MALICIOUS — 49ac89d55d514221bce6659d78869d8a72aad6174242f47e959164e44ae075e5

MALICIOUS — 49ac89d55d514221bce6659d78869d8a72aad6174242f47e959164e44ae075e5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 3 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 49ac89d55d514221bce6659d78869d8a72aad6174242f47e959164e44ae075e5
SHA-1: 3df5fe055b9980582c5e521e087e7c3bc9570330
MD5: 106e810742df4e6e678ae271bdb5fd54
imphash: d289668dfc2163a8d7ebe8a066b87241
ssdeep: 98304:JF9oIOkjRTrH0/PiQCQf7/0Bt1LwHVirhDkztpvrajOK3vYXnDB7C:xoIljRr1QCe/0B/wwrhAztpzanMO
TLSH: T16C6333B7C5E6E18DE170BA114D5E5E4F84B696F3143A90C5ACB3C2AC7E5301BAC24236
Submitted as: 49ac89d55d514221bce6659d78869d8a72aad6174242f47e959164e44ae075e5
File type: pe · Size: 4830031 bytes
Verdict: malicious (100/100) · Family: RedLine

Detections (3 of 56 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: flagged
Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Reline.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

Extracted RedLine config (1 C2) - engine signal, weight 0.80, confidence 0.90
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-PSW.MSIL.Reline.gen (rule UDS:Trojan-PSW.MSIL.Reline.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
2 IDS alert(s): ThreatLens Pastebin exfil/stager lookup - network signal, weight 0.50, confidence 0.80
2 behavioral detection(s) across 2 rule(s): Scheduled Task / Job [medium] (rule tl-scheduled-task) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

19528 behavior events · 2 ATT&CK techniques · 20 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Microsoft\services.exe - 979477de921953f5a3ac1e19f625bcdaac2e2a7f0b27c044122e42f83b66d088
C:\Users\analyst\AppData\Roaming\Microsoft\Libs\WR64.sys - 11bd2c9f9e2397c9a16e0990e4ed2cf0679498fe0fd418a3dfdac60b5c160ee5
C:\Users\analyst\AppData\Roaming\Microsoft\Telemetry\sihost64.exe - 5ccbc06175d382e358a64758fc166d4868fe06fe28643be8a354fa35bb296e5f
C:\Users\analyst\AppData\Local\Temp\UpdateChecker.exe - 2a8cd61007b4b4a7d71d6ce2ecb22cd2194f5ac2d803726cb7426ebc3fa92776
7be4baa01a538a08c2e28ae56836ac33e259088c8f6d8b011d9f3786c4ee5e1f - 7be4baa01a538a08c2e28ae56836ac33e259088c8f6d8b011d9f3786c4ee5e1f
ac3039d9c4c21854344fc759ffd5b5d23ded11558e0a5b90ee312a43e84746cd - ac3039d9c4c21854344fc759ffd5b5d23ded11558e0a5b90ee312a43e84746cd
c74ffca50f777a69336ca378ea7e847cbaf11b3daa61ee1b337ca697bb4497e5 - c74ffca50f777a69336ca378ea7e847cbaf11b3daa61ee1b337ca697bb4497e5
f6b950ffefed7e7c31d4c99752d98561c530aa60a5fa3eabec58ff221c8766f1 - f6b950ffefed7e7c31d4c99752d98561c530aa60a5fa3eabec58ff221c8766f1
a785b2c0eb6beddd72a73e7ffe58d96734577ecd408f237ae0bee979b5e2c2de - a785b2c0eb6beddd72a73e7ffe58d96734577ecd408f237ae0bee979b5e2c2de
804b8cd6a4479099715df026aa5511c1b2b08ded43955a73683e277e1789f14e - 804b8cd6a4479099715df026aa5511c1b2b08ded43955a73683e277e1789f14e
51b92042bcb3e80a0f42ffe1c169ca69d5cf8b9a98ff717f6a9da61e63359304 - 51b92042bcb3e80a0f42ffe1c169ca69d5cf8b9a98ff717f6a9da61e63359304
81f16574a1740ec586e6418d8a92eeedbfcf443d95925c4cfd111431bf47f200 - 81f16574a1740ec586e6418d8a92eeedbfcf443d95925c4cfd111431bf47f200
16248b92a35c8042afbd4065301b4ef397d995728363d83a04fc4b0ba50bfddc - 16248b92a35c8042afbd4065301b4ef397d995728363d83a04fc4b0ba50bfddc
9c11dec5b833a7ffdc466f271f584ef98721b8e26ded85e9ed5d1185befa19be - 9c11dec5b833a7ffdc466f271f584ef98721b8e26ded85e9ed5d1185befa19be
0192d741db7ef8286e1e3da9b90049aaf9d9bd2d846f4767b3e4e781e5a415d8 - 0192d741db7ef8286e1e3da9b90049aaf9d9bd2d846f4767b3e4e781e5a415d8

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
1.ch
8r.us
xmr-eu1.nanopool.org
pastebin.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.96
4.144.132.114
4.230.171.124
172.64.154.167
52.110.12.10
52.110.12.56
51.178.13.99
172.66.171.73
135.234.160.244
20.42.179.204
52.148.114.188
92.223.78.30
72.145.35.110
52.110.12.15

File paths

d:\Projects\WinRAR\SFX\build\sfxrar32\Release\sfxrar.pdb

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report