MALICIOUS — 27ee2af69fa4a0849b81593ac817edcf3a0310c7cb144331a98fc89061233563

MALICIOUS — 27ee2af69fa4a0849b81593ac817edcf3a0310c7cb144331a98fc89061233563 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 27ee2af69fa4a0849b81593ac817edcf3a0310c7cb144331a98fc89061233563
SHA-1: 20337ab9c247da3d6360e68b80ce87b2125cbef1
MD5: ef4d913323610a0158dfa944836e3d1a
imphash: b8e38d6e701dd0baea1499caf2a327e5
ssdeep: 768:1lvMa2QKJHTLoLDYFdwbjMPkG1VuW/wqvRXMXp677yCzdXZRT2Nq1MaQnepMri1:1RlmJHTLvilGVs4emEFbsP0
TLSH: T1614421C9D2488869F35FD41E82339EBF158DC845685D7C0A8C15A98737CB8B32782BD9
Submitted as: 27ee2af69fa4a0849b81593ac817edcf3a0310c7cb144331a98fc89061233563
File type: pe · Size: 249856 bytes
Verdict: malicious (100/100) · Family: Changeup

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Trojan:Win32/Fareit.CV!MTB
Emsisoft (Emergency Kit): Gen:Variant.Ser.Zusy.342
Kaspersky (KVRT): Worm.Win32.VBNA.c

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Fareit.CV!MTB (rule Trojan:Win32/Fareit.CV!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ser.Zusy.342 (rule Gen:Variant.Ser.Zusy.342) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.VBNA.c (rule Worm.Win32.VBNA.c) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

50642 behavior events · 3 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\leaciem.exe - 9e27cd45b7b8ac139b545fca0d1dce98412a1b4f7a5ecf3ecfb3d1dff1c787f7
f4ba40f3c81d46936861e99ef75d90bea976a4d615d890353404bc5e68f49281 - f4ba40f3c81d46936861e99ef75d90bea976a4d615d890353404bc5e68f49281
6ce510f63bb7c3750d21bfd1434bfdf80806d203267cc7e1c7ef006df07fdcde - 6ce510f63bb7c3750d21bfd1434bfdf80806d203267cc7e1c7ef006df07fdcde
968c925088c2c87afc4d7b23f733f79ea051bcf9223c302d37787c591339ae31 - 968c925088c2c87afc4d7b23f733f79ea051bcf9223c302d37787c591339ae31
91b3d117dbb215f4554fbbb2ad738031e1bb10c7831cefccc72fdfcfda3f7f2c - 91b3d117dbb215f4554fbbb2ad738031e1bb10c7831cefccc72fdfcfda3f7f2c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns1.codeconline.biz
ns1.player1523.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
default.exp-tas.com

Embedded IP addresses

20.42.65.88
57.155.101.212
4.230.171.124
52.253.84.76
135.232.92.137
135.232.92.97
52.182.143.212
20.42.73.30
172.215.188.225
52.110.12.54
52.110.12.50
20.184.175.21
40.79.141.154
4.209.250.170
52.168.117.174
135.234.160.246
203.26.79.13
20.42.73.27
20.42.73.26
52.148.114.188
172.172.255.216
52.110.12.40
52.110.12.2
72.145.35.108

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report