MALICIOUS — 37c16d4d36cfacc3442591f1db290cf15fcfd63b4c9e04035c3be6aa169534c2

MALICIOUS — 37c16d4d36cfacc3442591f1db290cf15fcfd63b4c9e04035c3be6aa169534c2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 37c16d4d36cfacc3442591f1db290cf15fcfd63b4c9e04035c3be6aa169534c2
SHA-1: 63f77283a61c1412a316e3ea90bfb1b1613fedb0
MD5: befcf7ba635be1446e5c55bf10f860aa
imphash: 8e292b790289a0603d2b2162d0b61b38
ssdeep: 6144:WxBWeMRygxDLbHxlSBxzJT1REBB6q1gBFJV6AvRqsf6YU+FM+3Yn/fCXjQGDqA2b:m3MQIDKJXTq+Xxvo0U+d3s/fCX0Lb
TLSH: T1F74BCE9982B1A3C4EAF797301E605E1E20E25CEED0BF1C940383D11D63E295BD6D525B
Submitted as: 37c16d4d36cfacc3442591f1db290cf15fcfd63b4c9e04035c3be6aa169534c2
File type: pe · Size: 498797 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Packed.Urelas-10012479-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Trellix Stinger (McAfee): Gupboot!BEFCF7BA635B
Kaspersky (KVRT): Backdoor.Win32.Plite.bhus

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Packed.Urelas-10012479-0 (rule Win.Packed.Urelas-10012479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas (rule Trojan:Win32/Urelas) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.SP.Urelas.1 (rule Gen:Heur.Mint.SP.Urelas.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Gupboot!BEFCF7BA635B (rule Gupboot!BEFCF7BA635B) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Plite.bhus (rule Backdoor.Win32.Plite.bhus) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 121.88.5.183, 121.88.5.184, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

15604 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 908913d505f46234387b12919a14c3aaf34a64ead78839e475b4058f7f0b8f79
C:\Users\analyst\AppData\Local\Temp\zavok.exe - 8b3b01e5be1fced9d36457350fb00f5d04cf4ae833bac8343b7b363e0808494a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

121.88.5.183
121.88.5.184
218.54.31.226
218.54.30.235
40.79.167.10
20.247.185.124
4.230.171.124
104.18.33.89
52.110.12.14
52.110.12.22
172.178.240.163
20.42.179.204
57.155.101.212
72.154.7.108
52.148.114.188
52.110.12.3
52.110.12.56

File paths

D:\PMS\pms4\Project(20131120)\GolfProject\bin\GolfProject.pdb

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report