MALICIOUS — PPLFaultTemp .exe

MALICIOUS — PPLFaultTemp .exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 26dd8ce3aed5093faea79d843fef2fd1153472f21a52a096fc7066238ffa461c
SHA-1: 4370a815636efc1a739473a014377f4e918fcc07
MD5: 94da0be43b4e0c800854b8f1cee7837b
imphash: 3a2003ea545fe942681da9e7683ebb58
ssdeep: 12288:CxIK9V14ImyHYWE3VLsf7sqPzWPalWywGl8U:CJEyYWE3VLK7nnSU
TLSH: T18A49BF30D54BB4AAEBC69C8DEAC85E7C04B259DA8AD47C34773E0B84D7CA69F00D4605
Submitted as: PPLFaultTemp .exe
File type: pe · Size: 420286 bytes
Verdict: malicious (99/100) · Family: Mira

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
ClamAV (daily): Win.Packed.Mira-7330891-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Krap!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Packed.Mira-7330891-0 (rule Win.Packed.Mira-7330891-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (Persistence): scoobe-fix.cmd - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.lol 1, MinGW - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

5822 behavior events · 1 ATT&CK techniques · 34 dropped files.

Dropped files

C:\808.ini - ecc131bb108c7892090d54b6b190483a1bf80cd0dc95850539ed0065f4e1f6cb
C:\Documents and Settings .exe - b72c3a43f2a02c668eedd31e91bbd3f983bf25ceeff24d7c56c99c0724a55227
C:\scoobe-fix.cmd .exe - d9b1da0bb33f8a2a483fa693d0b732b540d5c6903caea8b9085cca1353163f27
C:\Windows .exe - 3c2298ed2dd9afe8c68a02988a10a610c83c250ea00a6334c50bcc6be0bfd246
C:\Sysmon64.exe .exe - 9eb8b985a8bd48d3ed7e2132a7870cc778eeed84a9a7f1534665d6363fd80719
C:\$WinREAgent .exe - 4bc7f8b30fa5542189a780f071e1e22a5ffca0ef3c7a8f1c0e5339c25581eca2
C:\swapfile.sys .exe - ac09fa448c27f0ebc86d38855ed3a12a806b05e35d693e9633dc0fe51ed67c86
C:\Config.Msi .exe - 4683ea89d191eba04d4f6685d5b8c22f74f6ef6dca319385d1e0f1c6b55057a6
C:\System Volume Information .exe - 8216c9e95f63cd01794b6d135837d1cea4afcc9599849e25c8025d00fbc0150c
C:\DumpStack.log.tmp .exe - 699c9f9db9bdd902e5490143dd9df1368bd8b6137d6ca780b7efec42f7c307ea
C:\ProgramData\lvckk.exe - 9b6a6537fbb1c9af30608110c48b122e3ffae8baf6039bb29f88a308c44ec320
C:\PPLFaultTemp .exe - 794b757d4106179f02cbc3c4e2d18cea07b859aece99377d2cac7e7ca148c8ae
C:\Recovery .exe - 37395813283b5f72535152126b3df14ce2a3f969a6acae10db96f98ee0b87228
C:\uac-done.txt - ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a
C:\Program Files (x86) .exe - b9d069335bed3bf9e2ca31cedf358f54aa00fc4232564155b73458ed61e61315

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787725438&P2=404&P3=2&P4=b5gCyqW5Qi0P5Vo7hn4z8ka1hmRu1hUEd7q5rkotCmlRwlJPlEycgg6G1uDEjj53r4qOOy0wOhb3ImysxZOz%2bw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787725474&P2=404&P3=2&P4=m%2fsySDXnGJ00LSvpm21cshU%2bjEzJ05hDly36BeA3vSH2ioTd9gvOd5i51OA%2fi2oMp4Q6bOmu1WEQGTdPXg3r5A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.110.12.15
52.110.12.1
4.207.44.68
203.26.79.13
135.233.95.80
52.123.252.192
48.211.4.16
4.230.171.124
4.144.132.114
74.178.76.128
20.184.175.19
20.165.94.54
20.231.239.246
40.99.134.2
52.123.129.14
57.155.101.212
52.123.252.230
52.123.252.227
135.234.160.245
52.148.114.188
92.223.78.30
72.153.5.96
52.110.12.31
74.179.71.159
52.110.12.51

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report