MALICIOUS — 6d3733fc479c1cc5fd0761c783b376f3b15e3f9e454a4b77e99cf0c2baca2098

MALICIOUS — 6d3733fc479c1cc5fd0761c783b376f3b15e3f9e454a4b77e99cf0c2baca2098 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 8 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

• SHA-256: 6d3733fc479c1cc5fd0761c783b376f3b15e3f9e454a4b77e99cf0c2baca2098
• SHA-1: de829817d47bdad2a877d2a456a558b97118f913
• MD5: 24dfe2b633a0d1103d519c74efc35b2d
• imphash: 09d0478591d4f788cb3e5ea416c25237
• ssdeep: 6144:6YEoo/4rnzsBw+EwKEnePrNqhdFvmNpqB/A8/QJQCe2zdRQ0yhmcvZpIwiGIjKC:6uHrcYPkePhqpvmaBvYJQCe2I9fgGdC
• TLSH: T1DD49230C5A95BF57DB3F1F04A43CE60FB645BA6E42E47C0B0813925A1E6603BA59321F
• Submitted as: 6d3733fc479c1cc5fd0761c783b376f3b15e3f9e454a4b77e99cf0c2baca2098
• File type: pe · Size: 412160 bytes
• Verdict: malicious (100/100) · Family: Urelas

Detections (8 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): Win.Trojan.Urelas-6997280-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Detect It Easy (packer/type): DIE:Turbo Linker
• Microsoft Defender: Trojan:Win32/SystemBC.psyT!MTB
• Emsisoft (Emergency Kit): Generic.Urelas.C3A39B5E
• Trellix Stinger (McAfee): Obfuscated-FKS!hb
• Kaspersky (KVRT): HEUR:Trojan.Win32.Wecod.gen

MITRE ATT&CK

• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Urelas-6997280-0 (rule Win.Trojan.Urelas-6997280-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/SystemBC.psyT!MTB (rule Trojan:Win32/SystemBC.psyT!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Generic.Urelas.C3A39B5E (rule Generic.Urelas.C3A39B5E) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Obfuscated-FKS!hb (rule Obfuscated-FKS!hb) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Wecod.gen (rule HEUR:Trojan.Win32.Wecod.gen) - engine signal, weight 0.55, confidence 0.85
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
• Contacted 34 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:.text, Turbo Linker - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in tsk_019c3a9b4f (pid 3536) (rule windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

26303 behavior events · 1 ATT&CK techniques · 1 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• 209.52.40.23.in-addr.arpa.
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• tas02.sls.update.microsoft.com
• v10.events.data.microsoft.com
• 144.95.233.135.in-addr.arpa.
• d.1.d.1.c.4.2.1.4.9.5.2.6.e.8.b.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 85.65.42.20.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.

Dropped files

• 47ffab81c3345ffa758ff1fd40f3b27486b13cc1e43d667b8a396d877b8c56b3 - 47ffab81c3345ffa758ff1fd40f3b27486b13cc1e43d667b8a396d877b8c56b3

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• r.ga
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 52.123.128.14
• 135.233.95.144
• 48.211.4.16
• 203.26.79.13
• 172.215.188.225
• 20.42.65.85
• 72.145.35.101
• 52.148.114.188
• 52.168.112.66
• 20.42.65.93
• 20.184.175.1
• 135.233.95.80
• 74.179.77.204
• 20.184.175.18
• 20.184.175.22
• 172.215.188.232
• 85.210.193.152
• 72.145.35.97
• 72.145.35.107
• 51.132.193.105
• 20.50.201.195
• 20.184.175.5
• 20.50.201.203
• 51.116.253.169
• 57.154.63.210

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report