MALICIOUS — uac-done.txt .exe

MALICIOUS — uac-done.txt .exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 65296ae4d596e74b6445b571886f3d9e1690f903c01ec4a77a0965c5577fb952
SHA-1: 05326b22a3250090249ae88d4593f598e1cfa17d
MD5: d160c6cd06ecc7482583f1da9a431301
imphash: 3a2003ea545fe942681da9e7683ebb58
ssdeep: 6144:6BxIK3CTW8TMjp41u6nyHwnZSO7oqU+PFPPSdXqKmZaYJW6RtAB6RW2Y29+J:CxIK9V14ImyHYSEoKZFKc8oTY29+J
TLSH: T14749ADD3FB958488F9620477D8D2E30E74E312D34A7174CE1485C5D8EEAA113EA29D8E
Submitted as: uac-done.txt .exe
File type: pe · Size: 420288 bytes
Verdict: malicious (99/100) · Family: Mira

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
ClamAV (daily): Win.Packed.Mira-7330891-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Krap!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Packed.Mira-7330891-0 (rule Win.Packed.Mira-7330891-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (Persistence): scoobe-fix.cmd - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.lol 1, MinGW - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

5839 behavior events · 1 ATT&CK techniques · 34 dropped files.

Dropped files

C:\DumpStack.log.tmp .exe - 720145e81fb3ea2f19c9411e14059745dceaff603d973d7965d34050c28f849f
C:\Config.Msi .exe - 605057cd1403e55c0070235359cb1b589f6b58b886e75867713b0e768d036e8b
C:\PerfLogs .exe - b01508d1b62c42eb72915492f8216a75e3c0cd4c68816120671e8ef09dbd052b
C:\p.ps1 .exe - 24325fcc4f5c36c0eeaefbfe4568b037664396bd2690a87da2d1e5be285beb11
e5f2d8e70ab0f0995abf7b2c5993b5098c62246889afa35e8fe7eefcdb6aa845 - e5f2d8e70ab0f0995abf7b2c5993b5098c62246889afa35e8fe7eefcdb6aa845
C:\796.ini .exe - c947c0612b15f5f559d499ac388273f7ead24b1c5167482db8684e0cc059f222
C:\$WinREAgent .exe - 79b0d40db98ab21e0ba46de1672e59632cfca93a079cabff2f9504d250bf4178
C:\uac-done.txt .exe - e28192bc468e3da87dabaffae74d959b56cb9c7365bd0f30c9beca16071baec8
C:\uac-done.txt - ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a
C:\ProgramData .exe - f7e40c34f6f4e333058b77d6664a663e2803a58ed87b52784490a3190703784c
C:\swapfile.sys .exe - 4ed9e667518bc15f59a74d587f79cf6b2d238a9b8b84a62743b6900406da8e3d
C:\System Volume Information .exe - 3dd0b8d101889a847ebde6123d82f74238fe6d4e8e3e38574ced018bcad6e8b6
C:\796.ini - 00cf90388948922f586ffba26b07a16ddeffe8e5f6c5201c8bc39eee4d1006db
C:\uac.ps1 - a42e57db93b93ecb2224fdb1276f4ebb0b6705cc4a95ec1899772df8dc47a684
C:\ProgramData\sxdla.exe - aecfb638628b927cc2e4337b84b0fc72548cecb5825ff7f6ed980acbfaa5159c

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787725508&P2=404&P3=2&P4=KwtZ5eoOMo6l2dPooYvX%2bhHilc6XmQrrAD7OH%2f6exeC%2bM7QU585JRlLQ1npZP51mOHQpn%2fraAKbapWovSXz%2fUQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787725577&P2=404&P3=2&P4=Q3Ng%2bowVfsvPY%2fRDA4FELMtk4PMwhO6ZebzEAe5c4r62pNf%2btAmIBAP4rtOt6G4Y%2b5uKn3OOAGUrMqG7bHctjw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

203.26.79.13
104.208.16.94
20.247.184.197
57.155.101.212
4.230.171.124
74.178.76.128
20.42.73.27
135.233.95.135
4.247.188.224
20.112.250.133
52.123.129.14
52.123.128.14
135.233.45.221
135.233.95.80
52.148.114.188
52.123.252.226
74.179.71.159
52.110.12.54
52.110.12.16
72.153.5.140
20.165.94.46
52.110.12.42
52.110.12.37

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report