MALICIOUS — 1db77cd67cf4030d59992a87477183a7157365a13248e0d13e60655dda8d68dd

MALICIOUS — 1db77cd67cf4030d59992a87477183a7157365a13248e0d13e60655dda8d68dd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100). 2 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1db77cd67cf4030d59992a87477183a7157365a13248e0d13e60655dda8d68dd
SHA-1: c7e8688233a05bb067d15779e6adaa29dd811ec8
MD5: ac0efd73257602091616e4ebc4622ba9
imphash: 771106f54fcc51d1aa3989e528332f80
ssdeep: 6144:rzBkLL2NTBTR7VEIyEwopWu24U+o5Fh3r:rKyNT1RVE1ly2PpFpr
TLSH: T16843E01183A12B98D2E2F1F58A75FE5E5103F8B011B489EC2547DC6C92E2C37673A1E6
Submitted as: 1db77cd67cf4030d59992a87477183a7157365a13248e0d13e60655dda8d68dd
File type: pe · Size: 220672 bytes
Verdict: malicious (93/100)

Detections (2 of 56 engines)

Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Kaspersky (KVRT): UDS:Trojan.Win32.Reconyc.sb

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 7 weighted signals:

Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.Reconyc.sb (rule UDS:Trojan.Win32.Reconyc.sb) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

11352 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\CE5C.tmp\svdhost.exe - 254479206a227253a21eb4a1db261eeb7b533706923ffe10ab66ea7a7a3cb179
C:\Users\analyst\AppData\Local\Temp\CE5C.tmp\CE6C.tmp\CE7D.bat - cdcebae35e6e5df47aa7a57113f7d21bcd50825dcaa730febbef32bc82d7ef92
C:\Users\analyst\AppData\Local\Temp\CE5C.tmp\svdhost.ini - d36fa8fff9303e7e6585e2f8995b64d30dce1b2ff44e6c203355c90aa45f48ee

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.170
20.247.184.197
52.123.252.247
4.230.171.124
4.150.223.103
172.66.2.5
57.154.63.210
135.234.160.244
4.247.188.224
72.145.35.99
52.148.114.188
52.110.12.15
52.110.12.45

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report