MALICIOUS — 5051c2eb6766839b3b7d5c7de81bfbeff4aad8859bc004d43a2b3578f523022f

MALICIOUS — 5051c2eb6766839b3b7d5c7de81bfbeff4aad8859bc004d43a2b3578f523022f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Urelas family. 7 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 5051c2eb6766839b3b7d5c7de81bfbeff4aad8859bc004d43a2b3578f523022f
SHA-1: 5f38d3312ccb2f8604367d8cefbfeb558b368e38
MD5: d318d492d98e334920259a4ae4306d58
imphash: c184a13ebbcbe01b7f08f6a8f91b9808
ssdeep: 12288:MrKQUXfDqcDib2vqYzGp53ncgqmy0VFHJz:MuQcGbOJKpVncgV
TLSH: T19A4BAF9982F2A785DFF797202E905E1E20F2ACDDD0BE0D9D4783D14E66D294FE09101A
Submitted as: 5051c2eb6766839b3b7d5c7de81bfbeff4aad8859bc004d43a2b3578f523022f
File type: pe · Size: 485584 bytes
Verdict: malicious (99/100) · Family: Urelas

Detections (7 of 55 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Packed.Urelas-9879149-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Trellix Stinger (McAfee): Corrupt-FY!D318D492D98E
Kaspersky (KVRT): VHO:Trojan-Dropper.Win32.Plite.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Packed.Urelas-9879149-0 (rule Win.Packed.Urelas-9879149-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 30 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

21155 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ihfac.exe - 7dd189d7234f06ca96efc4ec119c491b4efe972e9f39ed6788ca73e991bd8a10
C:\Users\analyst\AppData\Local\Temp\girig.exe - 68df089575c5dc0f09bdabd589a25e5f73eae348c33a9fa8a94b38f10b3fc1f5
C:\Users\analyst\AppData\Local\Temp\girig.exe - 09473f51c4266cbcf629c7d966cb2cd715ffc407e78fd9b32922c96af8a54dda
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - f7ddafeac6d8b9ff8a55d56c11e4e6ec1b48951c6c7ecbcfd0f976f01925f3b6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787862065&P2=404&P3=2&P4=ffFfJueaVVSgEdZN3%2bp7CQF6tMEOOWxBH5RLexjdPI9onfo5AQ1uGhLRbi3XTvaztPopu43QM7nfN021QfuZjA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787862178&P2=404&P3=2&P4=j3jBxobloQn8x7ebkH5OHKy4x5aC6B2vdzJDpeNKtJDCZ%2brkrQ459D0qznySGKByxo%2ffMJQbm9NNoXXwoB2urw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
20.184.175.21
57.155.101.212
4.230.171.124
20.247.184.197
74.178.240.61
13.89.179.12
74.178.240.51
135.233.95.144
20.184.175.10
20.231.239.246
52.123.128.14
135.233.45.221
203.26.79.13
48.211.4.16
52.148.114.188
135.234.160.245
52.123.252.245
74.178.76.44
72.145.35.96
52.123.252.197
92.223.78.30

File paths

F:\LI
A:\+n^d
f:\dd\vctools\vc7libs\ship\atlmfc\src\mfc\auxdata.cpp
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin2.inl
f:\dd\vctools\vc7libs\ship\atlmfc\include\afxwin1.inl

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report