MALICIOUS — 4cc4d91b1ac1daf98fc34f34aa9316b43e3c50c21a85f6716690de885708c1fd

MALICIOUS — 4cc4d91b1ac1daf98fc34f34aa9316b43e3c50c21a85f6716690de885708c1fd is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the C83B492E family. 4 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 4cc4d91b1ac1daf98fc34f34aa9316b43e3c50c21a85f6716690de885708c1fd
SHA-1: 2ce16f3832a42419736a459662a736158990d104
MD5: 9c91a8feb014d74379d46e0a2b3db250
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dZ/BuSgEAB7uaql0AgoFG58fi7qbwo9DMUM:Qoa1taC01SRa7uB0A9GF7PxUM
TLSH: T15B5A23528B49770CE6F6C8C46C29116EC482E4E7A37C298E41CBF04EB7D796B781119B
Submitted as: 4cc4d91b1ac1daf98fc34f34aa9316b43e3c50c21a85f6716690de885708c1fd
File type: pe · Size: 1958400 bytes
Verdict: malicious (99/100) · Family: C83B492E

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

101 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\3DFE.tmp - edd13f82a1ff6f747d692c44738d507f71a8a57c81b839a93c9a6c55cc7d7b44
054cd9ec8ee449c3cfc75547e7394de748afc9db559605a8074f575d54a275a3 - 054cd9ec8ee449c3cfc75547e7394de748afc9db559605a8074f575d54a275a3

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

r.jp
schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.174
52.230.60.54
57.155.104.224
4.230.171.124
20.42.179.204
74.178.76.54
74.179.77.204
52.178.17.3
162.159.142.9
52.110.12.54
52.110.12.53
40.79.163.154
85.210.193.152
52.148.114.188
72.145.35.105
52.110.12.37
52.110.12.47

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report