MALICIOUS — 2873ed5acffc70c0d4548ea211c99062dc1b6ce0cdeb7c8e9ff933dfe4b452ba

MALICIOUS — 2873ed5acffc70c0d4548ea211c99062dc1b6ce0cdeb7c8e9ff933dfe4b452ba is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 2873ed5acffc70c0d4548ea211c99062dc1b6ce0cdeb7c8e9ff933dfe4b452ba
SHA-1: 9f325d4ec333d6288d2c3f55d6e5b04cab369a0a
MD5: e65698416a6366dff34121814820bc24
imphash: dadb12329976145c6a364992dc8ec07f
ssdeep: 384:iQ4n4X4f0y4vEhbTKFMWWeJqljfgj3WfgVl6DuwcP+60LnSCgBI5:ong40YfnWWeJqhIKuUDm+PLf+a
TLSH: T18F31F9CE81682AA7C2370DE71632ED5EB19AB0D30ADD77151DCCD03D50C28A3DD52A2A
Submitted as: 2873ed5acffc70c0d4548ea211c99062dc1b6ce0cdeb7c8e9ff933dfe4b452ba
File type: pe · Size: 41722 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Upatre-6997924-0
Microsoft Defender: Trojan:Win32/Zbot!pz
Trellix Stinger (McAfee): Trojan-FQSC!E65698416A63
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upatre-6997924-0 (rule Win.Malware.Upatre-6997924-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Zbot!pz (rule Trojan:Win32/Zbot!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FQSC!E65698416A63 (rule Trojan-FQSC!E65698416A63) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

15337 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\budha.exe - e93568e7c8fdbba2dc34d22d325f9c429171d02b7b80e3003a2ecbde8a5fde8f
61160fa848a401e0cd03ca0fee710e25246ef9eda2a1320b09f8619c68769371 - 61160fa848a401e0cd03ca0fee710e25246ef9eda2a1320b09f8619c68769371

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/JWW3Gj56Zd4.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788275193&P2=404&P3=2&P4=VEQpb55YVOurBgtDyiY3tXtH%2b7WztX0p6JdWWVF%2fSMkI6bSNnnmXRz2Ptf49ISI0eDctKSVzZYX3inTHBPawgA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

alore.co
aults.in
freebiegalore.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.11.192.48
52.123.252.247
4.230.171.124
20.247.184.142
104.18.33.89
104.21.87.172
172.178.240.163
203.26.79.13
57.155.101.212
20.89.1.12
4.150.223.115
74.178.76.44
52.148.114.188
72.145.35.96
92.223.78.30
52.110.12.42
52.110.12.16

File paths

C:\sample.exe
C:\UGW8tSzT.exe
C:\QZGXcIaC.exe
C:\zsW2nGnY.exe
C:\_7n0doHj.exe
C:\mV76_pSy.exe
C:\FFIdWXSo.exe
C:\CusWSwJl.exe
C:\eRtcT6_E.exe
C:\xUHPVa60.exe
C:\fe026d13893c61e1cebf20b781d234455de899a0a96a123a4eb1dc67bcd20037
C:\d1075190bf9b049094e343a4cf7b51954ac0b8cfe177d321bbe41d900d518801
C:\YfS1eNYB.exe
C:\LZ1GM52c.exe
C:\LCn4s4yQ.exe
C:\Users\Administrator\AppData\Local\Temp\cuckoo-9d6944bd226015a1b0e877abd9056c2c48a501139d490ef43cd3f285ca535844.exe
C:\dab7a5754d1a9a7cc514e05a4d447f84031a6a0ec2de749b44483782e1f471e7
C:\4354679b28ea5f7c6b508d18fa0a65d69f11bfaba0c86033fd49ec0915d3734d
C:\f9dcffbef27bb48ac00fa1e6f0fa8eefe78965564fa7ad65e6030c63321b3800
C:\FGCd3ONe.exe
C:\MZz4TPwI.exe
C:\BkVv7HYc.exe
C:\iypnYrjS.exe
C:\VWNLPu3F.exe
C:\KwFm_zcn.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report