SUSPICIOUS — 02ecbd74186f3c7b8c6d70b076e98cb4ae0580953a6a15c693617d4c85b486d6

SUSPICIOUS — 02ecbd74186f3c7b8c6d70b076e98cb4ae0580953a6a15c693617d4c85b486d6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (67/100), attributed to the DangerousObject family. 3 of 55 detection engines flagged it.

Identification

SHA-256: 02ecbd74186f3c7b8c6d70b076e98cb4ae0580953a6a15c693617d4c85b486d6
SHA-1: 8d96456a4cd528a805d3e86dea6959db7e581ed8
MD5: c114420de6676c9d164c657e1768aba4
imphash: 863d6a2d2e42cd3c71cc03396183dda6
ssdeep: 1536:lLjZ9O5ypCXVqdObOaqroV/3LIjl8TF0:lX+FXVXOaBdLI5CF
TLSH: T12C353B6BEA19B77FFC9647DE4289461F214631ABA37218661F83C0288D34B8FF425075
Submitted as: 02ecbd74186f3c7b8c6d70b076e98cb4ae0580953a6a15c693617d4c85b486d6
File type: pe · Size: 61440 bytes
Verdict: suspicious (67/100) · Family: DangerousObject

Detections (3 of 55 engines)

Emsisoft (Emergency Kit): Gen:Variant.Mikey.118638
Trellix Stinger (McAfee): Trojan-FFBU!C114420DE667
Kaspersky (KVRT): UDS:DangerousObject.Multi.Generic

Why this verdict

The suspicious score of 67/100 is the fusion of 2 weighted signals:

Memory forensics: 3 finding(s), e.g. RWX/private injected region in regsvr32.exe (pid 5636) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 31 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

93 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

4b3eb7ba8f3b5c4b5efe702ff81a92c7c01d79219316401a30e28143e9badd65 - 4b3eb7ba8f3b5c4b5efe702ff81a92c7c01d79219316401a30e28143e9badd65

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787812276&P2=404&P3=2&P4=WdXv9m0dhrDnL%2b3SwI5UqCyk7gL%2f0pNWLp3WtrsOWN2Ncfp4p5JOelCVKB7sSx5xhA6HwH8%2bPc4cVpBprmVeNA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787812311&P2=404&P3=2&P4=lKiU5sCvVSGKH6L0OfcdYHqFTdCp3hh0%2bnIenaA%2b1heHdvDTodrlF8QA6mSzYP9sGMQD43BdO6SfzaRK9UPpzg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787208935&P2=404&P3=2&P4=Susle3I0ddgTgalVerSqW7xIQWGG%2f3eU6ooaGDsnzcPsFYJnVemsapP0UsWJLFso7ygRV1cuJgjXuT9U%2b5Giyw%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787208612&P2=404&P3=2&P4=E9o4PZKYwfLFvvEf838q6LSlt5yoxy6ZSvSRy4jqyfMQGzzswXvLu02fxA6C4D%2f%2bXToOTdSYgeSIhnvIFjQ6ug%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

1w.ml

Embedded IP addresses

40.79.141.153
52.123.252.197
57.155.101.212
20.247.184.142
4.230.171.124
172.215.188.232
74.178.76.128
4.150.223.104
74.178.240.51
20.231.239.246
52.123.128.14
52.123.129.14
20.184.175.23
172.178.240.162
92.223.78.30
20.89.1.9
20.184.175.9
20.165.94.46
203.26.79.13
52.110.12.53
52.110.12.8
52.148.114.188
125.56.205.32
125.56.205.51
40.79.197.34

More DangerousObject samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report