MALICIOUS — 7b2f9631738ece7c43f547961e62f239a4757e8f4c76ccb08ea4da939882e00d

MALICIOUS — 7b2f9631738ece7c43f547961e62f239a4757e8f4c76ccb08ea4da939882e00d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7b2f9631738ece7c43f547961e62f239a4757e8f4c76ccb08ea4da939882e00d
SHA-1: 431899dc02d187d10482bddb877208a329c22faf
MD5: 601c68d17c0ff3a57d7e206f671250c5
imphash: b806352ebc796e5060cd13bc5e12711d
ssdeep: 1536:gbl0ccMBnZ6OB+dGrNjjmJ2NuKuFr1M5Br2QbCcIqZ:fMB4OB++jOKb3Z
TLSH: T1B93B91D40CE8D0A1CEA497878E8569FC058EEDABB222507419C5AA1BD7C21FF407E15F
Submitted as: 7b2f9631738ece7c43f547961e62f239a4757e8f4c76ccb08ea4da939882e00d
File type: pe · Size: 102400 bytes
Verdict: malicious (100/100) · Family: Changeup

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Worm:Win32/Vobfus.EH
Emsisoft (Emergency Kit): Gen:Variant.Pronny.2
Trellix Stinger (McAfee): Trojan-FAEI!601C68D17C0F
Kaspersky (KVRT): Trojan.Win32.Jorik.Vobfus.ahog

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.EH (rule Worm:Win32/Vobfus.EH) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Pronny.2 (rule Gen:Variant.Pronny.2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FAEI!601C68D17C0F (rule Trojan-FAEI!601C68D17C0F) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Jorik.Vobfus.ahog (rule Trojan.Win32.Jorik.Vobfus.ahog) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

42980 behavior events · 3 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\bauev.exe - 6c6256b5fd063c3ea50ee8390d6fac4ea2281690194dd9ad9974314155415897
529be74ab186df98063e155bf96a779205b8c715425e6b79a7d978d93dacde3a - 529be74ab186df98063e155bf96a779205b8c715425e6b79a7d978d93dacde3a
33924bc7eef85248e27dfe5995b1f4a55dd4107585b35a12485062ab95d69ae5 - 33924bc7eef85248e27dfe5995b1f4a55dd4107585b35a12485062ab95d69ae5
d0141d4c90fe4c121d38052e2cd92040167ea73d4b67dfc3c5db0afd4b8c8d15 - d0141d4c90fe4c121d38052e2cd92040167ea73d4b67dfc3c5db0afd4b8c8d15

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns1.spansearcher.net
ns1.spinsearcher.org
ns1.player1352.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.20
52.123.252.220
4.230.171.124
85.210.193.152
52.230.60.54
57.155.104.224
20.165.94.54
20.42.65.89
20.165.94.63
20.42.72.131
172.66.2.5
135.234.160.246
4.150.223.97
20.42.73.30
72.145.35.106
52.148.114.188
52.110.12.50
52.110.12.25

File paths

C:\Program
C:\Windows\system32;C:\Windows\system;

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report