MALICIOUS — DAoC(trainer).exe

MALICIOUS — DAoC(trainer).exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2a99f59b19bb898b801dbbcae08b035bf0a00286a23e0dc9f57f7c4347bb76c8
SHA-1: 4528304f1740b0aecd5416c52ed4309f3b8f7423
MD5: fc83951d10c1964a704cf34d266a0f5d
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1v:3
TLSH: T13D60D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: DAoC(trainer).exe
File type: pe · Size: 3527621 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 10 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1119 behavior events · 0 ATT&CK techniques · 10 dropped files.

Dropped files

C:\Windows\win32dc\UT2004_serial.exe - f33840ee2f1826398b99e0c17662af5f045ec22b044b8da610fa862a0d505677
C:\Windows\win32dc\Silent Hill 4 serial.exe - 885191dead4fe8901686494f02a0937eb25b9d9ecbe4138240aef2130126c146
C:\Windows\win32dc\Silent Hill 4_codes.exe - 430431910b8e38511e6d37c6bb590ed7592396a7499e0e91d7893a3d53d69594
C:\Windows\win32dc\DAoC + codes.exe - 3264c9c453fb125c1270984d60d26659d1bd3abe1f772f9d611a6b9899f6787a
C:\Windows\win32dc\Quake3 patch.exe - 2766f6fbf1779cb3fcac8044ca560c389d040eb169a47247c9949f37cd319bb3
C:\Windows\win32dc\Doom 3(trainer).exe - bd70c6de95e524e331c88cf5f8612d64058391526032bd2452c84cba24f6e9b8
C:\Windows\win32dc\Half-Life 2(codes).exe - 934fb8af36a05a3e339f65964f94740122d0f3734352c32bcb37ec5cacd9fc73
C:\Windows\win32dc\Half-Life 2_nocd.exe - e02f44270e7963bc15a072ef1c1efb390324167815a7091f4a894a576c5d90c3
C:\Windows\win32dc\FlatOut + patch.exe - d29f6f3d1343bdb39188e3c2dbbe76d84100287003d6872af345e99e2b18ef62
C:\Windows\win32dc\Counter-Strike(hack).exe - 4df798f6ce0673967900a34ee3afa6ece561a424a72b9132884f7f1082343e9c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787695777&P2=404&P3=2&P4=cZYB%2bNebF71mfSReewFDZzrdKmMS0e5%2fxJXNSZbX%2bLXQpEUT%2f2nxoBhxy37iWDNDjBC7YR%2bKaniItI3jhnCavQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787695845&P2=404&P3=2&P4=W9pSgWQvPTjIAsD5Wr6JKC%2bd8MDOs3MCmesPLTWHnqUcK2OhC4uun3FF3BszDcHexB8%2fZtjMqeGcog9cg6taLg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

203.26.79.13
20.184.175.13
4.144.132.223
20.42.179.204
4.230.171.124
40.84.97.4
74.178.240.61
20.184.175.2
20.165.94.54
20.236.44.162
40.99.134.18
52.123.128.14
52.123.129.14
20.184.175.15
135.234.160.244
52.123.252.232
135.233.95.80
172.83.156.122
52.148.114.188
72.153.5.135
172.175.111.170
20.184.175.19
57.155.104.224
52.110.12.19
92.223.78.30

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report