MALICIOUS — 645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3

MALICIOUS — 645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 7 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3
SHA-1: 144adc577bd4c726df95f8289850efe2e5361441
MD5: 2978e9bebf4deb6ca1195ebcb3bbb7c8
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 49152:HWwvPm6Ix60m8C1wPU+OGsxKmA8B1qmZZvGN+3Jh:tPVdNgeC+5h
TLSH: T16D5C7D9A01172022D4F9ED45B421C9DCD063F859D9349A8E9203DB1BD169EBFBBB00F6
Submitted as: 645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3
File type: pe · Size: 2549064 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (7 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

Dropped a malicious payload (Viking): 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://perfetto.dev/docs/contributing/getting-started#community - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

58880 behavior events · 2 ATT&CK techniques · 70 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9191/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9191/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9191/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9191/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9191/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9191/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9191/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9191/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9191/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9191/files/98948bb68681f3c27710c49481bf91c56b177e64dae91e5704cb71ed6b5e9c3a - 98948bb68681f3c27710c49481bf91c56b177e64dae91e5704cb71ed6b5e9c3a
/opt/CAPEv2/storage/analyses/9191/files/af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98 - af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98
/opt/CAPEv2/storage/analyses/9191/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9191/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73
/opt/CAPEv2/storage/analyses/9191/files/713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210 - 713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210
/opt/CAPEv2/storage/analyses/9191/files/c210222aa6920708541ef37fe530810d36d81cfafdf020275cccc0aad9398a35 - c210222aa6920708541ef37fe530810d36d81cfafdf020275cccc0aad9398a35

Embedded URLs

https://perfetto.dev/docs/contributing/getting-started#community
https://www.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
https://support.microsoft.com/en-us/topic/trying-to-install-an-app-69dcf80c-a88b-408f-9531-0b168d425a14
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786396735&P2=404&P3=2&P4=neIAuROKLiMn9nGl%2fneC5e77X2wHC7DzRlOQ47VbLsrtcqkeqLFGGV8ePx%2fyiQ9YSm1sU6%2f3MujGQKBz9DAu1g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786396836&P2=404&P3=2&P4=SDY0I5K0uuero%2f1tbaF4FeRE4aMUZGqe8p8Zl5ALrjPicj7aPl3HObJUgED2vIeetFFTIagKkmFhyq%2fwCFxkYQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

openssl.org
mutex.cc
field.cc
time.cc
utils.cc
rds.descriptor.name
descriptor.name
perfetto.dev
regex.cc
allocator.cc
executor.cc
parser.cc
blink.net
registry.cc
thread.cc
sequence.cc
values.cc
mem.cc
regexp.cc
re2.cc
tostring.cc
simplify.cc
parse.cc
onepass.cc
nfa.cc

Embedded IP addresses

192.168.0.30
192.168.8.1
20.89.1.9
20.247.185.124
4.144.132.114
4.230.171.124
40.84.85.40
20.165.94.63
74.178.76.54
52.168.117.168
135.233.45.222
20.42.65.84
203.26.79.13
74.179.71.159
184.84.165.136
72.154.7.106
52.148.114.188
52.110.12.44
52.110.12.31

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report