MALICIOUS — c261d38419991cfdbd46ef65acfa3668340b9cfa31e82d2137c3d355a0d5a50b

MALICIOUS — c261d38419991cfdbd46ef65acfa3668340b9cfa31e82d2137c3d355a0d5a50b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the DangerousObject family. 6 of 56 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: c261d38419991cfdbd46ef65acfa3668340b9cfa31e82d2137c3d355a0d5a50b
SHA-1: fe0930a686b64d60ec4b82f010638f129a5a9ff6
MD5: 73537eb5e8f195fd7c4802b0b6a6109f
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 384:XFKIVg2qDVRwNYbOtQD3hZjnmBLxZSlmqbUqnxaUVAUfWQ1W:X+2qDs2bMQDfjnOLnSD2Uf
TLSH: T19729E8CF12281712CAE7C9362954D6BF90D2B0D98FB1250C0A09593325E593BED377BA
Submitted as: c261d38419991cfdbd46ef65acfa3668340b9cfa31e82d2137c3d355a0d5a50b
File type: pe · Size: 18944 bytes
Verdict: malicious (100/100) · Family: DangerousObject

Detections (6 of 56 engines)

YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
capa (capabilities): capability:execution/powershell
ClamAV (daily): Win.Malware.Razy-9636401-0
Microsoft Defender: PWS:MSIL/Dcstl.GG!MTB
Emsisoft (Emergency Kit): Gen:Variant.Bulz.730266
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

MITRE ATT&CK

YARA

Suspicious_PowerShell_Download_Exec
Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 19 weighted signals:

ClamAV (daily) flagged Win.Malware.Razy-9636401-0 (rule Win.Malware.Razy-9636401-0) - engine signal, weight 0.90, confidence 0.95
Encoded/hidden PowerShell download-and-exec (rule Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90
4 behavioral detection(s) across 4 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.69, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged PWS:MSIL/Dcstl.GG!MTB (rule PWS:MSIL/Dcstl.GG!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Bulz.730266 (rule Gen:Variant.Bulz.730266) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:DangerousObject.Multi.Generic (rule UDS:DangerousObject.Multi.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1497.001, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Suspicious_PowerShell_Download_Exec (rule Suspicious_PowerShell_Download_Exec) - engine signal, weight 0.35, confidence 0.70
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: https://discord.com/api/webhooks/890305476942786600/b1ZHiTRv0S-p9KkH2iGQEedwsbKp6MvmfgUjOe4h_T3_it25TadhDmxxZpZ0dHTsAxf8 - static signal, weight 0.35, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

50314 behavior events · 3 ATT&CK techniques · 5 dropped files.

Dropped files

C:\temp\TCDC053.tmp\discord.exe - 207c9510b9a62cfd17f8b8b0f96a18a75db27da8f92fec516fd7670aa87b22a4
C:\Users\analyst\AppData\Roaming\Discord.bat - a69e3afe026342f3a125768f6050b736fc07b69b8ab2c583867ccaf5c15dd1b7
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - da93573628ec931df0dba1705552f27dfbfae28f352bd50731217d9fbf1c89cf
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_wji4a5ku.dwa.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
39d73dfb81f231f51bd4aec1f157cd3c8b56988532d9e3fa03f7bbf6acdccea6 - 39d73dfb81f231f51bd4aec1f157cd3c8b56988532d9e3fa03f7bbf6acdccea6

Embedded URLs

https://discord.com/api/webhooks/890305476942786600/b1ZHiTRv0S-p9KkH2iGQEedwsbKp6MvmfgUjOe4h_T3_it25TadhDmxxZpZ0dHTsAxf8
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.google.com
www.yahoo.com
www.youtube.com
discord.com
store2.gofile.io
store-eu-par-8.gofile.io

Embedded IP addresses

4.150.223.100
20.42.179.192
20.247.185.124
52.123.252.219
4.230.171.124
4.247.188.233
172.64.154.167
74.178.240.51
20.165.94.63
52.182.143.212
74.178.240.61
135.234.160.246
92.223.78.30
135.233.45.221
183.177.68.210
45.112.123.239
20.42.65.84
51.105.71.137
72.145.35.101
52.148.114.188
52.110.12.51
52.110.12.18

File paths

C:\temp\TCDC053.tmp
C:\temp\TCDC053.tmp\discord.exe
C:\temp\TCDC053.tmp\Discord.exe

More DangerousObject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report