MALICIOUS — 3c1276685de2da80b6d180068ad1886d7f71bcfc4333c4ba65b48752ff298980

MALICIOUS — 3c1276685de2da80b6d180068ad1886d7f71bcfc4333c4ba65b48752ff298980 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 3c1276685de2da80b6d180068ad1886d7f71bcfc4333c4ba65b48752ff298980
SHA-1: 6b21b71fe12fa23dd6664ea14d442ac839d28334
MD5: e166baf50554cd52be5b51ae0465d0e7
imphash: 6cd33c9988d6dec5c2c0f68a9a33b9d4
ssdeep: 196608:OmzMo/yccltyjIhzMo/yccltyjt/zMo/yccltyjc:jzh/ycytvzh/ycytwzh/ycyt7
TLSH: T1A66A3355E27B85B3F2A5F064D4DA793ECE5427ADDF8E5412D50286DB00E03330AEAD0A
Submitted as: 3c1276685de2da80b6d180068ad1886d7f71bcfc4333c4ba65b48752ff298980
File type: pe · Size: 9697808 bytes
Verdict: malicious (100/100) · Family: RedLine

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Packed.Aujdijdg-9909760-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Variant.Midie.168070
Kaspersky (KVRT): HEUR:Trojan.Win32.APosT.pef

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Packed.Aujdijdg-9909760-0 (rule Win.Packed.Aujdijdg-9909760-0) - engine signal, weight 0.90, confidence 0.95
Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Vindor!pz (rule Trojan:Win32/Vindor!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Midie.168070 (rule Gen:Variant.Midie.168070) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.APosT.pef (rule HEUR:Trojan.Win32.APosT.pef) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1497.001, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , , , , ,.boot,.rsrc1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

18106 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\ProgramData\Synaptics\Synaptics.exe - e83e445c7c3f58be2d5e5bb8b4f1872a574c036349190c9aee0cd0fd06b3dc61
C:\Users\analyst\AppData\Local\Temp\._cache_tsk_30c66996edea45f2.exe - 5db4d109af34341f641ce3ed1e82c644c1c46be3195f5cd2f55c764592f3597b
97eb6ac81c40e74ddf92d4b4e11d2e3b876d6f0f79fe74dc33a50c58e70268d3 - 97eb6ac81c40e74ddf92d4b4e11d2e3b876d6f0f79fe74dc33a50c58e70268d3
fdf75128d507c4b0caa124b1616f774f78a7841a4f96a1b1c9de5105b7c83f1f - fdf75128d507c4b0caa124b1616f774f78a7841a4f96a1b1c9de5105b7c83f1f
0baa3587b368377cb6da15b9ddecd913f63712f9b92af4eff849bd526d856577 - 0baa3587b368377cb6da15b9ddecd913f63712f9b92af4eff849bd526d856577

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

05.me
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
xred.mooo.com
freedns.afraid.org

Embedded IP addresses

51.11.192.48
52.123.252.242
4.230.171.124
172.215.188.225
20.247.185.124
135.233.95.144
135.233.95.135
20.42.65.93
20.42.65.85
104.18.33.89
135.233.45.221
172.66.2.5
20.89.1.13
4.150.223.104
67.220.81.150
52.148.114.188
57.154.63.210
40.84.97.4
72.145.35.111
52.110.12.55
52.110.12.28

File paths

t:\Qm

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report