MALICIOUS — 44ea7c4e7324210f2279d5bb641b33650c2f149042dd6dc89b8f8643c54d1de0

MALICIOUS — 44ea7c4e7324210f2279d5bb641b33650c2f149042dd6dc89b8f8643c54d1de0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 44ea7c4e7324210f2279d5bb641b33650c2f149042dd6dc89b8f8643c54d1de0
SHA-1: 9244cff5794874bcf7a522659278b50cda202b31
MD5: 265f1da00423cd7481e94e6c68cd962d
imphash: da966feef96864354f81cb34172f60fc
ssdeep: 768:0Z2iWT8yyWJNiX/LGGE+sSTrwpXbuLRCShk7uvVqtG:0Z2iW/NJNETGGvsSQVbV7y+G
TLSH: T1AE3D9DC990711BE6D3A75861FA72DD2E40E2B4F648E8F44E5C8E8C6A4CD1B237C75428
Submitted as: 44ea7c4e7324210f2279d5bb641b33650c2f149042dd6dc89b8f8643c54d1de0
File type: pe · Size: 132990 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Downloader.Upatre-7374321-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: TrojanDownloader:Win32/Upatre.AK
Emsisoft (Emergency Kit): Gen:Heur.Pack.Emotet.1
Kaspersky (KVRT): not-a-virus:HEUR:AdWare.Win32.DLDLMN.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Downloader.Upatre-7374321-0 (rule Win.Downloader.Upatre-7374321-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Upatre.AK (rule TrojanDownloader:Win32/Upatre.AK) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Pack.Emotet.1 (rule Gen:Heur.Pack.Emotet.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged not-a-virus:HEUR:AdWare.Win32.DLDLMN.gen (rule not-a-virus:HEUR:AdWare.Win32.DLDLMN.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10353 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ukyfact.exe - ea42be948129b792dc14311c208eead945ac838e25137614e6c8cf01164f9c80
3cc49aa7d04f4fd0a361f393b5378d5eb0b9282113976ad76b7edb75cbcd5a5e - 3cc49aa7d04f4fd0a361f393b5378d5eb0b9282113976ad76b7edb75cbcd5a5e
b4768d7d80f72f928287f42d7dedd403eb4e9ef99ebcca5c84e6fa5e0727486e - b4768d7d80f72f928287f42d7dedd403eb4e9ef99ebcca5c84e6fa5e0727486e
2fbc0e68a0fdb81f1c55e3a4307cf0fd172b7a5ece9221691a9011429b9e8f3d - 2fbc0e68a0fdb81f1c55e3a4307cf0fd172b7a5ece9221691a9011429b9e8f3d
871712d405828bfad07665b2069c313a8b1bb7957ae2a3cbe1fd7e1caa0a9a43 - 871712d405828bfad07665b2069c313a8b1bb7957ae2a3cbe1fd7e1caa0a9a43

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.107
4.230.171.124
52.230.59.222
135.232.92.97
172.215.188.232
40.74.98.197
135.233.95.144
92.223.78.30
20.184.175.19
20.42.73.24
135.233.45.222
40.84.85.40
72.154.7.103
52.148.114.188
52.110.12.16
52.110.12.14

File paths

C:\rs7FEHi6.exe
C:\ZUupDJG2.exe
C:\L8oAWQwY.exe
C:\trHMfwjY.exe
C:\P3FbANcA.exe
C:\g5UFwmvO.exe
C:\MdhBRnK8.exe
C:\Ej9r8IcJ.exe
C:\WBHWJajk.exe
C:\VV4SLJ57.exe
C:\hEV5CaNy.exe
C:\fc44f2082489057b62fd3e7ca4a62a5f8446c178d399f34170d81b2314a3468b
C:\75b824851069d851b6f4e634c2bf1375d77380ba10d9084245d24ae0618a8c99
C:\Users\george\Desktop\ukyfact.exe
C:\Users\admin\Downloads\ukyfact.exe
C:\Users\admin\Downloads\24e83bf51c97c6492f652da475fe3ea6560eccd100774bbbe2f587c9185876b9.exe
C:\Users\admin\Downloads\4ac691cc664ae4e3c99ab5193f85c08f4fd0fb5ea3bbf4693d4524e599158b7b.exe
C:\ee6a6c986fbc50d238bc61311eafd2e509f43fb8f4c16df72e6497806d58287a
C:\f3b5fbc6bed28055c388c5b3050f293595ce0c417b5ffcccc4d36f5ccc314eb0
C:\47f23dde8e027ba582024aa41205689776efe6e39d698c9d3e7f9c67be14438b
C:\b9f16ffaf0e2cea835d24a7a8e057a4d0bcc24809f6eb3aee5f7130f9a2c4e72
C:\a78PpvkD.exe
C:\Users\george\Desktop\program.exe
C:\Users\admin\Downloads\541ae59f67523adeb4b312b8019d19bb0c6273180a3cd6901d3e719b418fdb08.exe
C:\fQF9mXqe.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report