MALICIOUS — 75e3d261cf51cb3ebe4d701742f925e935a11ca23f4e0c64c0db89776e49a645

MALICIOUS — 75e3d261cf51cb3ebe4d701742f925e935a11ca23f4e0c64c0db89776e49a645 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 75e3d261cf51cb3ebe4d701742f925e935a11ca23f4e0c64c0db89776e49a645
• SHA-1: 5dbb947fa716d1207e605f5090a1ecabdc76fa14
• MD5: cf3a5b29df9a50484cc748251614bc4c
• imphash: 446f0aabccc2b063b4bb6671b1bfa4a3
• ssdeep: 1536:UP3W8ivSI3wcP3oAeiCX6tEG7a9GjB4tnYmy1DZeKM/:HSLqCXKgGjYnBy1g/
• TLSH: T1FD3FD8C11DA78106F9B2B10B3D84587D958E055AED2E68F5A38F863F08E717B607206F
• Submitted as: 75e3d261cf51cb3ebe4d701742f925e935a11ca23f4e0c64c0db89776e49a645
• File type: pe · Size: 163840 bytes
• Verdict: malicious (100/100) · Family: Changeup

Detections (5 of 56 engines)

• ClamAV (daily): Win.Trojan.Changeup-6169544-0
• Microsoft Defender: Worm:Win32/Vobfus.FQ
• Emsisoft (Emergency Kit): Win32.Worm.VB.OAE
• Trellix Stinger (McAfee): VBObfus.ek
• Kaspersky (KVRT): Worm.Win32.WBNA.ipa

MITRE ATT&CK

• T1547.001
• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
• 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
• Microsoft Defender flagged Worm:Win32/Vobfus.FQ (rule Worm:Win32/Vobfus.FQ) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Win32.Worm.VB.OAE (rule Win32.Worm.VB.OAE) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged VBObfus.ek (rule VBObfus.ek) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged Worm.Win32.WBNA.ipa (rule Worm.Win32.WBNA.ipa) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 2 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

50450 behavior events · 3 ATT&CK techniques · 4 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• ns1.chopzones.com
• ns1.chopzones.net
• ns1.chopzones.org
• ns1.chopzones.biz
• ns1.chopzones.info
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• default.exp-tas.com
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com

Dropped files

• C:\Users\analyst\xykuc.exe - 200bab9495331a1e342e94ab9dc80418212ee6c33934ecf15db2ec9dbebc1e3b
• a32bcf094e6fb4675ecd7444f5503828b0191ab3cf3b13a2544960b46f7d2cce - a32bcf094e6fb4675ecd7444f5503828b0191ab3cf3b13a2544960b46f7d2cce
• c3e82e9e3f0c7d9394d64f8d6190db9afa749cc2535b9a9b685ea673fb5acacf - c3e82e9e3f0c7d9394d64f8d6190db9afa749cc2535b9a9b685ea673fb5acacf
• c06ecb64f61ba0813fd0aea271592fa400951572f827841adaee1c75c9ce3361 - c06ecb64f61ba0813fd0aea271592fa400951572f827841adaee1c75c9ce3361

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
• http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• www.vbfx.net
• www.planetsourcecode.com
• aol.com
• ns1.chopzones.com
• ns1.chopzones.net
• ns1.chopzones.org
• ns1.chopzones.biz
• ns1.chopzones.info
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• default.exp-tas.com

Embedded IP addresses

• 104.208.16.94
• 52.123.252.225
• 4.230.171.124
• 135.233.95.144
• 48.211.4.16
• 135.232.92.97
• 52.230.60.54
• 20.42.73.30
• 104.18.33.89
• 92.223.78.30
• 172.175.111.170
• 4.150.223.106
• 135.234.160.244
• 203.26.79.13
• 20.184.175.9
• 4.150.223.114
• 51.132.193.105
• 52.148.114.188
• 172.172.255.217
• 72.154.7.96
• 52.110.12.2
• 52.110.12.15

File paths

• C:\Program
• c:\windows\desktop\

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report