MALICIOUS — 5843ec1be7c2e5ad6ec14b1f73446a32350368ef47fb8d7784c0e1e0cc854fa1

MALICIOUS — 5843ec1be7c2e5ad6ec14b1f73446a32350368ef47fb8d7784c0e1e0cc854fa1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 5843ec1be7c2e5ad6ec14b1f73446a32350368ef47fb8d7784c0e1e0cc854fa1
SHA-1: f2cfa9a85b166fb3ba9d754a1b3bb1df22504e4a
MD5: c446ddd7f80c177dc4fada508c078882
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070ddW55uQFZOkzUu1nNcwicNKwU5/2fG:Qoa1taC0yQFZ7rNEcNKwUwO
TLSH: T1FE5A23865A59370CE5F6C5843928127F8842E8E75378298B52CFF08FA7C796738211DB
Submitted as: 5843ec1be7c2e5ad6ec14b1f73446a32350368ef47fb8d7784c0e1e0cc854fa1
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

98 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\40F7.tmp - ad1e4ad6d114a0c29490625ff11ee692791cf70aca68b7a4a37865ce74b0f7ef
19cc684fff92aa2025d74f9da1ba98ee9cb9383b860033a85955547bf38acf72 - 19cc684fff92aa2025d74f9da1ba98ee9cb9383b860033a85955547bf38acf72

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787765873&P2=404&P3=2&P4=ipiQWDpZBUsIXDwNKDTi0sL0eR6NZ0BghutbczlKCSRNetpSIstv4yxnuOCqpN9qphEtek%2b5Yo37HvjPmYdtfg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787765892&P2=404&P3=2&P4=PtFHYq1ysFwUiqYv5omLSHBrjV03cHFPsbsYNqxXw0o%2bmUZTshowv3NzUmFLKdDD3EMx1qTTZxwUn6g2tlu3WQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.123.252.240
52.123.252.194
4.150.223.107
52.230.59.222
4.230.171.124
57.154.63.210
52.123.252.198
20.165.94.46
135.233.95.144
74.178.76.54
4.150.223.115
203.26.79.13
74.179.77.204
52.123.128.14
20.112.250.133
40.99.133.210
40.104.4.2
74.178.76.44
52.110.12.47
92.223.78.30
52.110.12.21
135.234.160.244
72.154.7.111
52.148.114.188
4.247.188.224

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report