MALICIOUS — 09180a5ccddeeebb47d9cf5eaa345a61528a50ce7a0e57cb321cce0cf9bdaa67

MALICIOUS — 09180a5ccddeeebb47d9cf5eaa345a61528a50ce7a0e57cb321cce0cf9bdaa67 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Urelas family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 09180a5ccddeeebb47d9cf5eaa345a61528a50ce7a0e57cb321cce0cf9bdaa67
SHA-1: 1ab4e21d727a5455cfe29ba1ad0bf812cd006aae
MD5: 66e5121ec95f5afb7e2d0b2400856728
imphash: 7caeadc02187e8816237dd529d1fe495
ssdeep: 12288:tEr6bkpYN2jF7vQZmSohg+k7j6aDG4FuA6lpgTIJcqBZ5Y2:tcykpY5852j6aJGl5cqBT
TLSH: T18554F159C2F26389E7F353301E048E0DA4E25CDEE07E4C9246C3C26E6AD1D6FE5A4166
Submitted as: 09180a5ccddeeebb47d9cf5eaa345a61528a50ce7a0e57cb321cce0cf9bdaa67
File type: pe · Size: 1200238 bytes
Verdict: malicious (99/100) · Family: Urelas

Detections (6 of 55 engines)

ClamAV (daily): Win.Malware.Urelas-9883246-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Trellix Stinger (McAfee): Corrupt-FY!66E5121EC95F
Kaspersky (KVRT): Backdoor.Win32.Plite.bhti

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Urelas-9883246-0 (rule Win.Malware.Urelas-9883246-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

30088 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\duqin.exe - 5dcb53ed3f97891e1f8613da6f05b1bb632660ced44835ce9a3ee694f25e099e
C:\Users\analyst\AppData\Local\Temp\jexup.exe - 673fbe934ea1b71fc8c5c9f1a060670ee44f162e4664e3665feb358fdf09c87e
C:\Users\analyst\AppData\Local\Temp\gbp.ini - 30f820bb1ca6c20bcd77113c7377e01f31cdf0ec5b64864f22887d41a9bf3c7a
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 8688eb84eed97669cfbca061239681ba57e7263737407becf19722e83d4f545f
bc60e95e1e164e84a26c5569cde8ae92deb684448d027c61d8a1d4b823491bd9 - bc60e95e1e164e84a26c5569cde8ae92deb684448d027c61d8a1d4b823491bd9

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787885463&P2=404&P3=2&P4=Plsv%2fZmYmmC%2fce3uNGuIPr8IT%2fYYaDo3kXmmXOx%2ftRHHNaFx9KoUEj9%2bHUq9OfAhbVFYhVYFaR%2fz90zgjPYvsg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

aefd.nelreports.net

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
52.123.252.244
20.184.175.0
85.210.193.152
4.230.171.124
4.144.132.223
135.233.95.144
4.150.223.115
74.178.240.51
52.123.129.14
20.231.239.246
40.104.4.2
52.123.128.14
4.150.223.104
52.123.252.239
135.233.45.221
203.26.79.13
52.148.114.188
172.178.240.163
52.168.117.171
74.179.71.159
57.155.101.212

File paths

U:\5A
G:\H
v:\FE
c:\work\Update_2005_rep\bin\release\MkRegister.pdb

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report