MALICIOUS — 2855c1dfedf42a6674bd806f1676109e3d5b76146d3194d6d76bad5a92b7ead5

MALICIOUS — 2855c1dfedf42a6674bd806f1676109e3d5b76146d3194d6d76bad5a92b7ead5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upatre family. 3 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2855c1dfedf42a6674bd806f1676109e3d5b76146d3194d6d76bad5a92b7ead5
SHA-1: 32b6fe9221c23d07e895b01ac87ad81a86bf7fcd
MD5: 2e71e8d795a41597ee4133f525235640
imphash: ec5885042cc2b33d72a078126ecee5b3
ssdeep: 768:0M+Fay71N6ij9ihSviVin9rOHiajz1xthS:0M+FaE19i8qwn96Hbs
TLSH: T17332F7CF80B407A3C37361262E75991F408770DA8D9D750A0E0A902E73E552BEDB6D7A
Submitted as: 2855c1dfedf42a6674bd806f1676109e3d5b76146d3194d6d76bad5a92b7ead5
File type: pe · Size: 45164 bytes
Verdict: malicious (99/100) · Family: Upatre

Detections (3 of 56 engines)

ClamAV (daily): Win.Packed.Upatre-9823253-0
Microsoft Defender: TrojanDownloader:Win32/Upatre.BN
Kaspersky (KVRT): Trojan-Downloader.Win32.Upatre.dwgq

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Upatre-9823253-0 (rule Win.Packed.Upatre-9823253-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Upatre.BN (rule TrojanDownloader:Win32/Upatre.BN) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Upatre.dwgq (rule Trojan-Downloader.Win32.Upatre.dwgq) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Embedded network infrastructure: 1.0.4.37 - static signal, weight 0.35, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

1567 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ofylywo.exe - bc22cef0a62f481bb7ff0a2aea9d1a0f6ab9aded690c13eb38aa025921efc5ff
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\ZVHAVNWM.htm - 0afaf795517e1260effdeb3ba0221df1365ec14cf6d96ec4b5baa057bbd1ba08

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://checkip.dyndns.org/

Embedded domains

checkip.dyndns.org

Embedded IP addresses

1.0.4.37
104.46.162.231
20.247.184.142
4.230.171.124
20.42.179.192
135.233.45.222
132.226.8.169
184.84.165.171
184.84.165.136
52.110.12.37
52.110.12.30

File paths

C:\ZjOB6B48.exe
C:\4bb4iZQO.exe
C:\qJIxC2Kd.exe
C:\2ESOjtBZ.exe
C:\7cjFEVaK.exe
C:\cvA2gH9n.exe
C:\aZ1ACKBq.exe
C:\GVJEy4p7.exe
C:\fQ5MWXE0.exe
C:\aHVAPZpu.exe
C:\ljt1vYUA.exe
C:\LsUFy3G6.exe
C:\bmwfUEcW.exe
C:\Bd0e_T51.exe
C:\B0De9gb7.exe
C:\ANmxDrOd.exe
C:\WA5PJtKg.exe
C:\nRuWLUHJ.exe
C:\Mz4MaviV.exe
C:\YuxQ45Xb.exe
C:\c918lB98.exe
C:\GX5WNdh1.exe
C:\01xLUBmb.exe
C:\5ZhLeD1k.exe
C:\7PUDcsfi.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report