MALICIOUS — 0b884296132ee7bb3bc96b500efc5cfd689046297c5c49aeb01770526f080086

MALICIOUS — 0b884296132ee7bb3bc96b500efc5cfd689046297c5c49aeb01770526f080086 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 0b884296132ee7bb3bc96b500efc5cfd689046297c5c49aeb01770526f080086
SHA-1: 0bfc39bc73cc0cd8ecc6fe9c8c08c39f3bd46592
MD5: 3fb39246113a7fc08063b21af839e90f
imphash: 4e7f4e9f034d0a9a0d18c7188d0c2390
ssdeep: 384:QLcTQvmFzKbE+QwuC6WREiHQqYBkUn/8yIYNMcSF:QqQmFL+QMC9B1QYdG
TLSH: T19D2ABBCD40B81B67C33A14E91B33D95FA19BF0E509AD31190D9DA03D90C28E3AE56E76
Submitted as: 0b884296132ee7bb3bc96b500efc5cfd689046297c5c49aeb01770526f080086
File type: pe · Size: 20788 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Downloader.Upatre-9854858-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Astaroth.psyW!MTB
Emsisoft (Emergency Kit): Trojan.Ppatre.Gen.1
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Convagent.pef

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Downloader.Upatre-9854858-0 (rule Win.Downloader.Upatre-9854858-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Astaroth.psyW!MTB (rule Trojan:Win32/Astaroth.psyW!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Ppatre.Gen.1 (rule Trojan.Ppatre.Gen.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Win32.Convagent.pef (rule HEUR:Trojan-Downloader.Win32.Convagent.pef) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Linker (rule Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10481 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\fcbnaf.exe - 3e6cd5f17141a296004b4c867cc83a4e213d9027048ca2eec755f08bd453ae31
d330636002f093bb537a02ec259509331eba67bce111a5eeb26ee1492d976fcf - d330636002f093bb537a02ec259509331eba67bce111a5eeb26ee1492d976fcf
532fb441935a63d31eb7008f2bbe0dcee8946332fd85f95d23e335aa3cc90c47 - 532fb441935a63d31eb7008f2bbe0dcee8946332fd85f95d23e335aa3cc90c47
5a291253b241b164b7256ccc058eb5a9eada9f284511a64c827253240104ff96 - 5a291253b241b164b7256ccc058eb5a9eada9f284511a64c827253240104ff96
7962dacdd03da6bf4628ded2e8080484325c9df09f048217e6e3cdf3dc6acf14 - 7962dacdd03da6bf4628ded2e8080484325c9df09f048217e6e3cdf3dc6acf14

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

huyontop.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.69.116.109
20.42.179.192
20.247.185.124
52.123.252.242
4.230.171.124
48.211.4.16
74.179.77.204
74.178.76.54
4.207.44.71
74.178.76.128
52.168.117.170
104.18.33.89
92.223.78.30
72.153.5.128
52.110.12.4
52.148.114.188
52.110.12.54

File paths

C:\xJg4Znp3.exe
C:\9180338b1d36bfff41d5f1a570d7632885796f79156da09d829f3f05b9c37cbf
C:\a33372c7519a1181e119a9c71a2772c2ab503ae5db3047247b604d2aa579c930
C:\d0fd253b90c84be3e80052dd52c714a8f592da9ab82a7b0549e17e86a758c3c9
C:\Users\Administrator\AppData\Local\Temp\cuckoo-1271f53c784a276a4561d2d748c88258acf195aa6ae6b36659cb97bd168d376f.exe
C:\743dc8257e28b6f6400b761e1a56a20c581d7145eefb19db79426f3e691c3b4e
C:\e1ca529908ccfb34f9fec97fcd2b77d4c0bc61e332d3e47e6d1315a45f4bf532
C:\9ee54b2b4c028db2451409a079c57ac4ae1daba027ae41cd8cc755a6dfe81017
C:\19bc00d54194009107c9f85f0442ad80375353c21daee23460e2af02828b6050
C:\r62CNF0G.exe
C:\ed525b5b5dba507c985f079062891afbb70de771aed5468a34bde1a305d8e4d9
C:\e462911cf00346d1f93b6f3ff4ea72087781b863cac407702d598476c4ee2651
c:\ffba4dada3418f3d9333451182008350.exe
C:\Documents
C:\5af2c3cf89fb4b0dfcc625f327b5d5e582758c7261dd6366a7f31b0eed888f95
C:\S1yHHKqb.exe
C:\fe0e78a8cdd370bbeef1e3f2be18085d61f4a4ac74584dea33b35783c85c5f5e
C:\b792f00d19a96e3121b6990e0029dacf678452d3d3aaa41a0c0ff8bb75e93d26
C:\1bc72a38da2276cd2bc0d7144adfeb915613d2caf4b1cc3bea2594d1ad3917f4
C:\4c266973a39f5444c0414feb69ace99a1c20c5a6a72e69981473d12f24627500
C:\317b7045afdb911e705d25954f715f9a0c6f4274146c8a96b3844650ad2f2228
C:\fce329e08f5f67901fc6721ae63daed88fd91832817752e0c014caa67080e6c6
C:\8f9297eb0c0484ae43cf7f0c57a778bcd0273683e8c7a7463db95222cee358ed
C:\9adfeb258717f37424eaa36df14c3d397a7fd80799dfe8956888f06e45fffd8b
C:\90d2d5d4dfb2eda1844248e6a29b343fdd470d5714680aa4c4426f3dd7398446

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report