MALICIOUS — 5b5dea9b505a23af56dae67e2d847bbe97ca17bd4560f41d6b604c71f4870d75.exe
MALICIOUS — 5b5dea9b505a23af56dae67e2d847bbe97ca17bd4560f41d6b604c71f4870d75.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Prometei family. 7 of 53 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
5b5dea9b505a23af56dae67e2d847bbe97ca17bd4560f41d6b604c71f4870d75 - SHA-1:
64ba56ced1e0e90c8d4452705796474c8ebb1704 - MD5:
5f31264fd0ff12d16e2bdc00ca1aa9bb - imphash:
4972aa353b94b0084a01f29629be50c3 - ssdeep:
6144:HGxCfPf0s3KPHfBxR8jPs1F1yD9jvryfL9SqXVdOW:HG60BpL8jk1FGjDc8GVdOW - TLSH:
T19444CE47B01617D1FBF473A904173D1FD3F6BBA0B69ADC86AE070896518490BE2107BA - Submitted as: 5b5dea9b505a23af56dae67e2d847bbe97ca17bd4560f41d6b604c71f4870d75.exe
- File type: pe · Size: 245864 bytes
- Verdict: malicious (98/100) · Family: Prometei
Detections (7 of 53 engines)
- MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Hash: abuse.ch ThreatFox: known-malicious-hash
- Detect It Easy (packer/type): DIE:Microsoft Linker
- Microsoft Defender: Trojan:Win32/Prometei.AHC!MTB
- Emsisoft (Emergency Kit): Gen:Heur.Variadic.Prometei.A
- Kaspersky (KVRT): HEUR:Trojan.Win32.Sdum.gen
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule
known-malicious-hash) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Prometei.AHC!MTB (rule
Trojan:Win32/Prometei.AHC!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Heur.Variadic.Prometei.A (rule
Gen:Heur.Variadic.Prometei.A) - engine signal, weight 0.55, confidence 0.85 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule
DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Contacted 4 external host(s) at runtime - network signal, weight 0.12, confidence 0.55
Dynamic analysis (windows)
1035 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- searchapp.bundleassets.example
- staging.to-do.officeppe.com
- s-0005.dual-s-msedge.net
- teams.cloud.microsoft
- outlook.office.com
- SYD-efz.ms-acdc.office.com
- settings-prod-scus-1-tagged.southcentralus.cloudapp.azure.com
- outlook.office365.com
- outlook.cloud.microsoft
- bg.microsoft.map.fastly.net
- settings-prod-wus2-2-tagged.westus2.cloudapp.azure.com
- teams-mrc-ww-perf.tm-4.office.com
- www.msftconnecttest.com
- settings-prod-cin-2-tagged.centralindia.cloudapp.azure.com
- onedsblobvmssprdwus04.westus.cloudapp.azure.com
- svc.ms-acdc-teams.office.com
- mr-b02.tm-azurefd.net
- mr-b01.tm-azurefd.net
- onedscolprdcus54.centralus.cloudapp.azure.com
- www.bing.com
Dropped files
- /opt/CAPEv2/storage/analyses/4704/files/def280f44f595624912b3600d175d2a5132827e868638703f139d9ea5cce7afc -
def280f44f595624912b3600d175d2a5132827e868638703f139d9ea5cce7afc
Embedded domains
- reroute443.trafficmanager.net
- staging.to-do.officeppe.com
- s-0005.dual-s-msedge.net
- glb.sls.prod.dcat.dsp.trafficmanager.net
- glb.api.prod.dcat.dsp.trafficmanager.net
- aefd.nelreports.net
- mr-b02.tm-azurefd.net
- mr-b01.tm-azurefd.net
Embedded IP addresses
- 192.168.10.16
- 52.123.252.233
- 23.11.36.157
- 23.221.133.185
- 23.33.238.103
More Prometei samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report