MALICIOUS — 748_WMIGhost.bin

MALICIOUS — 748_WMIGhost.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Syndicasec family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 6b91fdb0992ca029c913092db7b4fd94c917c1473953d1ec77c74d030776fe9a
SHA-1: d59c9cac75ec52c351b7fd74ff112bb95cbeafeb
MD5: c249cb532699e15b3cb6e9deb6264240
imphash: f6ec70a295000ab0a753aa708e9439b4
ssdeep: 768:j5QGuIOFwKTMAj3cdXhwlC9h7MiR+hYHAGQ:VsIOFwKT/BlMK5WQ
TLSH: T1D7349E115322A964ED92CB67CF428DBE2423E9F574B10104B6D2D9AE5FF8C63B41B01E
Submitted as: 748_WMIGhost.bin
File type: pe · Size: 57344 bytes
Verdict: malicious (100/100) · Family: Syndicasec

Detections (6 of 52 engines)

ClamAV (daily): {MD5}bin.trojan.syndicasec.9306.UNOFFICIAL
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Syndicasec
Emsisoft (Emergency Kit): Gen:Variant.Symmi.59398
Trellix Stinger (McAfee): Trojan-Thrip!24196F6CFFDE
Kaspersky (KVRT): Trojan.Win32.DLLhijack.ei

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged {MD5}bin.trojan.syndicasec.9306.UNOFFICIAL (rule {MD5}bin.trojan.syndicasec.9306.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 6 finding(s), e.g. RWX/private injected region in WebExperienceH (pid 6052) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Syndicasec (rule Trojan:Win32/Syndicasec) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Symmi.59398 (rule Gen:Variant.Symmi.59398) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-Thrip!24196F6CFFDE (rule Trojan-Thrip!24196F6CFFDE) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.DLLhijack.ei (rule Trojan.Win32.DLLhijack.ei) - engine signal, weight 0.55, confidence 0.85
Contacted 35 external host(s) at runtime (11 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

599 behavior events · 1 ATT&CK techniques · 3 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/6123/files/bdfc1fa349f5a653d3038d2d99197be5379562b4a089dad18c6901379547e64f - bdfc1fa349f5a653d3038d2d99197be5379562b4a089dad18c6901379547e64f
/opt/CAPEv2/storage/analyses/6123/files/49c71da98f297f558e1663294dd9bb8a500321a32874908d4371e71575e872db - 49c71da98f297f558e1663294dd9bb8a500321a32874908d4371e71575e872db
0fbe37953ae336e6bd7b7184c54c81967487d2ce12905c8e4d58e5e84781b213 - 0fbe37953ae336e6bd7b7184c54c81967487d2ce12905c8e4d58e5e84781b213

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/_-4iFwfCacM.crl

Embedded domains

inference.location.live.net
content.lifecycle.office.net

Embedded IP addresses

23.40.52.85
20.42.72.131
172.215.188.232
4.150.223.107
150.171.22.17
20.190.167.66
4.230.171.124
4.247.188.233
52.230.60.54
72.154.7.248
135.232.92.97
74.178.76.128
4.150.223.105
135.232.92.137
172.178.240.162
135.233.95.80
20.11.121.11
40.115.75.193
23.198.47.52
131.253.33.203
150.171.109.17
20.42.73.26
74.226.60.120
125.56.205.24
23.198.40.44

More Syndicasec samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report