MALICIOUS — 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e

MALICIOUS — 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 6 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
SHA-1: 81cd395c4fa5a5daf675ae5f87a3579367f3a441
MD5: 98d647db636bde4c54a3b4b8cdd1570f
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2fGDVpN8B4mPJOiOJ8RXLcRKldQjUmzYbS77tm0jUmzYbS:BtfDwsjPThT5zL2OD7N8BHJON8xLyE
TLSH: T12146C6041F37288EC4F165126EA1B48D49C399A6132F680B62EB477BE186C7F385717B
Submitted as: 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
File type: pe · Size: 307624 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (6 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

Dropped a malicious payload (Emotet): 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 4 finding(s), e.g. RWX/private injected region in svchost.exe (pid 936) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 37 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://repository.certum.pl/ctnca2.cer09, http://www.certum.pl/CPS0, http://repository.certum.pl/ccsca2021.cer0 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

58579 behavior events · 2 ATT&CK techniques · 64 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9206/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9206/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9206/files/0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f - 0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f
/opt/CAPEv2/storage/analyses/9206/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9206/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9206/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9206/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9206/files/30ff73fbe5eaa5ee96e8c20fbdabcd579decc9d7142697f1d3deed932e0acff2 - 30ff73fbe5eaa5ee96e8c20fbdabcd579decc9d7142697f1d3deed932e0acff2
/opt/CAPEv2/storage/analyses/9206/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9206/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9206/files/af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98 - af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98
/opt/CAPEv2/storage/analyses/9206/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9206/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73
/opt/CAPEv2/storage/analyses/9206/files/713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210 - 713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210
/opt/CAPEv2/storage/analyses/9206/files/c210222aa6920708541ef37fe530810d36d81cfafdf020275cccc0aad9398a35 - c210222aa6920708541ef37fe530810d36d81cfafdf020275cccc0aad9398a35

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl.certum.pl/ctnca2.crl0l
http://repository.certum.pl/ctnca2.cer09
http://www.certum.pl/CPS0
http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
http://repository.certum.pl/ccsca2021.cer0
https://www.certum.pl/CPS0
http://subca.repository.certum.pl/ctsca2021.cer0
http://subca.crl.certum.pl/ctsca2021.crl0
http://crl.certum.pl/ctnca.crl0k
http://repository.certum.pl/ctnca.cer09
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786397554&P2=404&P3=2&P4=hFxAbcuKxKQ%2bj56fJNFDjpbpfiyR%2b6aC2zHtbrl8WyJCZyXGcyFase4Mynr6LHnzwISaIESd7FljjVl6GnG0eg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786397585&P2=404&P3=2&P4=awna9iKys3%2bQ3qDDHqCUC7ygMLLaL5TJzjOfS2VzxrEqMoWVhskVe9TNfT9tl84fnflFs%2fwPVejMPmgFrxry6g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
crl.certum.pl
repository.certum.pl
www.certum.pl
ccsca2021.crl.certum.pl
subca.repository.certum.pl
subca.crl.certum.pl

Embedded IP addresses

192.168.0.30
192.168.8.1
26.2.5.2
51.116.246.104
4.230.171.124
172.215.188.232
172.215.188.225
4.144.132.223
135.232.92.137
135.232.92.34
20.184.175.22
74.178.240.51
135.233.95.144
172.178.240.163
203.26.79.13
20.42.73.28
20.42.65.89
135.233.45.222
184.84.165.136
72.153.5.129
57.155.104.224
85.210.193.152
52.148.114.188
92.223.78.30
20.165.94.46

File paths

E:\build\workdir\LinkTarget\Executable\sbase.pdb

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report