MALICIOUS — 3416791d4ce4dc90fee8a5440cab10ae2a2909dd8b6039258b43c5379d1fab13

MALICIOUS — 3416791d4ce4dc90fee8a5440cab10ae2a2909dd8b6039258b43c5379d1fab13 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Bublik family. 8 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 3416791d4ce4dc90fee8a5440cab10ae2a2909dd8b6039258b43c5379d1fab13
SHA-1: 1ef5881d735f4e0a3bf2ffb1687bb7423b8f6b65
MD5: cbe71ff6028d7f7d77d7c751d3f28b98
imphash: 2eb47895ee25649cf9e79d6e6127836a
ssdeep: 1536:WZFJTafg3hnfq4yyFB1iRT9bPKzvcOZ70AKgN:2FGgRfqIF
TLSH: T16836DEDD42BC1F26C33A04E51772E95FA1ABF0E11D9D71161949603E80C78A3AE22E77
Submitted as: 3416791d4ce4dc90fee8a5440cab10ae2a2909dd8b6039258b43c5379d1fab13
File type: pe · Size: 69352 bytes
Verdict: malicious (100/100) · Family: Bublik

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Windows Authenticode
ClamAV (daily): Win.Malware.Bublik-9948473-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Windows Authenticode
Microsoft Defender: PWS:Win32/Zbot.AF!MTB
Emsisoft (Emergency Kit): Gen:Variant.Ransom.Loki.2724
Trellix Stinger (McAfee): PWSZbot-FIT!CBE71FF6028D
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Bublik-9948473-0 (rule Win.Malware.Bublik-9948473-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged PWS:Win32/Zbot.AF!MTB (rule PWS:Win32/Zbot.AF!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ransom.Loki.2724 (rule Gen:Variant.Ransom.Loki.2724) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWSZbot-FIT!CBE71FF6028D (rule PWSZbot-FIT!CBE71FF6028D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 10 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Windows Authenticode (rule DIE:Windows Authenticode) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Windows Authenticode (rule Windows Authenticode) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: Windows Authenticode - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13221 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\retro.exe - 9c193ea6b206f0f17f784ee582d36b4655738fe339cfda157c1f308450d6fca8
d2d396734d79a53035a50430a7eec25db155226b256169bbdb5a1cfcbd656a00 - d2d396734d79a53035a50430a7eec25db155226b256169bbdb5a1cfcbd656a00
304927e906a5de1fb9c7a629ed68a8e161d4b16d0fcee80bb3c7dbe5d491fe60 - 304927e906a5de1fb9c7a629ed68a8e161d4b16d0fcee80bb3c7dbe5d491fe60
56a3d7d0d445d60337d691e3bd7baab04e9ac1cf0be57d118abf0faabd579552 - 56a3d7d0d445d60337d691e3bd7baab04e9ac1cf0be57d118abf0faabd579552
e58dddd047760a2050ee7b1a36960d1ceba1cda4c2c67f67df3b5b229952eca4 - e58dddd047760a2050ee7b1a36960d1ceba1cda4c2c67f67df3b5b229952eca4
ff9674370d9b2923fc93a58a20d73f1323996d9521b0ea1919bd974e854adb9f - ff9674370d9b2923fc93a58a20d73f1323996d9521b0ea1919bd974e854adb9f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://yr.c.lencr.org/
http://yr2.c.lencr.org/27.crl

Embedded domains

concepthomesuk.com
bigonheating.com
groupesorepco.com
x1.c.lencr.org
yr.c.lencr.org
yr2.c.lencr.org

Embedded IP addresses

184.84.165.168
20.184.175.5
4.155.95.248
52.123.252.230
4.230.171.124
104.18.33.89
74.178.76.54
85.210.196.11
74.179.77.204
20.42.73.30
52.168.117.170
46.32.240.37
135.233.45.223
135.234.160.245
72.153.5.134
173.209.36.35
52.148.114.188
104.18.21.213
52.110.12.22
52.110.12.48

File paths

C:\66799e92d92e661
C:\Users\Lisa\Desktop\0VuTYzZe.exe
C:\b50b3f82a63cb22e0daa83a0be40d7827301d502652c94b198f4d5ea3f7a7c49
C:\Users\Lisa\Desktop\fNpaslUQ.exe
C:\997872bc0a5669f3ec39561b305d8c4c3eb1723a9aba47eb049e4968d338b4eb
C:\FN1DqXoh.exe
C:\56b021621d3d11c024e04464372b9f698100f2f9611886a3e90907af40817756
C:\9eb5ee606e4365ba82dc2dc50848b815d176eae8e809d9d87307a02261a7a01b
C:\Documents
C:\5faf31f47613880612b6a7d37fc86e2766237027f236543b1801b52fd5d5b3c3
C:\Users\Lisa\Desktop\Y7OCm8AC.exe
C:\jP0KQx_D.exe
C:\d40f9a6dc6b05f43edbb3f1808fdcb0a2f2506141416c141df55cec56825e55c
C:\f5d6fd5afdc44c6d553ea721bc3ced0c5baedb36381618b63dd15731eaa6933d
C:\3a06be49a19e1e4d28703768c42fadce616eec9f0d093737bdded61a66fe4ab6
C:\f1004ab8df274481cf58e4687e3bbd7b27649b59920756b460942d127d23236c
C:\guMPq4bR.exe
C:\9d5cd452687917c34c8ab7e28d23684647a9de4f88b1b5184313879fb1619e2d
C:\b33b4e49d76dcb0903a5fc84033fba5d239807df5bf5672311c24f95b7851364
C:\ZyIcY4bY.exe
C:\79e2ffb3dbde0e4b1e291503cadb38ef3d42174ddcf21a4f2cdbc880a0fd8830
C:\j2NxJiFs.exe
C:\db0ce11af3ac948bc982a648dbe57ac9fb3ab1b60da452e38dd1379d20383fbb
C:\DwjW1VaO.exe
C:\a7f87530943ab3b8851619d9e7ef41ce7bcdb25391b24e896c48328d783f049b

More Bublik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report