MALICIOUS — 639d7fec7af640de2d2e62aa8911beb2b9d887aa420d607a40c5700af03bf183

MALICIOUS — 639d7fec7af640de2d2e62aa8911beb2b9d887aa420d607a40c5700af03bf183 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 639d7fec7af640de2d2e62aa8911beb2b9d887aa420d607a40c5700af03bf183
SHA-1: 366291dd0aec04b6e178d7edcd43ffa2f78ed802
MD5: d7f0d8bed75cbfa563a8ffd02ca24dba
imphash: e64c588944c2ac10400ed12764c26b03
ssdeep: 1536:SVHCDLiTEeX3rIyFCs3N8aLnfi6CaEVjfZfzoLp:S2uQeX7IGCsXfi6ZEVjfZSp
TLSH: T194388D9CD5F16BC8CBE353341F15812D2DE00EDCC57F8C221901E52596E2A6BD2EA1AB
Submitted as: 639d7fec7af640de2d2e62aa8911beb2b9d887aa420d607a40c5700af03bf183
File type: pe · Size: 82883 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:sdfsdhff
ClamAV (daily): Win.Malware.Urelas-9908833-0
Detect It Easy (packer/type): DIE:Packman
Microsoft Defender: Trojan:Win32/Urelas!pz
Trellix Stinger (McAfee): Trojan-Urelas!8713839F97C7
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Urelas-9908833-0 (rule Win.Malware.Urelas-9908833-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-Urelas!8713839F97C7 (rule Trojan-Urelas!8713839F97C7) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 6 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Packman (rule DIE:Packman) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:sdfsdhff (rule high-entropy-sections:sdfsdhff) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:sdfsdhff, Packman - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

13188 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - e3832877c5daf6c70643fe4360ad7d987122cd3ff833b46cc54bf9f74f9a640d
C:\Users\analyst\AppData\Local\Temp\huter.exe - a66a992a52dad9406a074264745340ab56e54e6b71860ead9818e2940ef0dbed

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.112.66
4.230.171.124
85.210.193.152
20.247.185.124
135.232.92.97
74.178.240.61
20.42.65.85
52.178.17.233
112.175.88.209
20.165.94.63
172.178.240.161
172.170.180.133
51.105.71.136
52.110.12.31
112.175.88.208
34.104.35.123
203.26.79.13
125.56.205.24
125.56.205.123
112.175.88.207
52.110.12.45
52.110.12.11
72.153.5.133
52.148.114.188

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report