MALICIOUS — 026c7e88ae764f4da049cd414ad0b5fc8affbd8e7a66a8e12671f0133b6f1797

MALICIOUS — 026c7e88ae764f4da049cd414ad0b5fc8affbd8e7a66a8e12671f0133b6f1797 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Midie family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 026c7e88ae764f4da049cd414ad0b5fc8affbd8e7a66a8e12671f0133b6f1797
SHA-1: a40b99e12ca8c6c5a691665a7243173fd999836a
MD5: 0cf231796e50e771c7830254de4867c0
imphash: b76d57c189eaeceb60fad8d88615dced
ssdeep: 98304:FLo8wNAOMVdM2dTaZBBDgr8ICX0+e8/Jmv1IndWYn:FLOAVrJaZBOCX5/cCh
TLSH: T12A6133CDC1345886FDED76F41C20DD3E0962A53029EF8199D7CAC4A8C9DACB7553A2A0
Submitted as: 026c7e88ae764f4da049cd414ad0b5fc8affbd8e7a66a8e12671f0133b6f1797
File type: pe · Size: 4026368 bytes
Verdict: malicious (99/100) · Family: Midie

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Midie-6983992-1
Microsoft Defender: Backdoor:Win32/Multiverze!rfn
Emsisoft (Emergency Kit): Gen:Variant.Barys.231780
Kaspersky (KVRT): UDS:Trojan.Win32.DiskWriter.haq

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Midie-6983992-1 (rule Win.Malware.Midie-6983992-1) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Multiverze!rfn (rule Backdoor:Win32/Multiverze!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.231780 (rule Gen:Variant.Barys.231780) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.DiskWriter.haq (rule UDS:Trojan.Win32.DiskWriter.haq) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 13 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9215 behavior events · 2 ATT&CK techniques · 14 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\48F.tmp\crazysound5.exe - 51731761183e705672137e33aaf26dcac3c220f871572594ed3df7ce4633a3ef
C:\Users\analyst\AppData\Local\Temp\48F.tmp\ClutterScreen.exe - 0d16632761b6958615f81084354e2c59873fa566ba2addf5d36c337db9d63c2f
C:\Users\analyst\AppData\Local\Temp\48F.tmp\Bytebeat1.exe - 1d05fc8fb21f2f332da47327f0c866363e676bb55a6552065fa7664f2c0a8437
C:\Users\analyst\AppData\Local\Temp\48F.tmp\IconHell.exe - 1270fa37075e325034ded30d4f59c1855106103c04f1887ca456dde373453da6
C:\Users\analyst\AppData\Local\Temp\48F.tmp\zoomlines.exe - d1c2d94cd2333554b17b0719723067c0f82618b63fcd70487b78baffdbabd975
C:\Users\analyst\AppData\Local\Temp\48F.tmp\Bytebeat3.exe - a0ce7894de4f8e2ab910a7af0f7443c7ded8b6c123274b11a2a2a75247e800ad
C:\Users\analyst\AppData\Local\Temp\48F.tmp\Bytebeat4.exe - ee1f53620f908d103ef1144a3b4c8d35b6c3f48f930a9177e1f0d6667039cd65
C:\Users\analyst\AppData\Local\Temp\48F.tmp\ScreenShuffle.exe - 047811debbddfbcd2ce0db3ca6e36dc875677dcc938293aa3c3886ff2a70bafe
C:\Users\analyst\AppData\Local\Temp\48F.tmp\ColorA.exe - 781f67d14a5ee5cf6508874dc47e4ec6c60b895c9893112272aec44ccdcafc51
C:\Users\analyst\AppData\Local\Temp\48F.tmp\Bytebeat2.exe - ab66acbabbb27a8d894a19f9b6e89bdaaabbca2afc76907f818781af9ca57652
C:\Users\analyst\AppData\Local\Temp\48F.tmp\GlitchB.exe - 8b3b3b3b2ccf787a7ca4672e717134d3bdf52e7c43d29737db2bf8b1e820c0d1
C:\Users\analyst\AppData\Local\Temp\48F.tmp\crazysound5.wav - adad6cd1a197a7412b296c1ccae6a74614264acf57f4597e01ed0ad57b8c573b
C:\Users\analyst\AppData\Local\Temp\48F.tmp\TrashMBR.exe - aaf6029ff69d4eddf3442855dffa507f52cfbb73d5b22d9b06cac0915e41fc9c
C:\Users\analyst\AppData\Local\Temp\48F.tmp\490.tmp\4A0.vbs - aa5aef7a4d90f3e2e049e29d2d8f82a4c1480e0ae9c5d2e017522238721b2324

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

oq.tv
skb.no
9r.mx

Embedded IP addresses

4.150.223.101
20.247.185.124
4.230.171.124
135.233.45.221
57.154.63.210
57.155.104.224
184.84.165.136
4.150.223.114
72.153.5.133
52.148.114.188
52.110.12.50

File paths

r:\%-:.Q}

More Midie samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report