MALICIOUS — 13c37f78410c0e9fc0cb5cc5c28fafc829feb4d72a55aaad1800a123bea9166e
MALICIOUS — 13c37f78410c0e9fc0cb5cc5c28fafc829feb4d72a55aaad1800a123bea9166e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the VMProtect family. 6 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
13c37f78410c0e9fc0cb5cc5c28fafc829feb4d72a55aaad1800a123bea9166e - SHA-1:
df1953e93a07a2791e6ec708ae6ffa565990f01c - MD5:
e11078eba22e934bf800b1b0d130d5a4 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
6144:AfkxUm+Rv+vcBQFRzaCVjNHQqMF66A4wdTv4n9uvk62FXKZDA9xQ:AfkW6vc0Rza+jNXZhVkTpg - TLSH:
T14C45C04FC259EF19C4395A02BD1F9DCD74D8E8C760BF289518082893F69178BAC93267 - Submitted as: 13c37f78410c0e9fc0cb5cc5c28fafc829feb4d72a55aaad1800a123bea9166e
- File type: pe · Size: 288768 bytes
- Verdict: malicious (98/100) · Family: VMProtect
Detections (6 of 56 engines)
- capa (capabilities): capability:execution/powershell
- MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
- YARA: Yara-Rules community: YR_Packer_VMProtect
- Microsoft Defender: Trojan:Win32/Wacatac.B!ml
- Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.50015
- Kaspersky (KVRT): UDS:Trojan.MSIL.Bingoml.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 10 weighted signals:
- Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule
Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.MSILHeracles.50015 (rule
Gen:Variant.MSILHeracles.50015) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.MSIL.Bingoml.gen (rule
UDS:Trojan.MSIL.Bingoml.gen) - engine signal, weight 0.55, confidence 0.85 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule
YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70 - capa (capabilities) flagged capability:execution/powershell (rule
capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70 - MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule
Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: https://cdn.discordapp.com/attachments/840047613214588958/840048894569611284/ssu.exe, https://cdn.discordapp.com/attachments/840047613214588958/840048959041175582/host.txt, https://cdn.discordapp.com/attachments/840047613214588958/840048970159489034/productkey.bat - static signal, weight 0.35, confidence 0.60
- Packing/obfuscation: Themida/VMProtect - static signal, weight 0.25, confidence 0.55
Dynamic analysis (windows)
495 behavior events · 0 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- officeclient.microsoft.com
- windows.msn.com
- www.msn.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- th.bing.com
- edge.microsoft.com
- time.windows.com
- settings-win.data.microsoft.com
Dropped files
- 7df599a4f97d6e6138ae0fa624ac7a5171621efc1db7df1042bf088fde815abf -
7df599a4f97d6e6138ae0fa624ac7a5171621efc1db7df1042bf088fde815abf
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- https://cdn.discordapp.com/attachments/840047613214588958/840048894569611284/ssu.exe
- https://cdn.discordapp.com/attachments/840047613214588958/840048959041175582/host.txt
- https://cdn.discordapp.com/attachments/840047613214588958/840048970159489034/productkey.bat
- https://cdn.discordapp.com/attachments/840047613214588958/840048978396839996/Volumeid64.exe
- https://cdn.discordapp.com/attachments/840047613214588958/840048877134676019/3D.exe
- https://cdn.discordapp.com/attachments/840047613214588958/840048881277337640/5F.exe
- https://cdn.discordapp.com/attachments/840047613214588958/840048965537890354/Mac.exe
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- schemas.microsoft.com
- cdn.discordapp.com
Embedded IP addresses
- 13.69.116.109
- 52.253.84.76
- 52.123.252.198
- 4.230.171.124
- 172.64.154.167
- 20.42.179.192
- 72.145.35.107
- 52.148.114.188
- 52.110.12.30
- 52.110.12.22
File paths
- C:\\ProgramData\\SoftwareDistribution\\1.exe
- C:\\antiOS
- C:\ProgramData\SoftwareDistribution\OS.bat
- C:\ProgramData\SoftwareDistribution\(3)D.exe
- C:\ProgramData\SoftwareDistribution\(4)E.exe
- C:\ProgramData\SoftwareDistribution\(5)F.exe
- C:\ProgramData\SoftwareDistribution\ssu.exe
- C:\ProgramData\SoftwareDistribution\(7)TiskKill.exe
- C:\ProgramData\SoftwareDistribution\Mac.exe
- C:\antiOS\host.txt
- C:\antiOS\productkey.bat
- C:\antiOS\Volumeid64.exe
- C:\\ProgramData\\SoftwareDistribution\\(5)F.exe
- C:\\ProgramData\\SoftwareDistribution\\(4)E.exe
- C:\\ProgramData\\SoftwareDistribution\\(3)D.exe
- C:\antiOS\Mac.exe
- C:\\antiOS\\Mac.exe
- C:\Windows\explorer.exe
- C:\\ProgramData\\SoftwareDistribution\\MicrosoftLogs.exe
- C:\\ProgramData\\Windows.exe
More VMProtect samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report