MALICIOUS — 5d45587395d9ed1567ce4c1c627f7b058af04be063d01e8507688d31aef47a58

MALICIOUS — 5d45587395d9ed1567ce4c1c627f7b058af04be063d01e8507688d31aef47a58 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 5d45587395d9ed1567ce4c1c627f7b058af04be063d01e8507688d31aef47a58
SHA-1: 55fae0dee00c32722564b6046673a004b8237d8a
MD5: 7962667b791e6cc8524be894c1d6e567
imphash: 372467513fc37686aa91f0703e76e7b1
ssdeep: 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBroh/:8IfBoDWoyFblU6hAJQnOl
TLSH: T19E49BE1CC2F26786EAF793202E504F0E70E25CDED0BE4C994793D15D26E259BE2C512A
Submitted as: 5d45587395d9ed1567ce4c1c627f7b058af04be063d01e8507688d31aef47a58
File type: pe · Size: 414466 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (6 of 56 engines)

ClamAV (daily): Win.Trojan.Urelas-9635181-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas.WE!MTB
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Trellix Stinger (McAfee): Corrupt-FY!7962667B791E
Kaspersky (KVRT): Backdoor.Win32.Plite.bhty

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-9635181-0 (rule Win.Trojan.Urelas-9635181-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas.WE!MTB (rule Trojan:Win32/Urelas.WE!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.SP.Urelas.1 (rule Gen:Heur.Mint.SP.Urelas.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Corrupt-FY!7962667B791E (rule Corrupt-FY!7962667B791E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Plite.bhty (rule Backdoor.Win32.Plite.bhty) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

32476 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\woorq.exe - 60b0b3bf3d1eca58c2b83aa5ba9d2c645f59e494d73707d95418d9467022aba1
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - aa3c916ae500d8b18f7ed0effee09376f0d0a324242844f16ad27a0e37b91e5f
C:\Users\analyst\AppData\Local\Temp\woorq.exe - 8d43c716750188137996adedf66fdd1163a94f4d7696ffd041cca624a36b6840
C:\Users\analyst\AppData\Local\Temp\diduj.exe - 20ef4636abaf5162db06aab031d2be01550d9741a2cf1616d835a2b2a320d6c9
C:\Users\analyst\AppData\Local\Temp\mimixu.exe - fbfaf340c63bf3f7d4ff6e2d25c0f1eb66e3bc24bf893b9de1c905fd36f5a4b4
b34278b6299f9c0386227833a8c9f62173817529b6e67b144b4a0efc8e48b633 - b34278b6299f9c0386227833a8c9f62173817529b6e67b144b4a0efc8e48b633

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

aefd.nelreports.net

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
51.104.15.252
4.230.171.124
57.155.104.224
4.144.132.114
135.232.92.97
20.165.94.63
52.182.141.63
104.18.33.89
135.233.95.144
92.223.78.30
172.66.2.5
52.110.12.8
52.110.12.51
135.234.160.244
4.150.223.112
13.69.239.69
72.153.5.139
52.148.114.188
52.110.12.18

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report