MALICIOUS — 1a9f7f9c0d9e22079328bf76a80fa1e620f5e7ae75cd2867b4667826b1ca2cd0

MALICIOUS — 1a9f7f9c0d9e22079328bf76a80fa1e620f5e7ae75cd2867b4667826b1ca2cd0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 1a9f7f9c0d9e22079328bf76a80fa1e620f5e7ae75cd2867b4667826b1ca2cd0
SHA-1: 58aee6faa64bf08de822bfa39a52541a1794ec9b
MD5: 1f5a8791e80394d0579fb7843d9c180d
imphash: b806352ebc796e5060cd13bc5e12711d
ssdeep: 1536:cwl0ccUBnUCOB+dGrNjjmJ2NuKuFr1M5B4QbCcItU:IUBUCOB++jOWgU
TLSH: T14D3BA1D40CE8E0A1CE6497878E4469FC058EEDABB222507419C9AA1BD7C21FF507E15F
Submitted as: 1a9f7f9c0d9e22079328bf76a80fa1e620f5e7ae75cd2867b4667826b1ca2cd0
File type: pe · Size: 102400 bytes
Verdict: malicious (100/100) · Family: Changeup

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Worm:Win32/Vobfus.EH
Emsisoft (Emergency Kit): Gen:Variant.Pronny.7
Trellix Stinger (McAfee): W32/Autorun.worm.ru
Kaspersky (KVRT): Trojan.Win32.Jorik.Vobfus.ahog

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.EH (rule Worm:Win32/Vobfus.EH) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Pronny.7 (rule Gen:Variant.Pronny.7) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Autorun.worm.ru (rule W32/Autorun.worm.ru) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Jorik.Vobfus.ahog (rule Trojan.Win32.Jorik.Vobfus.ahog) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

48742 behavior events · 3 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\hogos.exe - 7ca4bdab6a57dab7957bbec251c56f1d7583f37281b45617ef2838f3685df2be
001bf535424cd5d2ff24e467e829ba2acced6e256eef9df870a88f36218fa33b - 001bf535424cd5d2ff24e467e829ba2acced6e256eef9df870a88f36218fa33b
a9d82743d644091fce8ac151e1018facf1a7181c37ccaab69ef96083f024e42e - a9d82743d644091fce8ac151e1018facf1a7181c37ccaab69ef96083f024e42e
0742a0b3455645e625466933608fe887813d16ab13e57033fe880199a1ddd114 - 0742a0b3455645e625466933608fe887813d16ab13e57033fe880199a1ddd114

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns1.spansearcher.net
ns1.spinsearcher.org
ns1.player1352.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
default.exp-tas.com

Embedded IP addresses

20.184.175.12
4.230.171.124
57.155.104.224
52.230.59.222
172.64.154.167
74.178.76.54
74.178.240.61
13.89.179.15
74.178.76.128
57.154.63.210
135.234.160.246
4.150.223.110
20.42.73.26
172.170.180.133
4.150.223.111
20.184.175.17
203.26.79.13
20.184.175.15
20.184.175.13
92.223.78.30
52.148.114.188
52.110.12.54
52.110.12.11
72.153.5.141
172.172.255.216

File paths

C:\Program
C:\Windows\system32;C:\Windows\system;

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report