MALICIOUS — B14299FD4D1CBFB4CC7486D978398214

MALICIOUS — B14299FD4D1CBFB4CC7486D978398214 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the DistTrack family. 7 of 51 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 4f02a9fcd2deb3936ede8ff009bd08662bdb1f365c0f4a78b3757a98c2f40400
SHA-1: 7c0dc6a8f4d2d762a07a523f19b7acd2258f7ecc
MD5: b14299fd4d1cbfb4cc7486d978398214
imphash: c813c542704a675537c80dbea4da705b
ssdeep: 12288:Xfz3ZXNPcwmGWdCCg98gJWGG2EbzXHlk3qBUb7Ub:XfzZdE5Ng98gJWb2Ebzm3q
TLSH: T12E527D0321186EC9C39FB8524525802DF78D7716B3A24AF45CD3915D5CAEAB338B4ECA
Submitted as: B14299FD4D1CBFB4CC7486D978398214
File type: pe · Size: 989184 bytes
Verdict: malicious (100/100) · Family: DistTrack

Detections (7 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Trojan.DistTrack-1
YARA: JPCERT/CC: JPCERT_Emotet
Cyble Vision: Cyble Vision: Malicious
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/WipMBR.A
Emsisoft (Emergency Kit): Gen:Trojan.Heur.8u0@ILmUdSm

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.DistTrack-1 (rule Win.Trojan.DistTrack-1) - engine signal, weight 0.90, confidence 0.95
Cyble Vision flagged Cyble Vision: Malicious (rule Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/WipMBR.A (rule Trojan:Win32/WipMBR.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Heur.8u0@ILmUdSm (rule Gen:Trojan.Heur.8u0@ILmUdSm) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 5 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Contacted 1 external host(s) at runtime - network signal, weight 0.12, confidence 0.55

Dynamic analysis (windows)

42 behavior events · 2 ATT&CK techniques · 0 dropped files.

Embedded domains

testdomain.com
aefd.nelreports.net

Embedded IP addresses

23.33.238.104

File paths

c:\windows\temp\out17626867.txt
X:\:`:
C:\Windows\system32\svchost.exe

More DistTrack samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report