MALICIOUS — 441323f68e3e7c086cd16781aeb8df2b7618a32d0c4132013e596d4eb2455eb7

MALICIOUS — 441323f68e3e7c086cd16781aeb8df2b7618a32d0c4132013e596d4eb2455eb7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Wacatac family. 4 of 55 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 441323f68e3e7c086cd16781aeb8df2b7618a32d0c4132013e596d4eb2455eb7
SHA-1: c6d5b1c62562a0b1e10d38798ba95658348afd67
MD5: 103d4644c2af89f13cdee6bc16314a67
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 384:PRilCUCfIu5jknIhSZxgOQIaaLJqJViDX:JilCUvkwZdLJqJViDX
TLSH: T1342965CF41388252C76481BA1AEC90AFAAA366E127E11D1D2D43253F740616F7CE277D
Submitted as: 441323f68e3e7c086cd16781aeb8df2b7618a32d0c4132013e596d4eb2455eb7
File type: pe · Size: 18944 bytes
Verdict: malicious (99/100) · Family: Wacatac

Detections (4 of 55 engines)

YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
capa (capabilities): capability:execution/powershell
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Kaspersky (KVRT): UDS:Trojan.Win32.Shelma.bqlw

MITRE ATT&CK

YARA

Suspicious_PowerShell_Download_Exec

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Encoded/hidden PowerShell download-and-exec (rule Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90
2 behavioral detection(s): PowerShell Encoded / Download Cradle [high] (rule tl-powershell-encoded) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 30 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted CobaltStrikeStager config (0 C2) - engine signal, weight 0.45, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9276 behavior events · 2 ATT&CK techniques · 13 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_ci2xa0mu.atc.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - ea985f7c9efce500cb16debb7e98df12e91012a117fbe2bcddd05fea46ec3587
fd4c0fea7baf06bfef0bfc424f372c33ee19d01900b7f637a23d18e96ad61b03 - fd4c0fea7baf06bfef0bfc424f372c33ee19d01900b7f637a23d18e96ad61b03
1a2ca27042e285eab843d420a3e2ce3846e8e04e0329413015b018b340a3ec11 - 1a2ca27042e285eab843d420a3e2ce3846e8e04e0329413015b018b340a3ec11
cfb44ec7e0e5651127da336716b1c799ebb41ac4cda50f672eca9354bf7e5d19 - cfb44ec7e0e5651127da336716b1c799ebb41ac4cda50f672eca9354bf7e5d19
851505d650b698df5996b15b0ff9a3f0e685e9e759f90cdc6d396dab8cfe9b50 - 851505d650b698df5996b15b0ff9a3f0e685e9e759f90cdc6d396dab8cfe9b50
28a1135935d06b723a968f96642103fbc8efd8738c49d9acebb9187125fbe707 - 28a1135935d06b723a968f96642103fbc8efd8738c49d9acebb9187125fbe707
8193589a8e86416c83227718a5e50257135c7930d78b8b718e65034b158d5030 - 8193589a8e86416c83227718a5e50257135c7930d78b8b718e65034b158d5030
449b3de67a621a7e3fd9f45f51cb7a28ee34557402c9e3b5367ca88acc8bd91b - 449b3de67a621a7e3fd9f45f51cb7a28ee34557402c9e3b5367ca88acc8bd91b
b1378f1676a82b50080e6c42a15fc72401290381a4addb61873d2e905a236dc1 - b1378f1676a82b50080e6c42a15fc72401290381a4addb61873d2e905a236dc1
0be83f2ce81c35101d41449accdd0205c51c20f7882727ae1ca1619f4ed3e950 - 0be83f2ce81c35101d41449accdd0205c51c20f7882727ae1ca1619f4ed3e950
a651eb9e6ab26d0ade66bef8173133b324534fdf64f719fdf4870343b908cf8d - a651eb9e6ab26d0ade66bef8173133b324534fdf64f719fdf4870343b908cf8d
d2f286d154d4a30dfd33c0d8f76052083a9b8e6aa9651a3cb0a549780ce15307 - d2f286d154d4a30dfd33c0d8f76052083a9b8e6aa9651a3cb0a549780ce15307

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787890859&P2=404&P3=2&P4=QMdJgzyS6tZWkV%2bgL9933Zww5XWM46Vv7gdDnYl1mif%2bg%2bryHJ%2bDP2yAJvWygdm85vDTNstTnDNt9%2biWBni%2fpw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787890978&P2=404&P3=2&P4=nab9htBmh%2bWLr1cKWxQqDUQ1f9O4ciSo1Y%2bMOhCTtZddrxRGjyZZ9o3bMz0ZrA9FUtYj5kSNTcqOXAtqaM3jcQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.207.44.70
52.123.252.193
57.154.63.210
4.230.171.124
20.247.185.124
135.233.95.144
20.184.175.11
74.178.240.51
74.178.240.61
40.99.133.242
20.76.201.171
52.123.129.14
52.123.128.14
40.99.134.2
172.66.2.5
52.123.252.213
135.234.160.246
203.26.79.13
20.184.175.7
20.184.175.17
52.110.12.33
52.110.12.31
52.148.114.188
52.123.252.203
135.233.95.80

File paths

C:\Users\Yusif\source\repos\FUDDED\FUDDED\obj\Release\FUDDED.pdb

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report