MALICIOUS — 3951bebe2e7282ccd136e97a0b68b3d120357c42796d6d85ddf8d2c382ce0ecd

MALICIOUS — 3951bebe2e7282ccd136e97a0b68b3d120357c42796d6d85ddf8d2c382ce0ecd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Salgorea family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 3951bebe2e7282ccd136e97a0b68b3d120357c42796d6d85ddf8d2c382ce0ecd
SHA-1: 6193a9d49160e7abb25c026683281cc8abe39e96
MD5: ed764e2c3481fa110708b971c469174b
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:OFUcx88PWPOpX0SFDHxANPV/Z2oNhbzU70gVQ/xLSHhyGc:O+K88uPCHxHKNdRbNNg4gVWLUhyGc
TLSH: T1685A22C51A198B0CEBF6D95038293A6EC542F4E15778598A818FF01E33DB437B4721AB
Submitted as: 3951bebe2e7282ccd136e97a0b68b3d120357c42796d6d85ddf8d2c382ce0ecd
File type: pe · Size: 2089472 bytes
Verdict: malicious (100/100) · Family: Salgorea

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Trojan.GenericKDZ.110085
Kaspersky (KVRT): Backdoor.Win32.Salgorea.ie

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKDZ.110085 (rule Trojan.GenericKDZ.110085) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Salgorea.ie (rule Backdoor.Win32.Salgorea.ie) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12996 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c:\users\analyst\appdata\local\temp\tsk_5513990098354096.docx - f0c1b360c0b24b5450a79138650e6ee254afae6ce8f6c68da7d1f32f91582680
C:\Users\analyst\AppData\Local\Temp\1911.tmp - 7253c39d5d52e13279d80327b0db6f5ccb377ce33023540390c472f180dc56d5
22c297c97a7d25fc659872dbcfa6584901a57024791657ac3edd727232005444 - 22c297c97a7d25fc659872dbcfa6584901a57024791657ac3edd727232005444

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

d.es
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
oneclient.sfx.ms

Embedded IP addresses

20.184.175.19
4.230.171.124
40.84.85.40
40.84.97.4
74.178.76.54
135.232.92.137
20.50.80.215
4.144.132.114
52.110.12.44
52.110.12.16
135.234.160.245
92.223.78.30
172.215.188.232
52.182.143.212
52.148.114.188
172.215.188.225
51.104.15.252
57.155.101.212
52.123.252.224
52.123.128.14
172.172.255.216
72.145.35.101
52.110.12.48

File paths

k:\x5x^

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report