MALICIOUS — 7464acbc153aee6e37734a049a294499d27066cd45f064866bfb5ea2e3775d64

MALICIOUS — 7464acbc153aee6e37734a049a294499d27066cd45f064866bfb5ea2e3775d64 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 7464acbc153aee6e37734a049a294499d27066cd45f064866bfb5ea2e3775d64
SHA-1: b095ff65c586372279acaab8f668cc9900119805
MD5: 0db371fa80157665ab155b3243302218
imphash: 31521e1ad7ed29926e8a18c6d7bf206f
ssdeep: 1536:NRC7yXLfcwWX5s0MzvH81GUzJLjvUe5N8:vayXwwWJs01GUz1Tw
TLSH: T1F53BE7CE43A80F79C73A01E52B31E92E4297F0D615AD352D889E546D44C2CE39CA3DB5
Submitted as: 7464acbc153aee6e37734a049a294499d27066cd45f064866bfb5ea2e3775d64
File type: pe · Size: 102724 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): MPRESS
ClamAV (daily): Win.Dropper.Upatre-7391283-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: TrojanDownloader:Win32/Upatre!pz
Emsisoft (Emergency Kit): Trojan.Dalexis.Gen.1
Kaspersky (KVRT): Trojan.Win32.Agent.landbf

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Dropper.Upatre-7391283-0 (rule Win.Dropper.Upatre-7391283-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged TrojanDownloader:Win32/Upatre!pz (rule TrojanDownloader:Win32/Upatre!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Dalexis.Gen.1 (rule Trojan.Dalexis.Gen.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.landbf (rule Trojan.Win32.Agent.landbf) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged MPRESS (rule MPRESS) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 4 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

10130 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\koekuky.exe - 833a6d73f623eb40eff2e56f12804968d2e2e138dad3bb48d807d172c25a0df2
1736031a647fa9570c07a15965e06f2583a6ce29d1f8173ecc425e212498d300 - 1736031a647fa9570c07a15965e06f2583a6ce29d1f8173ecc425e212498d300
a03f649a0a8e11c5be5815f8900806f6cd7644cb80f31e1175ba05023bb7cd6a - a03f649a0a8e11c5be5815f8900806f6cd7644cb80f31e1175ba05023bb7cd6a
21fea51bcd623d372d1b23b376ca821dba0fd99338c5345d85eae0788f5d2ec0 - 21fea51bcd623d372d1b23b376ca821dba0fd99338c5345d85eae0788f5d2ec0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

4.150.223.110
52.230.59.222
52.123.252.203
4.230.171.124
20.42.65.94
135.233.45.222
4.247.188.233
72.154.7.111
52.110.12.16
52.148.114.188
52.110.12.52

File paths

C:\Users\john\AppData\Local\Temp\9D467D412FA86CC827D53DA14FB23446.exe
C:\268b897269d77acc5da1b9f5818b3d7ba38a55914935403bc626f0ad877fc15a
C:\8f4541eec6d1a449b49e182008e5564ab78586d3e8ae44f3524d21f5d886a283
C:\Documents
C:\Users\admin\Downloads\471b85b8cad34d2f1ddcc164dca79c8426ac05a3c6d797271ca388d436b5d956.exe
C:\bb02f4d9e3d434dca91c146f015e4db9b0f8d871f82c3f89ea015abe44a64a9d
C:\Users\admin\Downloads\koekuky.exe
C:\2b49872793166b7b21e4cd9faa2c88773342c732c993537e6948824197c4525c
C:\Users\Petra\AppData\Local\Temp\koekuky.pe32
C:\39f2e893e47f866734bdd007ae1d873e28048a01e88aa0fd03376746a97d0768
C:\f14a6e44752d72fcb5fef103e3b87343544ee865fb09431e0b493cf5e2ad5719
C:\Users\admin\Downloads\05f765f14665083d04a2eff6d6d5ec61b97acd200e34a72d985f18364b0b758b.exe
C:\Users\admin\Downloads\2a2909842c701864_koekuky.exe
C:\bd9743cc67f60c647e29e6764026235adc9dce2ffdab8c01159d4b6a2afbbb9a
C:\894752525ab16cb64ec948d46af6f1b93e6d39df9bb48a56e69a52ecb3255af9
C:\278988e9d7444f3b88a35b0826ea1c4ea70fc12b7e47a357c77a08992d619364
C:\fc963c28281ac421445da799a11d6489e087868a9e786e03c157fe77c584759a
C:\Users\admin\Downloads\124a32597477708e_koekuky.exe
C:\4e6860f098675e3744a9a3a1abf5c2cb9af691ffc3de53950156b191f4e1671a
C:\562930a149345f6e0e837a01c5ea4940cf67b24d97987b452c0ed85e203e7569
C:\7a3154eb9a62f60fa5ffd16f3fd1156872ba8cddcd5d449fa7e396536a5d5def
C:\Users\admin\Downloads\357b93032f9c82ce_koekuky.exe
C:\922d4d3d4cd4a1fe2c3bbf9ce36bc9c77c77da19ccee3ece59eb8d7f5af1d927
C:\a292fc8fb3238e6b40dc678ea6f83ed2d16a986c00f976e5c768b1f027996061
C:\bae8553b7fd95d3dcc14d0cb7e88cfa9fe983f1ef4511086ed7a4bd5acdfcbee

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report