MALICIOUS — 1e8d373b96da7fbe9aea056c885e37d0d164258ecd292c3b2364650000588226
MALICIOUS — 1e8d373b96da7fbe9aea056c885e37d0d164258ecd292c3b2364650000588226 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (91/100), attributed to the Wacatac family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
1e8d373b96da7fbe9aea056c885e37d0d164258ecd292c3b2364650000588226 - SHA-1:
2c27fa426300612e184c3b2ab6d04ef26e5d961d - MD5:
b6e682497bb90817a2e37b446f177fa9 - imphash:
d41d8cd98f00b204e9800998ecf8427e - ssdeep:
24576:kxNpf48BbT8c9YzOOy5wijby+QsjaYJysHXYzOOy5Q:ug8BbT8c9dhB3lXd+ - TLSH:
T1CE5301199D70C1F7F151220E384A393F8F6E58B854E8A410F46A1B7C4BE57A76B8C62C - Submitted as: 1e8d373b96da7fbe9aea056c885e37d0d164258ecd292c3b2364650000588226
- File type: pe · Size: 1095680 bytes
- Verdict: malicious (91/100) · Family: Wacatac
Detections (4 of 55 engines)
- ClamAV (daily): Win.Packed.Wacatac-9866458-0
- Microsoft Defender: Trojan:Win32/Copak.C!MTB
- Trellix Stinger (McAfee): Glupteba-FTSD!B6E682497BB9
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 91/100 is the fusion of 3 weighted signals:
- ClamAV (daily) flagged Win.Packed.Wacatac-9866458-0 (rule
Win.Packed.Wacatac-9866458-0) - engine signal, weight 0.90, confidence 0.95 - Contacted 23 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
- Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
3856 behavior events · 0 ATT&CK techniques · 6 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- www.nsVvpqv5tM.com
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- licensing.mp.microsoft.com
- windows.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\tsk_30168d1d279c4303.exe -
df0adeb036ef75cc3f8f2f7bb212f7e3cc81c1a0d089c5caf1524079c90f44f8 - 28f41922aedb9dc3c7fc34be7fe961a44a53df75557321a42b29198c50c912a5 -
28f41922aedb9dc3c7fc34be7fe961a44a53df75557321a42b29198c50c912a5 - dc326527f3ad67ffd57b4acf703d74a582722186eb184562c08984c839e2b745 -
dc326527f3ad67ffd57b4acf703d74a582722186eb184562c08984c839e2b745 - e13d8f2042bb8612c124a6fd765a1108d24190488e5dab5f6e4d328829bde211 -
e13d8f2042bb8612c124a6fd765a1108d24190488e5dab5f6e4d328829bde211 - b4a7b2f4f73c6e13f071183f91826f0f0f79a734e7b8e2d3e3f3a5f17cac04a0 -
b4a7b2f4f73c6e13f071183f91826f0f0f79a734e7b8e2d3e3f3a5f17cac04a0 - f2fe2b006aad52707898bc484ca7378c2f78b38040f8dbcc46a49682bf5c7d69 -
f2fe2b006aad52707898bc484ca7378c2f78b38040f8dbcc46a49682bf5c7d69
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787887876&P2=404&P3=2&P4=Q5Kb869Qjg40pZ41bLw63tLbVzgVjsKwXX5LQdiRM6kDy9hiMCvRNkl50kL2Ylnc7GC24ug6Y4XsewZvot3S2w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787887914&P2=404&P3=2&P4=FmEOp%2f6cbjg2%2fhD49O7dQyWXtVbXXa9Tz5Tpzo4IEBTzRhPSb55lxP1%2bWeq8XbLqQznavizc9Ln178xjmHnRhQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- www.nsvvpqv5tm.com
Embedded IP addresses
- 52.123.252.240
- 20.50.201.205
- 52.230.60.54
- 20.42.179.204
- 4.230.171.124
- 135.232.92.137
- 74.179.77.164
- 74.179.77.204
- 4.150.223.112
- 52.123.129.14
- 20.231.239.246
- 40.99.133.242
- 40.99.134.2
- 52.123.128.14
- 172.178.240.161
- 52.123.252.239
- 203.26.79.13
- 52.148.114.188
- 52.123.252.219
- 74.179.71.159
- 52.110.12.4
- 52.110.12.22
- 72.153.5.60
More Wacatac samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report