MALICIOUS — 772271b5ab1e7a8fe2949d23f9b6779ad9b7f83b3ea82262838a5d3dea58865b

MALICIOUS — 772271b5ab1e7a8fe2949d23f9b6779ad9b7f83b3ea82262838a5d3dea58865b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 6 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 772271b5ab1e7a8fe2949d23f9b6779ad9b7f83b3ea82262838a5d3dea58865b
SHA-1: dd3c9f2cc52713199233738d3da71158eb57af5b
MD5: e616f1b2397bf78f4aedf44e0e5b5e4e
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 6144:BtfDwsjPThT5zL2bQDRgct/sxgfawA8JJuvJ9poEgffOtA9mgBPnE:B5hVXDRgMsxAjpnE
TLSH: T12D476B18B7AE1141DAF1EA60FC805ADC6CB2E47EA072D18C9D43D56E72F4A3BD0B1116
Submitted as: 772271b5ab1e7a8fe2949d23f9b6779ad9b7f83b3ea82262838a5d3dea58865b
File type: pe · Size: 327560 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (6 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

Dropped a malicious payload (Viking): 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 36 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

55866 behavior events · 2 ATT&CK techniques · 70 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9261/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9261/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9261/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9261/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9261/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9261/files/38271223fc3d35be7fc12d5ca017a500fb37f1a121e63705e4adab19263effb6 - 38271223fc3d35be7fc12d5ca017a500fb37f1a121e63705e4adab19263effb6
/opt/CAPEv2/storage/analyses/9261/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9261/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9261/files/00a0f4d28f25ed6404e9d0a28938abfa9fbbbb670f485ee82d4fd004f64dce76 - 00a0f4d28f25ed6404e9d0a28938abfa9fbbbb670f485ee82d4fd004f64dce76
/opt/CAPEv2/storage/analyses/9261/files/30ff73fbe5eaa5ee96e8c20fbdabcd579decc9d7142697f1d3deed932e0acff2 - 30ff73fbe5eaa5ee96e8c20fbdabcd579decc9d7142697f1d3deed932e0acff2
/opt/CAPEv2/storage/analyses/9261/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9261/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9261/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9261/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73
/opt/CAPEv2/storage/analyses/9261/files/713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210 - 713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210

Embedded URLs

http://schemas.microsoft.com/SMI/2020/WindowsSettings
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786400760&P2=404&P3=2&P4=DaolB7Sf3Zx4zIA3Jxba%2b8Fe7uL6LZByLDwrDNXukHxvmmAbEDqhY1o%2bnKxB9qdm%2fQfvzcPYd3sIg9UDvOidOg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786400808&P2=404&P3=2&P4=MA9cOaA5kQKlZgjhh%2bBHP2q6E%2fJm7u6tfx%2f0V08wLwiIj%2f9XzOhd2IQiJVYoLp6iW36NPNxX4Ahkn8a3fmVpag%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
www.microsoft.com
crl.microsoft.com

Embedded IP addresses

192.168.0.30
192.168.8.1
20.42.65.84
52.253.84.76
4.230.171.124
85.210.193.152
74.178.76.128
4.150.223.108
74.178.240.51
104.46.162.229
135.234.160.246
203.26.79.13
52.123.252.203
74.178.232.29
52.123.252.244
184.84.165.136
4.243.160.21
40.84.97.4
4.150.223.110
20.42.65.89
52.110.12.52
52.148.114.188
135.233.95.80
52.110.12.22
52.110.12.51

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report