MALICIOUS — PerfLogs .exe

MALICIOUS — PerfLogs .exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 12c15af89f892c0c5906a6d49cf11da3cd541d95eb1597bf07c97a5a3c66063f
SHA-1: ab22f9a67619e18ae7c013a3f251175b78ee386b
MD5: 649160fcdaa96018453cff8ea772d746
imphash: 3a2003ea545fe942681da9e7683ebb58
ssdeep: 12288:CxIK9V14ImyHYKh+yLBTpWbxThDY6OZkk:CJEyY9yLBTpAh86OZkk
TLSH: T10849AF893CB9520BD3716FA0BA1ADDFD4B132512B1390A8D661828C1D5E8F433D6D72A
Submitted as: PerfLogs .exe
File type: pe · Size: 420288 bytes
Verdict: malicious (99/100) · Family: Mira

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
ClamAV (daily): Win.Packed.Mira-7330891-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Krap!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Packed.Mira-7330891-0 (rule Win.Packed.Mira-7330891-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (Persistence): scoobe-fix.cmd - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.lol 1, MinGW - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

5634 behavior events · 1 ATT&CK techniques · 34 dropped files.

Dropped files

C:\$Recycle.Bin .exe - 6aee055d4a5e62f6d9f1644d1c9b6c33a1539fad34a34769661a479e973b5cf6
C:\792.ini - df0a275a61523804dee8b8e2bca74773ece8fc19598dea19eb2b9da2c0ea7765
C:\uac-done.txt .exe - e7380e513ab8ea9d190a5706afc77eaf9856b2ff1740f74b5a6ffa0bdb15aec3
C:\ThreatLens .exe - 3cc404322079f8486117fd969f1ac0328d3e3936f72cbff84cd0ea3fcbd23199
C:\Config.Msi .exe - 12fbcb82f6428f2366997e9c3aeb31c1bacdc88c6ee6a73ea59da149302f43f4
C:\PerfLogs .exe - 7718e45466ca3ccc935e9b0d7c3f9655efa380d46f5f61f12381d9be8949963d
2956a56670903553783dd19526d2c80a3bc3149ec2b793704f6cbe81db4c98d8 - 2956a56670903553783dd19526d2c80a3bc3149ec2b793704f6cbe81db4c98d8
C:\ProgramData\lrbirh.exe - af68df00226d618d881ab0de1fc3a72e546903f5342181cdd1bc86e4683b82a2
C:\uac-done.txt - ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a
C:\scoobe-fix.cmd .exe - 51a0aeeab7784b69a054b504b492576e1331ffd2375bbe6da826f848218a4fdc
C:\PPLFaultTemp .exe - 579166ccb45a42b21d4c7cd469d68f61a6e4b633f4ffc84b00be6b2bd4d1e22e
C:\uac.ps1 .exe - 1137e1a1ed2e7c5442a5ad9d0bfc6e82a265d75a38e6dd6e1eb59d2cd6cd5e60
C:\Documents and Settings .exe - ce2767df1142a895e407453a414a62a0f67c95b2af3117e78d8bd654784ceb6b
C:\swapfile.sys .exe - b3944b82ecbea3b86744eaebe1224e3629d258f2c50852c4c44ca004c6a98248
C:\uac.ps1 - a42e57db93b93ecb2224fdb1276f4ebb0b6705cc4a95ec1899772df8dc47a684

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787725448&P2=404&P3=2&P4=eCH8GN7C5OkAFToI%2b0i237XVWPtztK6Fdf8x2XttuWOzOcufGWX1Sgcdjww5Obbc9YyspGvohhMMBHlnwJ3LPQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787725531&P2=404&P3=2&P4=mVghHy6oL7PCAP8oRXUbioyUyWYSHnOV0Zsp5fBKjRuIDrswlj7ExuYUKr%2fhWguQsn5gH5135ieVDdlKVFFIqw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.19
57.155.101.212
52.253.84.76
4.230.171.124
74.178.76.128
20.165.94.54
13.89.179.15
20.231.239.246
52.123.128.14
40.99.134.2
203.26.79.13
135.234.160.245
4.247.188.224
52.123.252.226
74.179.71.159
52.148.114.188
72.153.5.96
52.110.12.11
52.110.12.46
20.165.94.46
52.110.12.1
52.110.12.14

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report