MALICIOUS — 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a

MALICIOUS — 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Viking family. 6 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
SHA-1: 9371e9977568ca5cca6d396e0b4d91915d0937a8
MD5: c53c4461954f446f8d1ca18ff884cd57
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2fbum/ytSL+GjvVKkF3fS:BtfDwsjPThT5zL2Dum/y8DVz
TLSH: T1683BAE665A671392F3B7DA616800AB8D8072F87A31B1408D7363D47F63F9C3398B1258
Submitted as: 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
File type: pe · Size: 107944 bytes
Verdict: malicious (99/100) · Family: Viking

Detections (6 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Kaspersky (KVRT): Virus.Win32.Lamer.xe
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

Dropped a malicious payload (Emotet): 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 33 external host(s) at runtime (11 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://repository.certum.pl/ctnca2.cer09, http://www.certum.pl/CPS0, http://repository.certum.pl/ccsca2021.cer0 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

57118 behavior events · 2 ATT&CK techniques · 62 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9170/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9170/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9170/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9170/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9170/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9170/files/af2eacdc5171455ac8df56f669fdede4c190d29b3ba4439ec541beda490d28eb - af2eacdc5171455ac8df56f669fdede4c190d29b3ba4439ec541beda490d28eb
/opt/CAPEv2/storage/analyses/9170/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9170/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9170/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9170/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9170/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73
/opt/CAPEv2/storage/analyses/9170/files/713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210 - 713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210
/opt/CAPEv2/storage/analyses/9170/files/c210222aa6920708541ef37fe530810d36d81cfafdf020275cccc0aad9398a35 - c210222aa6920708541ef37fe530810d36d81cfafdf020275cccc0aad9398a35
/opt/CAPEv2/storage/analyses/9170/files/f5b34ea3e3f9beda1a6e253d504e0ba219a7be188dbe9e5294dc06e8f566ef72 - f5b34ea3e3f9beda1a6e253d504e0ba219a7be188dbe9e5294dc06e8f566ef72
/opt/CAPEv2/storage/analyses/9170/files/897dd89490f168caeac5385c487d6c9b16966d5aa88716b2be35335291ea5253 - 897dd89490f168caeac5385c487d6c9b16966d5aa88716b2be35335291ea5253

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl.certum.pl/ctnca2.crl0l
http://repository.certum.pl/ctnca2.cer09
http://www.certum.pl/CPS0
http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
http://repository.certum.pl/ccsca2021.cer0
https://www.certum.pl/CPS0
http://subca.repository.certum.pl/ctsca2021.cer0
http://subca.crl.certum.pl/ctsca2021.crl0
http://crl.certum.pl/ctnca.crl0k
http://repository.certum.pl/ctnca.cer09
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786395452&P2=404&P3=2&P4=nzSQS%2fK6rN%2fIxlDI%2f2mpH%2fvq1eIlW5tzEek6XuRJnLYa4ftI08zEy9nmzFiCUvcUvOfMELx6O8ZXCKmO04pJiQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
crl.certum.pl
repository.certum.pl
www.certum.pl
ccsca2021.crl.certum.pl
subca.repository.certum.pl
subca.crl.certum.pl

Embedded IP addresses

192.168.0.30
192.168.8.1
26.2.5.2
52.168.112.67
52.253.84.76
52.123.252.241
20.42.179.192
4.247.188.233
4.230.171.124
57.155.101.212
135.232.92.137
20.165.94.54
20.42.73.24
4.150.223.104
135.234.160.246
135.233.45.221
203.26.79.13
184.84.165.136
184.84.165.171
13.89.179.15
135.232.92.34
52.148.114.188
72.145.35.103
52.110.12.50
52.110.12.28

File paths

E:\build\workdir\LinkTarget\Executable\spsupp_helper.pdb

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report