MALICIOUS — 646b10023b900906a8a72996ad104d021d4218aa23241b489db5decb6d59500a

MALICIOUS — 646b10023b900906a8a72996ad104d021d4218aa23241b489db5decb6d59500a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 646b10023b900906a8a72996ad104d021d4218aa23241b489db5decb6d59500a
SHA-1: b2524bc73f895110fcff23904c1b33a3ae0306bf
MD5: 7620154ebe2fae21ed8706e8eb9d0794
imphash: bbe0e58a50af019da15d0f4f3e85b8f2
ssdeep: 1536:f9HMlaocok7dJK4Rm7mUBAMs0q4gF693F7hmE5DpxFO1:f9H75dJKWohBAMs0qCA
TLSH: T173384BCD81E40F67CF7624A44735D4AFD287F0E1099C3A890689813D9AC29B7AC75B72
Submitted as: 646b10023b900906a8a72996ad104d021d4218aa23241b489db5decb6d59500a
File type: pe · Size: 83436 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:
ClamAV (daily): Win.Malware.Upatre-9819643-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: TrojanDownloader:Win32/Upatre!rfn
Emsisoft (Emergency Kit): Gen:Trojan.Ipatre.1
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Upatre-9819643-0 (rule Win.Malware.Upatre-9819643-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Upatre!rfn (rule TrojanDownloader:Win32/Upatre!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Ipatre.1 (rule Gen:Trojan.Ipatre.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections: (rule high-entropy-sections:) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1746 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\C7BJWJSR.txt - f21ecdabafce078b3d71b5b80bd08c1a8f5f8cda4d2c4068aef27c4482b86360
C:\Users\analyst\AppData\Local\Temp\yaxkodila.exe - 17821d5404c3d0c418bca8bb09834280a6a31103aa2e56b9ab399799151562d1
7d6584d40c8787cb27bb2b78d3caadcf66fcd5ed4e2cb6eecc942d980cf79c9c - 7d6584d40c8787cb27bb2b78d3caadcf66fcd5ed4e2cb6eecc942d980cf79c9c
0f3ef0c3ef6923ee615000d9c69aa09ecce76290fe3265622b96ca64189a538a - 0f3ef0c3ef6923ee615000d9c69aa09ecce76290fe3265622b96ca64189a538a
70ad8c95df92e587d7c1daa81ece4954c2d866b4be360c62a19d099b8366e540 - 70ad8c95df92e587d7c1daa81ece4954c2d866b4be360c62a19d099b8366e540
f6f5397d3454db02a8b1833fc9fd726dbb687aa73e670d3fdf4be404fda3eb72 - f6f5397d3454db02a8b1833fc9fd726dbb687aa73e670d3fdf4be404fda3eb72

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://icanhazip.com/

Embedded domains

icanhazip.com

Embedded IP addresses

20.42.65.91
4.230.171.124
4.247.188.224
135.232.92.97
20.247.184.197
52.182.143.212
74.178.76.128
104.18.33.89
20.165.94.63
135.234.160.246
52.110.12.32
104.16.184.241
52.110.12.28

File paths

C:\Users\admin\Downloads\e9018d922efeaa103fd7c6053d89efc6b4a274cfb3d69013c04c92e77d2fd0b3.exe
C:\e10f1a5ceec0a8b16a59a6b97ba4b9e89216196457803168380ce1cfdabad702
C:\ae8255a8196a4f9e61339e6c3534e13167ab408153a2b68c0e0c53432c611872
C:\abaf43a89a724fe4f5473ae7721ef63356d6efedded1a35d69bea5c8b724bdcf
C:\d186429aa46a93093edce78ada4080adfe7a60e2f5278a7533074330c915a254
C:\Users\RA491~1.VUL\AppData\Local\Temp\33102e4646fa8259401b093869c661b2.exe
C:\57aa9260c8571e2b32ef538176a32cd2937e2dc72c8728310fd26784a4c5f1a0
C:\Documents
C:\5132d7773065938e2cdae3f2ef82e34e9d0d11626998f1fa67d26a49546539ab
C:\Users\admin\Downloads\yaxkodila.exe
C:\8bf6cec11ed412ed199cc83e676e69d78a7cc756dbdb0a5d1ccb3af3c02a7c8d
C:\59f6d3324e446ecf1400d8c848de658e52b4f47e7e6ec8c37c3058a989a8ed95
C:\Users\george\Desktop\executable.exe
C:\b09e65873c90ec2ca42989bf46cb6927102cd954deb0532b4e1dfeaaae09eb48
C:\Users\george\Desktop\yaxkodila.exe
C:\Users\Virtual\AppData\Local\Temp\6464a8e322204db7c0f2b68ee55bb3284b4c497cc9d2172734d299b6158fde0a.exe
C:\6f63ffc976f5dac144229c1480755781ec3219082290703cc84e245ccacc0ca1
C:\1b38e7a4d0de250c79aa7eff2e83ad65924cccc9478ce9297dd03a0187bd7e96
C:\Users\r.vult\AppData\Local\Temp\33102e4646fa8259401b093869c661b2.exe
C:\Users\Lisa\Desktop\BNUNAcEc.exe
C:\Users\admin\Downloads\f6e29d5b29bc5679cbd00013ac03b209565b1025b1aaad4f314240cd96e03c5b.exe
C:\Users\Lisa\Desktop\zXeOAsfA.exe
C:\33751ac83cad99c7d9b93244d629a481d624a56c104b48b6d64bab394f4475bf
C:\Users\admin\Downloads\ae196c64fb1779567a7bcda4496900890ac0eb2f34b0bf5555ee244f66953f14.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report