MALICIOUS — 1d241c1a63758f8aa1bffd5e05d9207889ac8ddc3649b5877d791ddd3aae28f4
MALICIOUS — 1d241c1a63758f8aa1bffd5e05d9207889ac8ddc3649b5877d791ddd3aae28f4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Winsecsrv family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.
Identification
- SHA-256:
1d241c1a63758f8aa1bffd5e05d9207889ac8ddc3649b5877d791ddd3aae28f4 - SHA-1:
5bf0fd5266ae77fe9c4b7ee6c91880a53634eb4f - MD5:
4e813b132d754640a8249ab6ec480ee0 - imphash:
d77e0f3736ceba816b55892c3ace67ff - ssdeep:
12288:8+NorltQK4N4y9FPalkcZPxQcuExtqdfPTi:8Yo+TF1cZPxQ1Stqdf7i - TLSH:
T17E49BF556156B702FE789B402D405F0E70B3B2CEB0BD59EC93C7C91F66E3893A222259 - Submitted as: 1d241c1a63758f8aa1bffd5e05d9207889ac8ddc3649b5877d791ddd3aae28f4
- File type: pe · Size: 414456 bytes
- Verdict: malicious (100/100) · Family: Winsecsrv
Detections (6 of 56 engines)
- ClamAV (daily): Win.Dropper.Cerber-7134183-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win32/Winexert.C!bit
- Emsisoft (Emergency Kit): Gen:Variant.Winsecsrv.1
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 15 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Cerber-7134183-0 (rule
Win.Dropper.Cerber-7134183-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Winexert.C!bit (rule
Trojan:Win32/Winexert.C!bit) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Winsecsrv.1 (rule
Gen:Variant.Winsecsrv.1) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule
HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - query domain / anti-analysis (rule
query domain / anti-analysis) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: http://www.wxrobot.cc:8082/cgi_ce, http://sf.symcb.com/sf.crl0f, https://d.symcb.com/rpa0 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule
windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
843 behavior events · 2 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
Dropped files
- C:\Users\Public\Documents\XMUpdate\conf.db -
2141584764b6adf5423131615e784e5bc8c4a690c3fe1c7a8e3e45457ba80f9f
Embedded URLs
- http://www.wxrobot.cc:8082/cgi_ce
- http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
- http://ts-crl.ws.symantec.com/tss-ca-g2.crl0
- https://www.verisign.com/rpa
- http://sf.symcb.com/sf.crl0f
- https://d.symcb.com/rpa0
- http://sf.symcb.com/sf.crt0
- https://www.verisign.com/cps0*
- https://www.verisign.com/rpa0
- http://logo.verisign.com/vslogo.gif04
- http://crl.verisign.com/pca3-g5.crl04
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- www.wxrobot.cc
- thread.cc
- udpiocp.cc
- ts-aia.ws.symantec.com
- ts-crl.ws.symantec.com
- www.verisign.com
- sf.symcb.com
- d.symcb.com
- logo.verisign.com
- crl.verisign.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 13.69.116.109
- 4.247.188.224
- 4.230.171.124
- 20.247.184.197
- 135.232.92.97
- 20.165.94.63
- 92.223.78.30
- 4.150.223.108
- 104.18.33.89
- 162.159.142.9
- 52.110.12.37
- 52.110.12.40
- 125.56.205.65
- 125.56.205.26
- 72.153.5.128
- 52.148.114.188
- 52.110.12.31
- 52.110.12.22
File paths
- E:\build\SmartEngine\Bin\Win32\Release\EXEngine.pdb
- T:\:d:l:t:
- T:\:d:l:0;4;8;
- C:\\Windows\\Temp\\tmp00007b24\\tmp00000e95
- C:\\Windows\\Temp\\tmp00007b24\\tmp00000e93
More Winsecsrv samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report