MALICIOUS — 4f63c8c6e4a3e27e03847e3ca90ecad2cc81c4caaa4f560c8ede3cd85bd14f09
MALICIOUS — 4f63c8c6e4a3e27e03847e3ca90ecad2cc81c4caaa4f560c8ede3cd85bd14f09 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the DarkKomet family. 2 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
4f63c8c6e4a3e27e03847e3ca90ecad2cc81c4caaa4f560c8ede3cd85bd14f09 - SHA-1:
69d4de0ec0f4615927eb5c08e1c7a4e0b1d375c7 - MD5:
3b64edf0ae60f91174fc0f5e157f1f0d - imphash:
fcf1390e9ce472c7270447fc5c61a0c1 - ssdeep:
98304:abNim9G/rF7RweXJ0dl9DbE27CvIDRpP21ggQjp1HMgSRLVOjBqQV:apim9G/rF7RweXeg27nFpe1ggQjpuPvY - TLSH:
T11C6123C90260568ACDB2AB50ACBD2E1E01A764D5423FAFE55757C83E2EF384BF40514B - Submitted as: 4f63c8c6e4a3e27e03847e3ca90ecad2cc81c4caaa4f560c8ede3cd85bd14f09
- File type: pe · Size: 3984662 bytes
- Verdict: malicious (97/100) · Family: DarkKomet
Detections (2 of 55 engines)
- ClamAV (daily): Win.Trojan.DarkKomet-10027799-0
- Kaspersky (KVRT): HEUR:Backdoor.MSIL.Bladabindi.vho
MITRE ATT&CK
Why this verdict
The malicious score of 97/100 is the fusion of 6 weighted signals:
- ClamAV (daily) flagged Win.Trojan.DarkKomet-10027799-0 (rule
Win.Trojan.DarkKomet-10027799-0) - engine signal, weight 0.90, confidence 0.95 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 32 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
- Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
23511 behavior events · 2 ATT&CK techniques · 22 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.tlog\link.command.1.tlog -
c4bb13468dd9f112acf3e4f02f5e9912a91881e2c55700553aee677ae1c8e11f - C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.exe -
0021c3d92e28928e1b41a2e209b2c9056df731f13da93bd6b894db77c75d9e7e - C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.vcxproj.FileListAbsolute.txt -
e7918657b14f907193c873daca0088f35b86cf92b96190fe85b1087f4883f621 - C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.tlog\CL.write.1.tlog -
b68b9cf7290a4928f1cc85ed231dd424ba0ed1979f58ee254fef30ca14dd80b9 - C:\Users\analyst\AppData\Local\Temp\RarSFX0\vcpkg.applocal.log -
9ed0a466d320baba8d058940d2ffc148048ed560b862cc6792129503691f56a5 - C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.pdb -
5e7f0f94273da25100a2fc444485df340d413c948ea91a5c4e8b7dfc103ac5ac - C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.tlog\CSmtp.write.1u.tlog -
624bba976c0441d61638507185b609e103e88e0ccc570cca7c76ddda1c4106a3 - C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.tlog\CSmtp.lastbuildstate -
500b3201c43852a80410064fd7147a80592026130b65b8230b00e2f79ec9246a - C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.exe.recipe -
9312db50fe8f5e8719f0870ddd8d6d13a09b8e4ba97b91601804c6a53bf64d8e - C:\Users\analyst\AppData\Local\Temp\RarSFX0\md5.obj -
a319290ee34b9809e74df731c26146d4c27405679dbe9a9f6d232522d4994750 - C:\Users\analyst\AppData\Local\Temp\RarSFX0\vc142.pdb -
47fa3c0de5c188351ed3a79a6ab8df499419b2fa10f42bea01439aff3f4fdf7a - C:\Users\analyst\AppData\Local\Temp\RarSFX0\libssl-1_1.dll -
ba4c83696b6d1129e9a1655ec71179799e3db23e6c31f6665b299c8f4b9956d1 - C:\Users\analyst\AppData\Local\Temp\RarSFX0\main.obj -
48e4fceb565bdb3053666cf9b5f3e4ddc195e977c68419b795dcc1b268e050d4 - C:\Users\analyst\AppData\Local\Temp\RarSFX0\libcrypto-1_1.dll -
77fb679cb133a64b8a44f3b6b78ec9bae89e7028a6372c648e5989f8cf4b2947 - C:\Users\analyst\AppData\Local\Temp\RarSFX0\CSmtp.log -
fbe9669b91e7e0a3940d073cb930561832aa3546e9a64a4b0c011186d0be7e5a
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787914867&P2=404&P3=2&P4=HD%2f1LMvZT6hUm%2fpt9yAC0xQxYy%2bZS%2bv%2begWfbfK20SI5fuk5ah8QYRySshlqZ%2f96Dh8sqF9u0qhw5cosWqO6VQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787914937&P2=404&P3=2&P4=g8hwV7ETFrMFe181ANfui%2bA%2fKXy6Xg4mKNAnomc%2fD8KOmTSFDQrscFkBrLeXySsseuwTx5Dgh8JRKnI6c1UWeQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787311625&P2=404&P3=2&P4=KOjbNC9N2Xn2QFE8pgmGTGtG%2fQ3Kqm9OrAMHtTboDOVKIXjSF0LOxe3Zh5w0dP40ptckOlAR4Co8ZbJsdPtF7w%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787311210&P2=404&P3=2&P4=QSOge4hpStQmCqc23qhidK9nnlvb3HQJaiQ8qCFPnlSFzy9eLcklqTSbwwRk4fXtlH1b5w8jr%2fXQmaAf7o7UpQ%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- to9.uk
- schemas.microsoft.com
- u.sg
- k.gq
Embedded IP addresses
- 4.150.223.103
- 52.123.252.216
- 4.230.171.124
- 20.42.179.204
- 20.247.184.142
- 40.79.167.9
- 52.123.252.193
- 74.178.76.128
- 135.232.92.97
- 20.76.201.171
- 52.123.129.14
- 52.123.128.14
- 203.26.79.13
- 172.178.240.162
- 52.123.252.204
- 135.233.95.80
- 172.178.240.161
- 52.110.12.48
- 52.148.114.188
- 52.110.12.10
- 85.210.196.11
- 72.154.7.97
- 135.234.160.246
- 48.199.12.1
- 52.168.112.66
File paths
- D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
- T:\:d:l:t:
- X:\0M
- j:\2{
- A:\r
- y:\G3f
More DarkKomet samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report