MALICIOUS — 0e63759833c73739f279dd67019c910e8034838f9169641b3478a4eef572c1e7

MALICIOUS — 0e63759833c73739f279dd67019c910e8034838f9169641b3478a4eef572c1e7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the C83B492E family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 0e63759833c73739f279dd67019c910e8034838f9169641b3478a4eef572c1e7
SHA-1: a4c0ebd45833b7cc7a8048ece166d94eaf005ea5
MD5: 6d80109958f03471f5f47fc008eb1719
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dDIARlnTRIvRKSoNufl37CFav7T9MO:Qoa1taC0JuJ+nb97CFaqO
TLSH: T11F5A239A5618B70CE2F2C4C83D68266DC841A4A76378158B12CFF01FBFD66677C2119B
Submitted as: 0e63759833c73739f279dd67019c910e8034838f9169641b3478a4eef572c1e7
File type: pe · Size: 1958400 bytes
Verdict: malicious (99/100) · Family: C83B492E

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

151 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\70F5.tmp - 8db10160619501945efc30edd1aea2b452ca5cd358e744ce2385becaaafe0594
4fc363c26bfc6dbe61dd4c45e493acc28cb88bcc3e7d1d010b27113b06eeadf1 - 4fc363c26bfc6dbe61dd4c45e493acc28cb88bcc3e7d1d010b27113b06eeadf1

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.31
52.123.252.245
4.230.171.124
48.211.4.16
135.232.92.97
135.233.95.144
20.247.184.142
104.18.33.89
20.165.94.63
52.110.12.14
40.84.85.40
52.110.12.3
20.184.175.14
4.150.223.111
125.56.205.65
125.56.205.123
72.145.35.96
52.148.114.188
52.110.12.32
52.110.12.51

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report