MALICIOUS — 1148d65b47fe104f844419566028ddb8c846deb83103fffe23ee868508aab7d6

MALICIOUS — 1148d65b47fe104f844419566028ddb8c846deb83103fffe23ee868508aab7d6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upatre family. 3 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 1148d65b47fe104f844419566028ddb8c846deb83103fffe23ee868508aab7d6
SHA-1: b42c9b0f73cf263137ccabdfc022e523d4b7a56c
MD5: 18bd7905cc38d79db645763810ff8595
imphash: 3bd1cf97537104404441a903e61f0f5f
ssdeep: 768:/VhR61d2hyKIDMi5FazjmilAA8/wv3pckZ30:jed2ZFX/8/ws
TLSH: T19331ADCD41BC1B67C33A05E51A32D95FA1DBF0E209ED751A198CA03E90C38A39D52E76
Submitted as: 1148d65b47fe104f844419566028ddb8c846deb83103fffe23ee868508aab7d6
File type: pe · Size: 41724 bytes
Verdict: malicious (99/100) · Family: Upatre

Detections (3 of 56 engines)

ClamAV (daily): Win.Packed.Upatre-7168611-0
Microsoft Defender: Trojan:Win32/Waski.A!MTB
Kaspersky (KVRT): Trojan-Downloader.Win32.Small.fbbs

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Upatre-7168611-0 (rule Win.Packed.Upatre-7168611-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Waski.A!MTB (rule Trojan:Win32/Waski.A!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Small.fbbs (rule Trojan-Downloader.Win32.Small.fbbs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

11698 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\budha.exe - f2475075ab39b7c2af7566adf19d136f847c0b32d9e06221c616619e6a0d83f8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/23.crl
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

merrymilkfoods.com
evaniz.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.116.253.170
4.230.171.124
57.155.101.212
52.230.60.54
20.165.94.54
52.168.117.175
74.179.77.204
4.150.223.106
104.18.33.89
172.66.2.5
172.178.240.163
72.153.5.97
52.148.114.188
2.57.91.91
104.18.20.213
52.110.12.19
52.110.12.24

File paths

C:\Users\admin\Downloads\important_document.exe
C:\Users\admin\Downloads\factura.exe
C:\nFinHGql.exe
C:\afa6f9711bea9dc1890f2f08f8e809a4cb311869e50a77f41f9d1410c7364eeb
C:\d3ddb3391b1c4d5f85259e002f9598bd33ff60504b828d914585641efe031618
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\d2d285363b3d7978182b4b3ece3c0871036e25ef205eeb9395ffa0325263d824
C:\Users\admin\Downloads\sample.exe
C:\Users\Virtual\AppData\Local\Temp\41a4b4ed5863c053d614595122b139c7f280b81bb1781c431a679ceb320fc665.exe
C:\b3d08a9624b6dea6787a7a86b3e265c05030184b52f3f284d9dff97c9290d259
C:\5a8145af4d54af9ae2e89f4c6537967270937be02f6c2617dd6b341b1b9e8267
C:\Documents
C:\55a985716bc3e8825cdd9cafcd265390bea731dbb1b565ae8683ba85e07636b0
C:\3787f0c07af42bb353e323c0a988c4fdb40fd70963dfb39403edad397e26bf65
C:\c90f4c6a0d2586667302bb20a34d375b516865a8398f1acf0670a41bd3b46faf
C:\s6MQ9K3s.exe
C:\74a76a0d9d0c162bd6bc499bcc58e6eee14764a218b120555577973344588130
C:\RZHlmZFL.exe
C:\be59ad804bda9c6f0882b200fabe2fd0e98ac1258cd39b24a4b604fcff5747c2
C:\hMwCXQC5.exe
C:\e1G3VJaR.exe
C:\sVqinDXI.exe
C:\V_bLZieM.exe
C:\296609b73951da3dc28c5b8335d4db172e8e491d9f66a441460abf539da080ca
C:\uM0w34hw.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report