MALICIOUS — 421375136a67c5ed92b31b5a5dc8050f425ccea24d38900223ed30d5f9ff4afe
MALICIOUS — 421375136a67c5ed92b31b5a5dc8050f425ccea24d38900223ed30d5f9ff4afe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the C83B492E family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
421375136a67c5ed92b31b5a5dc8050f425ccea24d38900223ed30d5f9ff4afe - SHA-1:
29309bc92bb2d24f57cfcba294645884ff6f5708 - MD5:
7327729e0690350276b942f6a23c2b20 - imphash:
95122753ea27818b35f9b51859e4c692 - ssdeep:
49152:Qoa1taC070dQwfxbwMUos3dfQCh0hm6kfHz:Qoa1taC0P643NP0hm6kfHz - TLSH:
T1DD5A2396520D6B09E6FAC4443C59136E8081E8F7A33C198B938FF02E77D796778111AB - Submitted as: 421375136a67c5ed92b31b5a5dc8050f425ccea24d38900223ed30d5f9ff4afe
- File type: pe · Size: 1958400 bytes
- Verdict: malicious (99/100) · Family: C83B492E
Detections (4 of 56 engines)
- ClamAV (daily): Win.Malware.Zusy-9764479-0
- Microsoft Defender: Trojan:Win32/Salgorea!pz
- Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
- Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule
Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule
Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule
Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule
Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 22 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule
windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
13969 behavior events · 2 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 252.0.0.224.in-addr.arpa.
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- nexusrules.officeapps.live.com
- 194.110.171.150.in-addr.arpa.
- c.pki.goog
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- ctldl.windowsupdate.com
- yr.c.lencr.org
- 54.133.221.23.in-addr.arpa.
- 172.30.101.151.in-addr.arpa.
- 106.238.33.23.in-addr.arpa.
- 195.25.217.172.in-addr.arpa.
Dropped files
- C:\Users\analyst\AppData\Local\Temp\D2E0.tmp -
cf9ff42ba30689e124197262b0d5374ceceb108248cbb281c14e6e3577e28d89 - e4dbac2ebecd64793775e938d2a71b00cd8c48f629d18e0804a28c13591abe72 -
e4dbac2ebecd64793775e938d2a71b00cd8c48f629d18e0804a28c13591abe72
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- 3.ir
- schemas.microsoft.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 52.168.112.66
- 20.184.175.1
- 72.153.5.139
- 20.42.179.204
- 72.145.35.97
- 52.148.114.188
- 4.150.223.105
- 51.105.71.136
- 4.150.223.107
- 135.234.160.244
- 52.168.117.175
- 4.207.44.74
- 72.145.35.96
- 72.145.35.103
- 52.168.117.170
- 172.172.255.217
- 4.150.223.97
- 52.178.17.234
- 172.172.255.216
- 52.178.17.3
- 172.215.188.232
- 52.110.12.14
- 172.178.240.162
- 20.247.184.142
- 52.123.252.238
File paths
- q:\@y
More C83B492E samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report