MALICIOUS — 6b74cc8e2d349646cfae30d2edd14313493449782485c1ac0f006a1dbb15cbab

MALICIOUS — 6b74cc8e2d349646cfae30d2edd14313493449782485c1ac0f006a1dbb15cbab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Ppatre family. 4 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 6b74cc8e2d349646cfae30d2edd14313493449782485c1ac0f006a1dbb15cbab
SHA-1: 1d34b7526a8a8b0e58ef3a5351df4d200613792c
MD5: 1718c6bbbeaf140a56ce64a9005830e8
imphash: 3bd1cf97537104404441a903e61f0f5f
ssdeep: 192:13XQwMCQWRIGKpa625mgGcdAQOYnwIkRwMogbe:1HQWQWRIGKp3Im4Z
TLSH: T1E92349CE40A41B6BC33B05F61772D90E9197B1E209AD750B1C5D903E50C6CA3AD62E7A
Submitted as: 6b74cc8e2d349646cfae30d2edd14313493449782485c1ac0f006a1dbb15cbab
File type: pe · Size: 11254 bytes
Verdict: malicious (99/100) · Family: Ppatre

Detections (4 of 55 engines)

ClamAV (daily): Win.Trojan.Agent-1302532
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.Ppatre.Gen.1
Kaspersky (KVRT): Trojan-Downloader.Win32.Small.fbbs

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Agent-1302532 (rule Win.Trojan.Agent-1302532) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

59422 behavior events · 2 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\budha.exe - 891613014b1cc49ed8c8ea2bbb36050ac1187dc7e594613bb7f49d90259a9394

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787805941&P2=404&P3=2&P4=gyRVZh1tNkZ3iJdZI4iut%2bLPPfxNdnkFGeVCd2oPgu%2fR9c6gTZEUwma7Us%2fdXW5UDSZaor%2fA3yHtrPNQujZVCQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787805963&P2=404&P3=2&P4=JX1%2bgsINHY318dAojmagGvhZh1y%2fQAATDSwj%2bKXHl4qO6qSF4yysOh24kexxhpHwr%2fm60n8Jc7VaJELKV6Surg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

findsupplychainmanagement.com
acesecureshop.com

Embedded IP addresses

20.42.73.31
85.210.193.152
4.230.171.124
4.144.132.114
74.178.240.61
20.184.175.17
74.178.240.51
52.123.129.14
20.76.201.171
52.123.128.14
4.150.223.113
203.26.79.13
135.233.95.80
135.233.45.222
20.89.1.13
40.79.141.154
52.148.114.188
135.234.160.245
125.56.205.11
125.56.205.56
72.145.35.99
52.123.252.234
52.110.12.30
52.110.12.24

File paths

C:\baMfg9Qq.exe
C:\vsDh99FN.exe
C:\wmHI8JTW.exe
C:\9i8zoYJ4.exe
C:\vU984Ncr.exe
C:\ATaRsR4p.exe
C:\oD0dOCph.exe
C:\sXETmWZY.exe
C:\ReVb0MrU.exe
C:\I3AcqSG9.exe
C:\Users\admin\Downloads\283e4b692714a9abb470f1fe078d264c53f118db12a33376602c8d9fd9b20722.exe
C:\fa9e20653276ca3679898059d781d89937700a46154855e8e45361f56ac512fb
C:\43ed3e3a3338571d6a2f90d73fa091e3ae87770cae2574965193f77c39f6f4cc
C:\Users\admin\Downloads\budha.exe
C:\Users\admin\Downloads\e357af6b6fc808ae7a4b41fc4caa530f0ffb548ae43f6318460755336b1debe7.exe
C:\Users\r.vult\AppData\Local\Temp\c63d375025bfcf8c43ee685edfc5765e.exe
C:\8df2c619884db29ec6fe1204bfa56f1fffd6cacacc3a826d2011bb47321f1689
C:\Users\Virtual\AppData\Local\Temp\617baf8c7e94cf9f792ab015501107238b9645e836e731d5307b00c11ca14187.exe
C:\Xyl8PtOJ.exe
C:\N0Gipv7q.exe
C:\UM5NTRUl.exe
C:\cpDJWDp4.exe
C:\Users\george\Desktop\executable.exe
C:\Users\george\Desktop\budha.exe
C:\f51ac8a85f7e4166859085f7d099b97e4643de71a7883a968153229fe97493b0

More Ppatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report