MALICIOUS — 1042ad393e6e79f17b0d04d7ef1cc92b70d3bb6b6c0a4382d0fcc4224661a90e

MALICIOUS — 1042ad393e6e79f17b0d04d7ef1cc92b70d3bb6b6c0a4382d0fcc4224661a90e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1042ad393e6e79f17b0d04d7ef1cc92b70d3bb6b6c0a4382d0fcc4224661a90e
SHA-1: e5a81ea8f0dea278802f08faf704b7a29e71bb5f
MD5: 3a36a050847175de820f8b1bf2ad4ed2
imphash: 1e6a4fffacfedb07cb59a03d8271add1
ssdeep: 768:CBM7zh0vnsEnBJNVVutayVpSQKjdbyo/SkL6fYYhXJwYMIifzEhELbYG:CBMnqv7nFVDyxo/SkL6fxWFd0EfY
TLSH: T1D240FC89C99DE4DAC2E8C645F9C02CFD75ADECC0CE11CB6B2496B94749A203768350ED
Submitted as: 1042ad393e6e79f17b0d04d7ef1cc92b70d3bb6b6c0a4382d0fcc4224661a90e
File type: pe · Size: 172032 bytes
Verdict: malicious (100/100) · Family: Changeup

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Worm:Win32/Vobfus.gen!D
Emsisoft (Emergency Kit): Gen:Variant.Ser.Ursu.13494
Trellix Stinger (McAfee): Downloader-CJX.gen.l
Kaspersky (KVRT): Worm.Win32.WBNA.ipa

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.gen!D (rule Worm:Win32/Vobfus.gen!D) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ser.Ursu.13494 (rule Gen:Variant.Ser.Ursu.13494) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Downloader-CJX.gen.l (rule Downloader-CJX.gen.l) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.WBNA.ipa (rule Worm.Win32.WBNA.ipa) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

49278 behavior events · 2 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\vaoaka.exe - 33649f51d4c9b016d83b04119cf284cfa0cb2e07afd78fbd927e9890242c8329
12f8d3cf4afcffbcbb0eb6092c7bb82c41b7fe93f369d3c4f1a96400f05c0d79 - 12f8d3cf4afcffbcbb0eb6092c7bb82c41b7fe93f369d3c4f1a96400f05c0d79
ba11f770560100e901e333ae74ac8377ab88e07efa6418a09c28394fa56a1518 - ba11f770560100e901e333ae74ac8377ab88e07efa6418a09c28394fa56a1518
630f6ce265a6a72b20b3d52a96d4b0f1c44fc33eb471fbd2c568f456f881c551 - 630f6ce265a6a72b20b3d52a96d4b0f1c44fc33eb471fbd2c568f456f881c551
cf1185e7985251f781a242acbe6a754483fd79c965406c64a9d13001f66f0f44 - cf1185e7985251f781a242acbe6a754483fd79c965406c64a9d13001f66f0f44
333dd7003b0515ce08619949835ee7a973235a0083862c1b5224cdf44f50680f - 333dd7003b0515ce08619949835ee7a973235a0083862c1b5224cdf44f50680f
08ad63a25cebcb803604dbd87c85162016cf394319ecd4cc8b02059bffb59499 - 08ad63a25cebcb803604dbd87c85162016cf394319ecd4cc8b02059bffb59499

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788131172&P2=404&P3=2&P4=cInfsPkDlwgZ5MNx%2fSzXxNxcwTldMLGYoxrTqZ4u61asL61OJAOmBVmbNhZkejkasBktCcGYuvS9k0rVb9R6kw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns1.player1253.com
ns1.videoall.net
ns1.mediashares.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.102
52.123.252.193
4.230.171.124
20.247.185.124
20.42.179.192
135.232.92.137
74.178.240.51
4.150.223.105
104.18.33.89
20.184.175.16
135.232.92.34
203.26.79.13
52.110.12.31
52.110.12.46
20.42.73.25
72.145.35.107
20.42.179.204
85.210.196.11
52.148.114.188
52.110.12.11
52.110.12.30

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report