MALICIOUS — 1da076f32a18931442e003aebb04b7d5b69e1b21ea3d52be1949449eb3d304df

MALICIOUS — 1da076f32a18931442e003aebb04b7d5b69e1b21ea3d52be1949449eb3d304df is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Razy family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 1da076f32a18931442e003aebb04b7d5b69e1b21ea3d52be1949449eb3d304df
SHA-1: 8d12885b24f1082dbf79ef7ecce3df933c29c39f
MD5: cbdd2222f499ed620a7dd74afcb32f10
imphash: 8c235e3a9d7f61224225c532f7c9583a
ssdeep: 3072:y9mWooSsgseO6ZBjm/w5SKKhXQI36Ow6sujyhw7F9XboLYls4pLthEjQT65:5GuTZBk7KoEOfXoLYlskEjP
TLSH: T113428CF8853C7C49CE39D9182E42A84ED05155BA26BC7F2897ABE63500E356F743432B
Submitted as: 1da076f32a18931442e003aebb04b7d5b69e1b21ea3d52be1949449eb3d304df
File type: pe · Size: 213486 bytes
Verdict: malicious (100/100) · Family: Razy

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Malware.Razy-9759519-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Aenjaris.AL!bit
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Babuk.69
Kaspersky (KVRT): Trojan.Win32.Nobady.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9759519-0 (rule Win.Malware.Razy-9759519-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Aenjaris.AL!bit (rule Trojan:Win32/Aenjaris.AL!bit) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Babuk.69 (rule Gen:Variant.Ransom.Babuk.69) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Nobady.gen (rule Trojan.Win32.Nobady.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

46093 behavior events · 2 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\System\KLY.exe - 4c4d73f79e2d96ddf96c27c282a084f3a236c8d2a94fb40a9ad9faf3b5099225
C:\Windows\System\KVOJPF.exe - 6e546adbeda1b724b5fe619dc5662901427b217817e971e1b0d6fa288dceab53
C:\Windows\System\KTV.exe - ce1d8f2c97e0e2770c9badc9842b61ccb052a307d0499bf29806b8a3a753afd4
C:\Windows\JSND.exe - 3ce569d66c36dc8ed0543492708d4116630e92ca238e452a8468e49a17fa1262
C:\Windows\BEBXDMR.exe - aa23ae437088bb63dd68169f85d033321a9bf336a4edcb33362d55dedec9788f
C:\Windows\System\ICGYSRY.exe - da3c0df8ef1a128519db663654d21a2ed6a1e998e1a148d6d5e89f5c45c2a5d2
C:\Windows\YAZZL.exe - 5192f3a3443459f8b58f7e7a2033c81467bb258e75052bf18b8b77c33639a5ab
C:\Windows\System32\FWF.exe - b8bf49b9cd3a0d5d11ed35b0d13b8238d7c1823cec176d949cd5fe529b1e5549
C:\Windows\System32\YCGL.exe - d36e7adc69939c69bc5e095e09e572ff48e84245d3d1098ad429fd729ef96757
C:\Windows\System\EAMLCW.exe - be3dcc91b7700aee309c485c18fe3d181c945106b466da4bf51e91b6fc93cbec

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.107
52.123.252.235
4.230.171.124
40.84.85.40
4.247.188.224
74.179.77.164
135.233.95.144
20.247.184.197
52.168.117.170
74.178.240.61
135.233.45.222
135.234.160.244
52.110.12.42
52.110.12.40
135.233.45.221
172.215.188.232
172.178.240.162
135.234.160.246
172.178.240.161
52.148.114.188
172.178.240.163
135.233.45.223
72.145.35.108
52.110.12.51
52.110.12.56

File paths

f:\rtm\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
C:\windows\%s
C:\windows\system32\%s
C:\windows\system\%s
c:\stop-adw.txt

More Razy samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report