MALICIOUS — 6947a7bf6a5f98c4a99871cfe7c7cf67f944a2911e6781f5a4351cfd456c0ae8
MALICIOUS — 6947a7bf6a5f98c4a99871cfe7c7cf67f944a2911e6781f5a4351cfd456c0ae8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Urelas family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
6947a7bf6a5f98c4a99871cfe7c7cf67f944a2911e6781f5a4351cfd456c0ae8 - SHA-1:
6cc4e516ff115090a6adcefa695df68e6dc72b25 - MD5:
ff14b1b2f37bd6be3bc8ad865be61c82 - imphash:
f56111a7f5f53f0507c7e2b16ea587bd - ssdeep:
1536:JF02aqzNYndSTa+B3Rt2fZt+RtTILSZpLIQaV3WvGtWX0gu5DqpwWLtxhl7pn:wuYndSW7gILCLIPtqVu5Dqpxhzn - TLSH:
T1DE40399DC3B167C5EBF787201F104E1E24E15CEDE1BE5C440A83D16E62E296BDAE011A - Submitted as: 6947a7bf6a5f98c4a99871cfe7c7cf67f944a2911e6781f5a4351cfd456c0ae8
- File type: pe · Size: 178764 bytes
- Verdict: malicious (99/100) · Family: Urelas
Detections (5 of 55 engines)
- ClamAV (daily): Win.Malware.Urelas-6717394-0
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- YARA: Yara-Rules community: YR_AntiDebug_Checks
- Microsoft Defender: Trojan:Win32/Urelas!pz
- Kaspersky (KVRT): VHO:Backdoor.Win32.Plite.gen
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 10 weighted signals:
- ClamAV (daily) flagged Win.Malware.Urelas-6717394-0 (rule
Win.Malware.Urelas-6717394-0) - engine signal, weight 0.90, confidence 0.95 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 33 external host(s) and 24 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule
YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: 121.88.5.183, 121.88.5.184, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
- Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
14066 behavior events · 2 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- c.pki.goog
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\opert.exe -
3a0c44ac3f41db98e2cee8c211a6754c371f84eb6a774190ff34111e383c21a5 - C:\Users\analyst\AppData\Local\Temp\golfinfo.ini -
f8925f72b19e3a2e14ebfda83d63a10e4a6f218d84cc30fb738caa9a575e1217
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787947303&P2=404&P3=2&P4=K8D8KLxZTNl%2fW659VwRvMw%2baETXeA7sn78X2hMeqQD%2bMZnVxgsu3NhFtxeyYSX%2fZ6vfZysdnaqzillT2udU8SA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://c.pki.goog/r/gsr1.crl
- http://c.pki.goog/r/r4.crl
- http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787947421&P2=404&P3=2&P4=gBZEdFuMGFkR1K7jbJrCOEWxBKT7Qjffo3VlT4AC83w7R%2bn4bRECsY3koRkbnru5Vk8OkFs7ZvdBo7OQL01SfQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 121.88.5.183
- 121.88.5.184
- 218.54.31.226
- 218.54.28.139
- 20.42.65.88
- 52.253.84.76
- 4.230.171.124
- 20.42.179.204
- 20.165.94.63
- 74.179.77.164
- 52.168.117.174
- 40.84.97.4
- 135.233.95.144
- 40.84.85.40
- 52.123.129.14
- 20.76.201.171
- 52.123.128.14
- 20.184.175.5
- 135.234.160.245
- 52.123.252.198
- 135.233.45.223
- 52.148.114.188
- 203.26.79.13
- 52.110.12.38
- 52.110.12.45
File paths
- D:\PMS\pms4\Project(20131216)\GbpInstall_2008\bin\GbpInstall.pdb
More Urelas samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report