MALICIOUS — 1f84e04c4b9ca299ac324e9e309923d555e94239007f0785e44e39fad23e5ddc

MALICIOUS — 1f84e04c4b9ca299ac324e9e309923d555e94239007f0785e44e39fad23e5ddc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Fileinfector family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 1f84e04c4b9ca299ac324e9e309923d555e94239007f0785e44e39fad23e5ddc
SHA-1: 591a2ac2e0d45a481c95285a23a795856fb78e63
MD5: 54b2103011a381c5ba14144956df617f
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 768:ae2mxDM5ZaR0G1sw6v5KPukcy+h4wOZS8FnrsOiiNfJDLrBjydwTpo5LC:txu81hx+4wOZS8VrsOii9hB9poJC
TLSH: T1FF34F787526E227AC6ECCEA07F12D91F97E2B0D6117A2E4E1049C0277461C739C7AF16
Submitted as: 1f84e04c4b9ca299ac324e9e309923d555e94239007f0785e44e39fad23e5ddc
File type: pe · Size: 57344 bytes
Verdict: malicious (100/100) · Family: Fileinfector

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Fileinfector-9833022-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: flagged
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9833022-0 (rule Win.Malware.Fileinfector-9833022-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.ks (rule Virus.Win32.Lamer.ks) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 23 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

57719 behavior events · 2 ATT&CK techniques · 38 dropped files.

Dropped files

C:\Windows\System32\vulkan-1.dll - 838366fcf460638f1d3089957663cce26fd945376c457d5443938f3b5c7d06d1
C:\Windows\System32\vcruntime140.dll - 5596f98550aa6643af8c6a2c9e541b8b2d477afce1239a4aac5c440dcb158956
C:\Windows\PFRO.log - e8d1bc6ee90eda0d60ba92282517cd4b6291c19186cf71bac8a66f7908b47204
C:\Windows\System32\msvcp140_1.dll - 4037f2c88b2a960d92fd26721389409718b1aa7a3b04d23ec91e9ddba1b27971
C:\Windows\SysmonDrv.sys - 4b4a4904fc6ba0f25fc1a0de7a16de037d6387c78e8bd2d20397c12e1428abe4
C:\Windows\System32\mmc.exe.config - 72f1588da288c838ef934dd43ca159d6dfe3206eb4be3bf29b2a94725d549ac4
C:\Windows\System32\msclmd.dll - 9a8d34c2f5713445260ce22d3ab76aa70f9e734e14aa72fa4739f6a575adb30d
C:\Windows\DtcInstall.log - 1c26561365a07e24b960ac91cfeee335ec48a5ff34ebaaa982b42db12e33ed72
C:\Windows\System32\mfc140u.dll - be081b1e3ca27db707b88e82c4b8f630ff41999c6b21d20c64f880ebde63a3ef
C:\Windows\System32\dssec.dat - c8e5be4d4da56fa9583929a99bce726c93b9a68d85ec0b307b494583c7c0e653
C:\Windows\pyw.exe - 5328a1e3d3c5793271b7244f77817df473e74ac2cc6200b5a30cfd9d1eb0a7cb
C:\Windows\System32\mfcm140.dll - 212e946d05c757a88061735ea5e974c8860681018e8ceb22e031af34789e53d5
C:\Windows\System32\msvcp140_atomic_wait.dll - 8d304479997dcabbe62754b51fab0b9c4aa0e498ec7133479507c2ad93f3e1da
C:\Windows\System32\msvcp140_2.dll - aa3d6d308f8f6ad8a2295d5fa0d9af40bd12671577552dcecc6caa33fe8c7f50
C:\Windows\Professional.xml - 64def758cce4a7a260da5cb4bd832e8f567d7fff12592ab248405d155ad32c9f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.89.179.15
52.123.252.242
4.230.171.124
172.215.188.225
4.144.132.223
74.179.77.164
74.179.77.204
20.42.73.30
74.178.240.61
20.184.175.0
20.42.179.192
162.159.142.9
52.110.12.22
52.110.12.52
4.209.250.170
52.178.17.2
52.168.117.170
203.26.79.13
20.42.65.89
40.79.163.154
4.150.223.106
135.234.160.247
52.148.114.188
52.110.12.2
72.154.7.99

File paths

C:\Windows\system32\x3daudio1_0.dll

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report