MALICIOUS — 60e2fccdec4c858fc113c0a223c16cf1a4c878e7ba6e88587dee4fe796478cb9

MALICIOUS — 60e2fccdec4c858fc113c0a223c16cf1a4c878e7ba6e88587dee4fe796478cb9 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (85/100), attributed to the Wacatac family. 5 of 55 detection engines flagged it.

Identification

SHA-256: 60e2fccdec4c858fc113c0a223c16cf1a4c878e7ba6e88587dee4fe796478cb9
SHA-1: 13c408a9d291d00f022fb567fd448b36f8baeabe
MD5: 3f6b28bcb2334ca5eb33cb3d91295fc9
imphash: baa93d47220682c04d92f7797d9224ce
ssdeep: 49152:EtSETBY7LT+/hz2OB+8ZcIzxo1mU2eEK:auHCN2Oo8C8wf5
TLSH: T14059335BAB3940DFFFA8482479B7A58C45BC99BA41CA338CD226F5C6102E8235F45DC4
Submitted as: 60e2fccdec4c858fc113c0a223c16cf1a4c878e7ba6e88587dee4fe796478cb9
File type: pe · Size: 1780736 bytes
Verdict: malicious (85/100) · Family: Wacatac

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections: ,goxblysz
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Emsisoft (Emergency Kit): Gen:Variant.Bulz.215170
Kaspersky (KVRT): UDS:Trojan-PSW.Win32.Coins.abot

Why this verdict

The malicious score of 85/100 is the fusion of 5 weighted signals:

Memory forensics: 3 finding(s), e.g. RWX/private injected region in rundll32.exe (pid 6848) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections: ,goxblysz, Microsoft Linker - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

223 behavior events · 0 ATT&CK techniques · 2 dropped files.

Dropped files

e75331b4156c4f38ec9da6b305f5d8d635ec9d178939779b322cf8d5ba367802 - e75331b4156c4f38ec9da6b305f5d8d635ec9d178939779b322cf8d5ba367802
cc6461e168b2827feda4c735fc2abc6fe4d1993ad5b2cc9e1db61c124a1039c2 - cc6461e168b2827feda4c735fc2abc6fe4d1993ad5b2cc9e1db61c124a1039c2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787865059&P2=404&P3=2&P4=jQ%2bI2xHSefqV85B99Uu5VNKPtMgJd69YUZPB5nIOEAg0WPwF0UTCr6qGdup57uezXN10YDJlLwH1xRql0WBtFQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787865128&P2=404&P3=2&P4=IOd8PreMtbsKQ69IZ47Jcfr40Z8Frg8YceRmFSb63qSD%2fL5qJyEu0V4enFn8%2bVVnueiFLTB5t9jpV%2b3BIjYcAQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

l.co
mr.ly

Embedded IP addresses

51.104.15.252
172.215.188.225
52.230.60.54
20.247.185.124
4.230.171.124
40.84.85.40
20.165.94.63
74.178.240.51
51.132.193.104
20.112.250.133
52.123.252.232
52.123.129.14
20.42.65.84
203.26.79.13
20.165.94.46
52.110.12.16
172.178.240.163
52.110.12.54
52.123.252.229
52.148.114.188
72.153.5.62
74.178.76.44
52.110.12.19
52.110.12.14

File paths

c:\L
G:\p5

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report