MALICIOUS — 407436519b513e3fc16c7685bba2ebeec13178cbfc34f1ad20cb28c336a66992

MALICIOUS — 407436519b513e3fc16c7685bba2ebeec13178cbfc34f1ad20cb28c336a66992 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 407436519b513e3fc16c7685bba2ebeec13178cbfc34f1ad20cb28c336a66992
SHA-1: 0e0b74b8e4cfbd8e3db0f6b7bdc48c89beb233eb
MD5: 4310aa6e289e0d3ecc38ac7fef844737
imphash: 372467513fc37686aa91f0703e76e7b1
ssdeep: 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohph:8IfBoDWoyFblU6hAJQnOF
TLSH: T19B49BE1CC2F26785EAF793202E508F0E74E25CDED0BE4C984793D15D26E259BE2C512A
Submitted as: 407436519b513e3fc16c7685bba2ebeec13178cbfc34f1ad20cb28c336a66992
File type: pe · Size: 415905 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (6 of 56 engines)

ClamAV (daily): Win.Trojan.Urelas-9635181-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas.WE!MTB
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Trellix Stinger (McAfee): Corrupt-FY!4310AA6E289E
Kaspersky (KVRT): Backdoor.Win32.Plite.bhty

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-9635181-0 (rule Win.Trojan.Urelas-9635181-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas.WE!MTB (rule Trojan:Win32/Urelas.WE!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.SP.Urelas.1 (rule Gen:Heur.Mint.SP.Urelas.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Corrupt-FY!4310AA6E289E (rule Corrupt-FY!4310AA6E289E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Plite.bhty (rule Backdoor.Win32.Plite.bhty) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

40325 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\jomig.exe - c0a32fe86168dafdfa71996b62ebffe945891734217e8c34f84ec1f935b0abc3
C:\Users\analyst\AppData\Local\Temp\kidom.exe - 12204e871eaf8083a0d31d29de81385121bfcd919108980a640af809592eea5d
C:\Users\analyst\AppData\Local\Temp\reawni.exe - 22abf8297cc3c5c2cbcfa33476dba79ba0bb2aadaf2d75622562a8596c2428a7
C:\Users\analyst\AppData\Local\Temp\jomig.exe - 47784d057eddd2b94034d0a8d9162ac3224321925efbc8bca09777c33183d551
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - c3e9664b5470019989502edab738eb3507edecd27145c3ad57aec1a638cb298d
08bf8abfaede3d7c4bd52a7e1cb1ab0d905c6f27fd121651b4129a0c2fa2846b - 08bf8abfaede3d7c4bd52a7e1cb1ab0d905c6f27fd121651b4129a0c2fa2846b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
20.42.73.26
52.253.84.76
4.230.171.124
20.42.179.204
135.234.160.245
172.215.188.232
48.211.4.16
52.110.12.47
52.110.12.51
52.148.114.188
72.145.35.105

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report