SUSPICIOUS — 259bc9d49b49a022e8756e1152e30016faf2491cdd5442de4bc58e69606d1440

SUSPICIOUS — 259bc9d49b49a022e8756e1152e30016faf2491cdd5442de4bc58e69606d1440 is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (54/100). 4 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 259bc9d49b49a022e8756e1152e30016faf2491cdd5442de4bc58e69606d1440
SHA-1: dd8d9694fb99d195b1b1ce232f399852e5566051
MD5: 8d3d1236d13af276d875b16c86a5b7e2
imphash: f027691deacfb4c91b8655c5c9cc0094
ssdeep: 12288:RZ+FPmPH2itIFd8FFRdri8Fj6Oi3KtenKuosuziH3oj:rX4WPfj6PKeKuos
TLSH: T1654B12FD92128DABC884E61294150DACD42B38F895352FCCA7A7D83891B4F63569D0D3
Submitted as: 259bc9d49b49a022e8756e1152e30016faf2491cdd5442de4bc58e69606d1440
File type: pe · Size: 491520 bytes
Verdict: suspicious (54/100)

Detections (4 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Microsoft Defender: Trojan:Win32/Gatak.DR!dha
Emsisoft (Emergency Kit): Gen:Variant.Fugrafa.41461
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The suspicious score of 54/100 is the fusion of 6 weighted signals:

Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

428 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~136592.tmp - 750db11af3029f71035da462555e63079334fb0b6cbbbbe5a294bc0325150424
ee4c11807ccb5abf3d8b3209998ee3a6447dc61cc81990f483b738d4b986548e - ee4c11807ccb5abf3d8b3209998ee3a6447dc61cc81990f483b738d4b986548e
7fe8773e4ead526cc38ed4663530242fa148945eb93891d3c772b4550cbabb0b - 7fe8773e4ead526cc38ed4663530242fa148945eb93891d3c772b4550cbabb0b
9d439b26ca79c97ca3476d8819c0d7a780eb292cae8bdabfcc3a905a5da28b0c - 9d439b26ca79c97ca3476d8819c0d7a780eb292cae8bdabfcc3a905a5da28b0c
c060de9fdf9351540ab42973b41dd45aba85362781efc6ee54b1f9b8490d616f - c060de9fdf9351540ab42973b41dd45aba85362781efc6ee54b1f9b8490d616f
78a583d364825ecf6976bc5d67779d59fb6797b936f9af5d6757b3719a82e25e - 78a583d364825ecf6976bc5d67779d59fb6797b936f9af5d6757b3719a82e25e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787807437&P2=404&P3=2&P4=EuVhR8mikvkeXTxwSJPYnMC8Cjj%2b%2fYIgdmpk7RHuJvfgtWj7YbhX2qjeiq4omfblRShbU%2fm7H7F0j8i1V3%2f0DA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787807508&P2=404&P3=2&P4=ERYbfs3BhfZnLKUaPBJOVYHY5B3QNUumwrL0LFJ99wpG5g1GqOsqJxD%2fuRAk85DFpcVZqEzft%2f3SUFxQN%2f%2fgrA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

51.116.246.106
4.230.171.124
172.215.188.232
52.230.59.222
74.178.76.128
20.89.1.10
74.178.240.51
20.236.44.162
162.159.142.9
52.123.129.14
52.123.128.14
203.26.79.13
51.11.192.48
135.232.92.34
172.178.240.162
207.36.232.49
52.148.114.188
125.56.205.123
125.56.205.51
72.153.5.132
52.110.12.4
52.110.12.15

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report