MALICIOUS — 13a143aaa8c2af179a09b06e5243a5cfb678dcc8986626c34c8235d4397f4bcc
MALICIOUS — 13a143aaa8c2af179a09b06e5243a5cfb678dcc8986626c34c8235d4397f4bcc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Unruy family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
13a143aaa8c2af179a09b06e5243a5cfb678dcc8986626c34c8235d4397f4bcc - SHA-1:
02a0783508ab19ea4af5c047b962e0ab70224f97 - MD5:
5758b218a95d1ad291094dabddf42d04 - imphash:
53b338a5a343440770be2403e59415fb - ssdeep:
6144:1mSUslh44d5nngQFZJ6mKH4fx0I2jIT46uLKMVS12ZvPw1y9mKKwkdIfTDm6GUjR:1mLsla4bgLJI0fLKMNw+2We8z - TLSH:
T18F4AB026062ABE74D72F3F215825FB0FB653D93FA0FC142552918B2E761914FE2C4229 - Submitted as: 13a143aaa8c2af179a09b06e5243a5cfb678dcc8986626c34c8235d4397f4bcc
- File type: pe · Size: 443986 bytes
- Verdict: malicious (97/100) · Family: Unruy
Detections (5 of 55 engines)
- ClamAV (daily): Win.Downloader.Unruy-6988793-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: TrojanDownloader:Win32/Unruy!pz
- Emsisoft (Emergency Kit): Gen:Variant.Unruy.1
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 97/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Downloader.Unruy-6988793-0 (rule
Win.Downloader.Unruy-6988793-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 24 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - persist via registry run key (rule
persist via registry run key) - capa signal, weight 0.35, confidence 0.60 - Embedded network infrastructure: 94.75.229.248 - static signal, weight 0.35, confidence 0.60
- communicate over HTTP (rule
communicate over HTTP) - capa signal, weight 0.30, confidence 0.60 - enumerate processes (rule
enumerate processes) - capa signal, weight 0.20, confidence 0.60 - Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
356 behavior events · 0 ATT&CK techniques · 5 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
Dropped files
- C:\program files (x86)\internet explorer\wmpscfgs.exe -
b22d6229c2508c39e8b116f4501b16c54af5eb48cc3458e4fdc3861d50edf321 - C:\Users\analyst\AppData\Local\microsoft\OneDrive\onedrive.exe -
e5e5a1af84dc40565eda396581f06f75647a7168d98b301e06fa7a2f797aff75 - C:\program files (x86)\Adobe\acrotray.exe -
55a4d06ff1e5cb4577a72196b7e059ab5c662eae9f9843ffe5cae7a58838237a - C:\program files (x86)\Adobe\acrotray .exe -
e2f7e2000802eb094ece7a38819e43b49a5de0a3194db9fd6921503682037a6e - e74a3fa84237500b7eafea3b54af63b012dc435e660899db8447f7cf4a886450 -
e74a3fa84237500b7eafea3b54af63b012dc435e660899db8447f7cf4a886450
Embedded URLs
- http://www.google.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787796066&P2=404&P3=2&P4=TaQEF9QGTw0PFBnOjCM4W%2b8sm1BAhRgoeiQp5pCVe8HemHyZ9GyoorQ5Ae1KuqJStrd2EeDILautgXjjgemw5Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787796099&P2=404&P3=2&P4=UYmAYO8ISNvxTT389lcvA5VPxK7Lw%2fl6%2bnGnS8U%2byNCwrinIkTPSQHrjTteP5tKEm%2bA%2bs3Ii9pajP0A73j8G5Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- www.supernetforme.com
- www.superwebbysearch.com
- www.google.com
Embedded IP addresses
- 94.75.229.248
- 52.168.117.170
- 52.123.252.215
- 40.84.85.40
- 4.230.171.124
- 4.144.132.223
- 20.165.94.63
- 135.233.95.135
- 4.150.223.104
- 74.178.240.61
- 20.236.44.162
- 52.123.129.14
- 52.123.128.14
- 52.182.143.212
- 52.123.252.212
- 172.178.240.162
- 203.26.79.13
- 172.66.2.5
- 52.123.252.192
- 74.179.71.159
- 135.233.45.223
- 72.154.7.107
- 52.148.114.188
- 52.110.12.53
- 52.110.12.32
File paths
- c:\program
- C:\Program
More Unruy samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report