MALICIOUS — 297198e6d50620288014600e30f05d14a5f2fd037952bdc2222bc9dbb4d5355f

MALICIOUS — 297198e6d50620288014600e30f05d14a5f2fd037952bdc2222bc9dbb4d5355f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Infostealer family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 297198e6d50620288014600e30f05d14a5f2fd037952bdc2222bc9dbb4d5355f
SHA-1: 7997a56d3ab7dc4e0d5b5ca29725eb2b2bf36f3a
MD5: b7359296cc646185a7cf3a9f632f6c0b
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 192:PBksuL9MuIjIeMZZ3y93Vnjdwqzr3vjO:gluIeMmFnhwq3fj
TLSH: T1F0220BDF5A5C9B83CE7EE51B61518A3D6480749B38F63A8C05004B33547882798BE7EB
Submitted as: 297198e6d50620288014600e30f05d14a5f2fd037952bdc2222bc9dbb4d5355f
File type: pe · Size: 9728 bytes
Verdict: malicious (99/100) · Family: Infostealer

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Msilkrypt-9839010-0
Microsoft Defender: PWS:MSIL/Infostealer.PAC!MTB
Emsisoft (Emergency Kit): Gen:Trojan.Mardom.PN.16
Kaspersky (KVRT): HEUR:Trojan.MSIL.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Msilkrypt-9839010-0 (rule Win.Malware.Msilkrypt-9839010-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://tempuri.org/IUserService/GetUsersT, http://194.87.145.184:6484/UserService, 194.87.145.184 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3947 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://tempuri.org/IUserService/GetUsersT
http://194.87.145.184:6484/UserService
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787808937&P2=404&P3=2&P4=jaZ5p5WmZeD41UFMA0LcL9RJcsMhGFp8etqRRhDhS8rOFFAfjFfWMED4Xnwf2AcOYXL3hMrPMg9k9CXw0WYbkQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.datacontract.org
tempuri.org

Embedded IP addresses

194.87.145.184
4.150.223.115
52.123.252.246
20.42.179.204
20.247.184.142
4.230.171.124
20.165.94.63
51.116.253.168
20.165.94.54
135.233.95.144
20.231.239.246
40.99.133.226
52.123.128.14
52.123.129.14
20.184.175.4
203.26.79.13
172.178.240.163
135.233.95.80
135.233.45.221
72.154.7.109
52.110.12.14
52.148.114.188
52.110.12.42
125.56.205.105
125.56.205.17

More Infostealer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report