MALICIOUS — 3aee4c02c0d3a11f2b3001888b8b17680e06dbe4a6abf665b77b1dc07b6d6793

MALICIOUS — 3aee4c02c0d3a11f2b3001888b8b17680e06dbe4a6abf665b77b1dc07b6d6793 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 3aee4c02c0d3a11f2b3001888b8b17680e06dbe4a6abf665b77b1dc07b6d6793
SHA-1: 5d9217e71baaa2d831a43da398ddadc81ba5ff6e
MD5: d12feeec8360307b48b02804f24324b9
imphash: e296f3e0d8a2821d5e0a3719d2e0e79d
ssdeep: 6144:oo3wBi+1Py3V0a2WkRNgi3caOHO5NjEwwiYWB5mV4Pzw9ygibGGMIC:rKf1PyKa2H3hOHOHz9JQ6zBnC
TLSH: T17C4ACF8D82F96784E7E3C7242E544F0E64F2ACDDE0BE5D440A83D02E27D291BD5D219A
Submitted as: 3aee4c02c0d3a11f2b3001888b8b17680e06dbe4a6abf665b77b1dc07b6d6793
File type: pe · Size: 453382 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (7 of 56 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
ClamAV (daily): Win.Malware.Urelas-9655843-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Trojan:Win32/Urelas!pz
Trellix Stinger (McAfee): Gupboot!D12FEEEC8360
Kaspersky (KVRT): Rootkit.Win32.Plite.pfl

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Malware.Urelas-9655843-0 (rule Win.Malware.Urelas-9655843-0) - engine signal, weight 0.90, confidence 0.95
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Gupboot!D12FEEEC8360 (rule Gupboot!D12FEEEC8360) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Rootkit.Win32.Plite.pfl (rule Rootkit.Win32.Plite.pfl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 7 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: MalwareAnalyser built-in flagged Windows_Injection_Api_Combo (rule Windows_Injection_Api_Combo) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

13108 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 5cb5ee6ba39faf16f7114a2635039d8c75d0b43aa4d9d258d178435107c55da6
C:\Users\analyst\AppData\Local\Temp\deido.exe - 46ec65b4a5f483c650ab43f911a4f0cb749c25c1c2baa098566e797056df1d5f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
20.184.175.13
52.230.59.222
52.123.252.248
4.230.171.124
52.168.117.170
52.110.12.40
52.110.12.37
135.234.160.245
57.155.101.212
172.178.240.163
20.209.154.161
135.233.45.222
72.145.35.100
52.148.114.188
92.223.78.30
52.110.12.53
52.110.12.46

File paths

X:\:`:d:h:l:p:t:x:

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report