MALICIOUS — 506dfba3076c39f7ebe16bfcf0079c4a32729d2861bb26ffbbbd5328d496b674

MALICIOUS — 506dfba3076c39f7ebe16bfcf0079c4a32729d2861bb26ffbbbd5328d496b674 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 506dfba3076c39f7ebe16bfcf0079c4a32729d2861bb26ffbbbd5328d496b674
SHA-1: db84e8aa0f0d20c86223351f5c31575f93672059
MD5: c1daa85d4b48757eefb65bc4c0fdbbf9
imphash: e64c588944c2ac10400ed12764c26b03
ssdeep: 768:n5mhew0GpSyMe6hwUkdwJzh+qciaQRENEzxZbARtR06g2wqp4YPeznellmqGwxPP:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdC
TLSH: T1C8350269800AE969F5BEF3003854EC2D6B4E62741CEDB1E9FF00516C6378213920932F
Submitted as: 506dfba3076c39f7ebe16bfcf0079c4a32729d2861bb26ffbbbd5328d496b674
File type: pe · Size: 61441 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:HSUDHUHW
ClamAV (daily): Win.Trojan.Generic-9909987-0
Detect It Easy (packer/type): DIE:Packman
Microsoft Defender: Trojan:Win32/Urelas!pz
Trellix Stinger (McAfee): Trojan-FEXT!87EE44CB458B
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9909987-0 (rule Win.Trojan.Generic-9909987-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FEXT!87EE44CB458B (rule Trojan-FEXT!87EE44CB458B) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Packman (rule DIE:Packman) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:HSUDHUHW (rule high-entropy-sections:HSUDHUHW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:HSUDHUHW, Packman - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12902 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
C:\Users\analyst\AppData\Local\Temp\biudfw.exe - c3ec7bc7f879427d130f573d2fcd77e720ecead9626c10972fa31fef8fa119aa

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.90
4.230.171.124
57.154.63.210
52.230.60.54
135.232.92.137
20.165.94.54
20.42.65.94
40.79.167.9
218.54.47.76
218.54.47.74
52.110.12.25
52.110.12.45
218.54.47.77
135.234.160.246
52.178.17.2
72.153.5.61
52.148.114.188
52.110.12.46
52.110.12.31

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report