MALICIOUS — 17e08f8c6dfd5e196119028aabf142bb2c6a33a4016021586e6e11978f3104f4

MALICIOUS — 17e08f8c6dfd5e196119028aabf142bb2c6a33a4016021586e6e11978f3104f4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 17e08f8c6dfd5e196119028aabf142bb2c6a33a4016021586e6e11978f3104f4
SHA-1: 58f02904040ded2070c8aaa8dff3836f4e466044
MD5: 0a1bcaed7c7418780a5c88106c4549e2
imphash: e77246b3d14bf4cc4fcd12f0ba31740f
ssdeep: 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpom+:PMpASIcWYx2U6hAJQnr
TLSH: T11D4ACE69C2F2A789EBF797302E509E0E20E25CDDD0BF4D984383C15D62D299BD1D112A
Submitted as: 17e08f8c6dfd5e196119028aabf142bb2c6a33a4016021586e6e11978f3104f4
File type: pe · Size: 459895 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Urelas-9635181-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: flagged
Trellix Stinger (McAfee): Corrupt-FY!0A1BCAED7C74
Kaspersky (KVRT): HEUR:Backdoor.Win32.Plite.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-9635181-0 (rule Win.Trojan.Urelas-9635181-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Corrupt-FY!0A1BCAED7C74 (rule Corrupt-FY!0A1BCAED7C74) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Plite.gen (rule HEUR:Backdoor.Win32.Plite.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 4 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

32786 behavior events · 1 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tohon.exe - a06d10e4597d5f5a18ab4f19d9fa4f9c44f48810b16255210ba511b0e7929a78
C:\Users\analyst\AppData\Local\Temp\tohon.exe - 01060bd3cbe579f99a6e9ec17e8fd6894d12097df046ec18f1e15bc7f205f97c
C:\Users\analyst\AppData\Local\Temp\ocunri.exe - 965e4b64eef15aa02280e9f8a6f101a7d060119f1863116637579109ed99ad82
C:\Users\analyst\AppData\Local\Temp\opree.exe - 4217140bfe21db89fa8f0c06bca230d5ecb6992c4a15acdee34bb06a7bfacb92
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - b5c4b376d79fe3f129999240477b31d2ee7f583fbb33b05704694113cb72f0e1
98843af3e1f2b6be29fca417f497e7a16e277a97e02575648cbca2cf63229b23 - 98843af3e1f2b6be29fca417f497e7a16e277a97e02575648cbca2cf63229b23

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
40.79.167.10
4.230.171.124
20.42.179.192
20.247.185.124
20.165.94.54
135.232.92.137
20.42.73.28
104.18.33.89
40.84.85.40
52.148.114.188
72.154.7.106
52.110.12.20
52.110.12.16

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report