MALICIOUS — 6386e5e2c28ebe66c9b1282f837ed067536370f3bf5815c66d6f9c49e61b462b

MALICIOUS — 6386e5e2c28ebe66c9b1282f837ed067536370f3bf5815c66d6f9c49e61b462b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 6386e5e2c28ebe66c9b1282f837ed067536370f3bf5815c66d6f9c49e61b462b
SHA-1: 8589dff6c02368e1418708601541c3e44486a3ca
MD5: fe928b0261c7f30f772775a693d424c0
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 3072:fRNtiHSmxPn654NeOqnMWQDIWKZr2zVmw2wh0lZrwfERyqMpd:fSSg8MWQPKR2zV8ugZrwfE1Mpd
TLSH: T19B422A61A18EABAEFA22EAE3302DDD3C5C4928E4E315440DF3DC55D264AC0979EC570D
Submitted as: 6386e5e2c28ebe66c9b1282f837ed067536370f3bf5815c66d6f9c49e61b462b
File type: pe · Size: 206336 bytes
Verdict: malicious (100/100)

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.4 (rule Win32.Virlock.Gen.4) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 4 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 18 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

17541 behavior events · 3 ATT&CK techniques · 37 dropped files.

Dropped files

C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png.exe - 1ca7175e7d44fbf30f875b5ede99685490e5d30a91034b8fc75ba0f53b4f98c2
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\watermark.png.exe - e9744a1c0de104f8f7eb59d9e01aa2798bd8755217ada9b88c65d8feb361e8fc
C:\ProgramData\xiocAsMc\yKgEskQE.inf - e09fa78bd7391a87058a27f1fb9343bdfad098cc57503e4800d998d0e2766413
C:\ProgramData\xiocAsMc\yKgEskQE.inf - 59059ac302e035eee32394fe51488302de3af83e2142a877849bbcf8f315ad4b
C:\Users\analyst\AppData\Local\Temp\heYAQUQk.bat - 0ce1af247235c3ae58d848ffe78ed4fc374514a6874991570784937534e43954
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\device.png.exe - 3d6d49eeede1a867819441b690ccde6e2b09f37c09040b642e6067f936be9c6b
C:\Users\analyst\AppData\Local\Temp\TGkQYsAw.bat - a18df85ec8ad16386a13b91acc484d4258efc1c9bd44f46962024cd1541a09e4
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png.exe - 36ddad380cdff2d3c155115fcc5236e92bc63d4f9e595e1bd2f03d67d71df2f3
C:\Users\analyst\AppData\Local\Temp\vaUoEkUQ.bat - 5484e01ce593dba32a8f76411a4b4addf942a15c7f548fe6cac0109c8daf5907
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png.exe - dc97fb57ba2ade4184d7bac708b0097a96b75b115ddb3f43859aed72f63673ab
C:\Users\analyst\AppData\Local\Temp\XigAwsQs.bat - 011f852b355d9b66f09ad60e54acc29b7611623bdeffc09260c28d36bea25a7b
C:\Users\analyst\AppData\Local\Temp\riIcYAgA.bat - b72ebb63b9c1b139b74c660f9db6e1d4ee3e18daf11f79a15e5b9aecb21881cb
C:\Users\analyst\AppData\Local\Temp\Kcwq.ico - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
C:\ProgramData\xiocAsMc\yKgEskQE - 452c048db32d296084ebde1d0df3b2411772a9c63b9dd41ea7eecb9c64823392

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/

Embedded domains

o.se

Embedded IP addresses

52.168.117.170
20.247.184.197
4.230.171.124
200.87.164.69
200.119.204.12
190.186.45.170
20.42.179.204
20.42.65.89
135.233.45.222
52.148.114.188
72.153.5.136
52.110.12.25

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report