MALICIOUS — 252a2b128b987871cf03d757a48ba263f47196d1367979fa3556db98e55919b6

MALICIOUS — 252a2b128b987871cf03d757a48ba263f47196d1367979fa3556db98e55919b6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upatre family. 4 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 252a2b128b987871cf03d757a48ba263f47196d1367979fa3556db98e55919b6
SHA-1: c54220da733374afcdd13f1699736f8727010d65
MD5: f5258cab7d6f6a05ea6c601881d4d860
imphash: 8bacd03bbc7cdff0985aa85f801440c8
ssdeep: 96:Vb+u4l46E3cX4aVfTmBBXYiYIICe0YpajAGdY+W:sHO6OI9TsYieCe0ZjRdvW
TLSH: T1F21F968FC02426E3CA774DD31931E89D619AB0E30AEEB7541DDDD12D50D1463ECA2E29
Submitted as: 252a2b128b987871cf03d757a48ba263f47196d1367979fa3556db98e55919b6
File type: pe · Size: 7086 bytes
Verdict: malicious (99/100) · Family: Upatre

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Upatre-6722905-0
Microsoft Defender: TrojanDownloader:Win32/Upatre!pz
Emsisoft (Emergency Kit): Trojan.Ppatre.Gen.1
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Genome.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Upatre-6722905-0 (rule Win.Malware.Upatre-6722905-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

44457 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ffengh.exe - 0eddb01b9db674b2268818eca3f818b61fdb1b56d9c7fd00c2bb36010d1791ee

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787789480&P2=404&P3=2&P4=bFHrvB3h5If2Wpy%2b4rtDkLR6%2b7QMNPGMBbTTiNU6zZhiIY9reXRv6aAJThcLX6F4h9HlHGo%2b8noRwHvuCp07rg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

drippingstrawberry.com

Embedded IP addresses

40.79.167.9
52.123.252.212
20.42.179.192
4.230.171.124
20.247.184.197
74.178.240.61
20.184.175.9
135.233.95.135
135.232.92.137
20.76.201.171
52.123.128.14
52.123.129.14
13.89.179.12
135.234.160.244
52.148.114.188
135.233.45.221
4.247.188.233
203.26.79.13
52.123.252.236
74.178.232.29
72.154.7.101
52.110.12.26
52.110.12.51

File paths

C:\jyKeWK7u.exe
C:\dh8L0ara.exe
C:\mEBvN3c5.exe
C:\JvMsZFFZ.exe
C:\McABjoW6.exe
C:\1dyqjn0F.exe
C:\H5AEYxD0.exe
C:\NnHAb9SS.exe
C:\Y5LfGbUt.exe
C:\RIdo0kZM.exe
C:\GBBOhubX.exe
C:\9b_qXIbd.exe
C:\WzOl7jrh.exe
C:\DqYCYy0_.exe
C:\gbkm8WYl.exe
C:\Ui3_U3im.exe
C:\sample.exe
C:\5PUSEt3q.exe
C:\93f615165ffc56a09b7f22f9ce5865d308cdebd4b6c6611bc417c3af49334931
C:\emmK2YZk.exe
C:\BThRQDuk.exe
C:\nZNXE6_B.exe
C:\DHVEvhSo.exe
C:\11Joy3JD.exe
C:\ZP48IeIh.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report