MALICIOUS — 6623d89e8cc12d9bd376e675463596910db1862fd13b75c1c9d55af9c16acd9b

MALICIOUS — 6623d89e8cc12d9bd376e675463596910db1862fd13b75c1c9d55af9c16acd9b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upatre family. 3 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 6623d89e8cc12d9bd376e675463596910db1862fd13b75c1c9d55af9c16acd9b
SHA-1: ca8067d9c473cf0f2d48a6b3a903d76d30d43868
MD5: 34917ae2e1a3aa78339380ad070588eb
imphash: 3bd1cf97537104404441a903e61f0f5f
ssdeep: 768:/fhR+SEipTyC3Bq+MFhC+5amI2nIp9vY:hzHTyGMFhC6Ip9Y
TLSH: T1402FDFCD40A81B6BC33705E61B36D95EA1D7F0E209ED751A1C9CA03D90C2CA3AD52E76
Submitted as: 6623d89e8cc12d9bd376e675463596910db1862fd13b75c1c9d55af9c16acd9b
File type: pe · Size: 33360 bytes
Verdict: malicious (99/100) · Family: Upatre

Detections (3 of 56 engines)

ClamAV (daily): Win.Packed.Upatre-7168611-0
Microsoft Defender: Trojan:Win32/Waski.A!MTB
Kaspersky (KVRT): Trojan-Downloader.Win32.Small.fbbs

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Upatre-7168611-0 (rule Win.Packed.Upatre-7168611-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Waski.A!MTB (rule Trojan:Win32/Waski.A!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Downloader.Win32.Small.fbbs (rule Trojan-Downloader.Win32.Small.fbbs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

14236 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\budha.exe - 0964afb36cd4b1fabb09c792a7b47f24998153c0742ed4b83c99672303b34408

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye2.c.lencr.org/23.crl
http://c.pki.goog/r/r1.crl
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

merrymilkfoods.com
evaniz.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye2.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

51.104.15.252
4.144.132.114
4.230.171.124
52.253.84.76
104.18.33.89
52.110.12.28
52.110.12.48
135.234.160.244
172.215.188.225
104.18.21.213
92.223.78.30
72.145.35.102
52.148.114.188
2.57.91.91
52.110.12.51

File paths

C:\cad6deb4ff92bd615ee31636a73b7d75afd616efc857489d358cbf51c47ab832
C:\CzixPUyL.exe
C:\bb95HOuN.exe
C:\Users\Lisa\Desktop\KdFyXCi6.exe
C:\Users\Petra\AppData\Local\Temp\file.pe32
C:\lSjR0Shl.exe
C:\438990827724c75df266d61261622967311633243574f3658312eeb605a687b1
C:\51726999c63777f4f27c7d80f4642f788d12fed51d3bd44d3e20a55b1f431a24
C:\8ef74PMH.exe
C:\9173aaca845cac3cf5d41da53ac6d021d1a9242b7a5b75c525e4c24bbb58eea6
C:\6556351f017b9206298818ad56a16768bb7bb422578d00edc3cd3368442031cc
C:\6580868ab755977c2bebb29cd813299c4ee4ded19d6b6bd763c382c0565e7c22
C:\07c73cf8d32e3369e79d46433f474411df3d0b9a69d96360e6c5cf6a043579b0
C:\e9cca649457feae911909d518ca915e364daf026cc4ef740adbf284d1f538d11
C:\78ba379ca4f57ba429ad7ac88da68231b37912944852307c546eef8c69def37c
C:\CVqPatxH.exe
C:\WDpEF31e.exe
C:\SkaZ7Pox.exe
C:\6bg5bubl.exe
C:\yTTMr4Dy.exe
C:\8RqmSqja.exe
C:\deef61308e248c36f9cf5499b1c1ae022494ae75da4a1b4b38670bba07c1c4b1
C:\U1fRBYb7.exe
C:\ftFykh5e.exe
C:\NwVVZGTL.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report