7O5I.com - 6ab13afe028f6b81566a3bf76e01209308827097b87bc88738503691aebcbb9e
C:\Windows\OUD4K1V\OGM3W1F.exe - 46fdb420da33a40cfa15605556ba1153bd83a77289e896df34dd93e2928cf8e4
C:\Windows\System32\RJK8O0X\JED6K2F.cmd - e3410d70a092b778ea5d5e520e4d402d6d333834143f165c71fac87678c1b88d
C:\Windows\64enc.en - 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
C:\Windows\OUD4K1V\regedit.cmd - 64b6ee7ec00c856dba94fa11ccd9b8b6db19ac8b06bb8ced380bfba5e839298c
C:\Windows\System\msvbvm60.dll - eb319cc5c5e432b3f111b185fa12e1410b43d90b81b4bd8d7f007c860256b4b1
C:\Users\analyst\AppData\Local\Temp\~DFA55388022F1CBDA5.TMP - 097123076ec4652d22c51ba7fe39ca62a56195f9986a5b3551b38ae377492a8c
C:\Users\analyst\Documents\My Music\My Music.exe - 92caa735c2cdf46d6b993da242c1ec46664449497ae365bca11b436fe52f5d66
C:\Windows\cypreg.dll - a58b76d937d148c8aab3323e833b131d662d8013a2d715d00a17f111e5eb2468
C:\Windows\System\msvbvm60.dll - 2160e45f6bb10d3e3a8765ffc01b42dd6a68159abf14c1a8dea2602365bb002d
C:\Windows\System32\JED6K2FNSE8W8V.exe - 8b6cfdb16ccc794681c17218c30a6e36c94340493d6c46d0f503abf5d7f23157
C:\Windows\System32\RJK8O0X\JED6K2F.cmd - e803f26580d74ea6fd3af797acd511e1349f37bd3d7b2f1d5b4a16a483e27266
C:\Windows\cypreg.dll - 293d51b813fc45f6fdfbd9713e74c87174348fca0c9c3bf78e4dc9e55805e3c4
C:\Windows\OUD4K1V\system.exe - fd493306d2471285ea74b5aecc803438f67230361352c68a9c085d5441af8e5a
C:\Windows\System32\systear.dll - 8cd38cbbc8850a45eae0ebfbd17a4ff6696ba344222e0abb47f4fb31da31a5e1

Embedded URLs

http://www.google.com/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.vaksin.com
www.google.com
hackersmail.com
hotmail.com
gmail.com
msn.com
yahoo.com.sg
yosef.netfast.org
friendster.netfast.org
untk.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.14
52.123.252.223
4.149.227.78
4.230.171.124
20.165.94.54
20.42.179.192
74.178.76.128
4.150.223.98
20.184.175.5
40.79.150.120
4.209.250.170
4.150.223.101
34.104.35.123
135.233.45.222
4.150.223.110
203.26.79.13
52.148.114.188
72.145.35.105
52.110.12.2
52.110.12.56

File paths

C:\Program

More Lightmoon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report