MALICIOUS — 63935268c3fd6806fc5de779b5f72358721f7dd537de53f019f3baa1cbdb3451
MALICIOUS — 63935268c3fd6806fc5de779b5f72358721f7dd537de53f019f3baa1cbdb3451 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the DarkKomet family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.
Identification
- SHA-256:
63935268c3fd6806fc5de779b5f72358721f7dd537de53f019f3baa1cbdb3451 - SHA-1:
ae8972c472806faa87599cae7fbea22ba0cf9d59 - MD5:
d96a9a72a8e2b99d4d2674e849631db1 - imphash:
9c0bef6c78ee47e19aafb4194fb7c67a - ssdeep:
12288:Ho9JyqfmEN3gaoTfEmMHNdbrZusHtmL9b:HqR/pHPZuLb - TLSH:
T1B149D0194B2ED3CBE47086A154C5370D92AAF4FAB09F20CD2D5794EDFBB1087245621B - Submitted as: 63935268c3fd6806fc5de779b5f72358721f7dd537de53f019f3baa1cbdb3451
- File type: pe · Size: 401987 bytes
- Verdict: malicious (100/100) · Family: DarkKomet
Detections (4 of 56 engines)
- ClamAV (daily): Win.Dropper.DarkKomet-7945051-0
- Microsoft Defender: VirTool:Win32/VBInject.gen!FT
- Emsisoft (Emergency Kit): Gen:Variant.Jaiks.964
- Kaspersky (KVRT): HEUR:Trojan.Win32.Generic
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 13 weighted signals:
- ClamAV (daily) flagged Win.Dropper.DarkKomet-7945051-0 (rule
Win.Dropper.DarkKomet-7945051-0) - engine signal, weight 0.90, confidence 0.95 - 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule
tl-run-key) - dynamic signal, weight 0.60, confidence 0.90 - Microsoft Defender flagged VirTool:Win32/VBInject.gen!FT (rule
VirTool:Win32/VBInject.gen!FT) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Jaiks.964 (rule
Gen:Variant.Jaiks.964) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule
HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85 - 2 IDS alert(s): ThreatLens no-ip dynamic DNS C2 - network signal, weight 0.50, confidence 0.80
- Observed at runtime: Registry Run Key Persistence (T1547.001) (rule
Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 1 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Extracted CyberGate config (0 C2) - engine signal, weight 0.45, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - encrypt data (rule
encrypt data) - capa signal, weight 0.15, confidence 0.60
Dynamic analysis (windows)
54850 behavior events · 3 ATT&CK techniques · 11 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- chelseajoecole.no-ip.org
- ctldl.windowsupdate.com
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- assets.msn.com
- www.bing.com
- fe3cr.delivery.mp.microsoft.com
- v10.events.data.microsoft.com
Dropped files
- eeb85f32e8d47be957edc43b4ab61821baf1dcfbe1a3ad02039b07fa2db16874 -
eeb85f32e8d47be957edc43b4ab61821baf1dcfbe1a3ad02039b07fa2db16874 - a35c0dd01fab864726fc5a1c03cbb1efae0bad04fdaec7c0972e0065fbed07e8 -
a35c0dd01fab864726fc5a1c03cbb1efae0bad04fdaec7c0972e0065fbed07e8 - d87b33b835f66c94d976f2b1665ae264c017e01e217da7ef6f2b93514058575e -
d87b33b835f66c94d976f2b1665ae264c017e01e217da7ef6f2b93514058575e - b5be5316e34ffae0d612841bd92f3a46638bfd92a9017fd7f4b7558f6c75c526 -
b5be5316e34ffae0d612841bd92f3a46638bfd92a9017fd7f4b7558f6c75c526 - 9937d508d8acb9b6f94d00094ca3a2e0e20c8c670b481afc99cc46585ec9de60 -
9937d508d8acb9b6f94d00094ca3a2e0e20c8c670b481afc99cc46585ec9de60 - dc77ab1aee3f0057bad4d92e386b72565703ec2396416771051369d68d00b0c7 -
dc77ab1aee3f0057bad4d92e386b72565703ec2396416771051369d68d00b0c7 - 13a97f45f80967f1a210a3c93bfcd4aa916e2af10d9d5515853ac98a2c4abe05 -
13a97f45f80967f1a210a3c93bfcd4aa916e2af10d9d5515853ac98a2c4abe05 - 74f02eda166b33a0a64099cd69d1de4867ae566dfaf9bd9ac6439dc2d8712657 -
74f02eda166b33a0a64099cd69d1de4867ae566dfaf9bd9ac6439dc2d8712657 - d2fac3b9d3b3a36902bdc1e2b720b1e363ff48a308efc435a2188bd34af3b6e3 -
d2fac3b9d3b3a36902bdc1e2b720b1e363ff48a308efc435a2188bd34af3b6e3 - c4f67535dcf9556cc27aac20e81b5dbf7fd168988d56230dcd976dc967f140a9 -
c4f67535dcf9556cc27aac20e81b5dbf7fd168988d56230dcd976dc967f140a9 - 059c080b26491b6b5c84288af1311e899c1070ff0c31b116501c962125d04fbe -
059c080b26491b6b5c84288af1311e899c1070ff0c31b116501c962125d04fbe
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- chelseajoecole.no-ip.org
Embedded IP addresses
- 20.184.175.9
- 52.123.252.231
- 4.230.171.124
- 48.211.4.16
- 74.178.240.51
- 52.253.84.76
- 74.178.240.61
- 20.184.175.4
- 135.234.160.244
- 135.234.160.245
- 190.247.83.100
- 172.215.188.225
- 40.84.85.40
- 135.233.45.221
- 72.153.5.61
- 52.148.114.188
- 52.110.12.42
- 52.110.12.16
File paths
- C:\Windows\system32\Msvbvm60.dll\3
More DarkKomet samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report