MALICIOUS — 3b5ab24e243731d9969f9414dbc74c27734a51b841867c0f023dfda1b5d860fa

MALICIOUS — 3b5ab24e243731d9969f9414dbc74c27734a51b841867c0f023dfda1b5d860fa is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Urelas family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 3b5ab24e243731d9969f9414dbc74c27734a51b841867c0f023dfda1b5d860fa
SHA-1: b3e2a1250ad226b5ff0288178f7ceecb97b189e6
MD5: be3a03dc6bc363d18a7083768b0347df
imphash: f5fbf8ad25d2fe46dca8cfa257d1b253
ssdeep: 12288:4yPHijVSuJqu4kw6eDPvjJ81VGqK6GvP4:4uCTq4w6or+Gnw
TLSH: T1BC4ACF99C2F1A3C4EBF797205E109E4E20E26CDDE0BE4CD84683D11DA2E2D5BD1D125A
Submitted as: 3b5ab24e243731d9969f9414dbc74c27734a51b841867c0f023dfda1b5d860fa
File type: pe · Size: 458356 bytes
Verdict: malicious (99/100) · Family: Urelas

Detections (6 of 55 engines)

ClamAV (daily): Win.Packed.Mikey-9645700-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Trellix Stinger (McAfee): BackDoor-FBLQ!BE3A03DC6BC3
Kaspersky (KVRT): VHO:Backdoor.Win32.Plite.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Mikey-9645700-0 (rule Win.Packed.Mikey-9645700-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

23968 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 0011c0925b544846e042ddf9dde179da4d371b25685ee86680f8f9679bdca1aa
C:\Users\analyst\AppData\Local\Temp\nukow.exe - 2a56206072149f7e8262bf7053919c294e3eccd775a921db23bb946eaa54ba50
C:\Users\analyst\AppData\Local\Temp\nukow.exe - 4b337d81f3a2e6045ce139aae6b3dd56acdc12d7cca54416c315f383cd22113c
C:\Users\analyst\AppData\Local\Temp\pywuh.exe - e776eaff4366f0d9ee6944204efd7063283170a4d987035b764e29f5f87b97bc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787868085&P2=404&P3=2&P4=kHdBAoYL%2bh9BgztXBrVyBgulfO3toRCwAUoOZDql4T8cnceiDsdqdMwuBTCXCtO0Svippa1TwTUYHICzeobegg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787868170&P2=404&P3=2&P4=Sz7Q4hicj9GU4hmOflJ%2bnXQqpbeUPvDOLqug8krZN3f0nS8e5KAquOLbnasMYvZaGHcapmt1jJQt0c6io7Oacw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
4.150.223.102
4.144.132.223
20.42.179.204
4.230.171.124
20.165.94.63
20.42.72.131
20.231.239.246
52.123.129.14
74.178.240.51
20.184.175.18
135.233.45.222
172.178.240.163
162.159.142.9
203.26.79.13
52.148.114.188
52.123.252.243
74.178.232.29
52.123.252.231
72.145.35.107
52.110.12.26
52.110.12.22

File paths

X:\:`:d:h:l:p:

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report