MALICIOUS — 551676dd2639c5508b8455461d2654f3634c0901984fc081f6f4b7d6931a8d8a

MALICIOUS — 551676dd2639c5508b8455461d2654f3634c0901984fc081f6f4b7d6931a8d8a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Wacatac family. 6 of 56 detection engines flagged it.

Identification

• SHA-256: 551676dd2639c5508b8455461d2654f3634c0901984fc081f6f4b7d6931a8d8a
• SHA-1: d4d93ac0130b0d22f4961e1c6aa0137912d4e1e8
• MD5: 376220407ecf0f1f6b209e482a2697a7
• imphash: 4328f7206db519cd4e82283211d98e83
• ssdeep: 49152:S3Sr/XDgTbGoef1XfcTbq8p2LVoRMpoRyEbJ8Ahd6KDPibnQZLQ/ordaWYYOu4w:SKgvGoef1Xf988LSRv8AVD4nkLIordN
• TLSH: T12C5C23C6917E380FC2E9C010749CCD2EA68749E606379CFC5585E46398B6A33D9743AD
• Submitted as: 551676dd2639c5508b8455461d2654f3634c0901984fc081f6f4b7d6931a8d8a
• File type: pe · Size: 2590400 bytes
• Verdict: malicious (100/100) · Family: Wacatac

Detections (6 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
• ClamAV (daily): Win.Dropper.Reline-9906719-0
• Detect It Easy (packer/type): DIE:wxWidgets
• Microsoft Defender: Trojan:Win32/Wacatac.B!ml
• Emsisoft (Emergency Kit): Trojan.Agent
• Kaspersky (KVRT): UDS:Trojan-PSW.Win32.Stealer.wfz

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

• ClamAV (daily) flagged Win.Dropper.Reline-9906719-0 (rule Win.Dropper.Reline-9906719-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_687c98a0e9 (pid 3288) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Trojan:Win32/Wacatac.B!ml (rule Trojan:Win32/Wacatac.B!ml) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan-PSW.Win32.Stealer.wfz (rule UDS:Trojan-PSW.Win32.Stealer.wfz) - engine signal, weight 0.55, confidence 0.85
• Contacted 4 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1082, T1497 - dynamic signal, weight 0.40, confidence 0.75
• Extracted RedLine config (0 C2) - engine signal, weight 0.45, confidence 0.60
• Detect It Easy (packer/type) flagged DIE:wxWidgets (rule DIE:wxWidgets) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,^€®°,.boot,^€®°,^€®°, wxWidgets - static signal, weight 0.25, confidence 0.55
• Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

1198 behavior events · 0 ATT&CK techniques · 2 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• charirelay.xyz
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• licensing.mp.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• assets.msn.com
• www.bing.com
• crt.usertrust.com
• edge.microsoft.com

Dropped files

• 9f2e422b0559f6b9a1a0f99b739efa3851dfd4a15be8e247c1688cbccbb125fe - 9f2e422b0559f6b9a1a0f99b739efa3851dfd4a15be8e247c1688cbccbb125fe
• 476808afbe7b522919da5ef922bd3bf280d7bf27a940e62f0b107d99d438df58 - 476808afbe7b522919da5ef922bd3bf280d7bf27a940e62f0b107d99d438df58

Embedded URLs

• http://schemas.microsoft.com/SMI/2005/WindowsSettings
• https://sectigo.com/CPS0D
• http://crl.usertrust.com/USERTrustRSACertificationAuthority.crl0v
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• kn.cf
• c.xyz
• color.xyz
• adjacentcolor.xyz
• schemas.microsoft.com
• sectigo.com
• crl.sectigo.com
• crt.sectigo.com
• crl.usertrust.com
• crt.usertrust.com
• charirelay.xyz

Embedded IP addresses

• 20.184.175.9
• 4.144.132.114
• 52.123.252.235
• 4.230.171.124
• 103.224.182.214
• 57.154.63.210
• 52.110.12.53
• 52.110.12.16
• 172.64.149.23
• 20.42.179.204
• 4.150.223.104
• 51.116.253.170
• 72.154.7.112
• 92.223.78.30
• 52.148.114.188
• 52.110.12.21
• 52.110.12.1

File paths

• J:\#Z

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report