MALICIOUS — 7bae201622a2fd3469b18ec98e7c94aac40c5dd27bec3fc03876aeffc33c45b7

MALICIOUS — 7bae201622a2fd3469b18ec98e7c94aac40c5dd27bec3fc03876aeffc33c45b7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Expiro family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7bae201622a2fd3469b18ec98e7c94aac40c5dd27bec3fc03876aeffc33c45b7
SHA-1: 2af3bf0a1ab8126956e41fabe0af9874881c9cca
MD5: bd2f89e5487c4b948843902b88a63c13
imphash: cae23392de80fef4078e38d18018ad3f
ssdeep: 12288:WJW2KXzJ4pdd3klnnWosPhnzqIxZoPyCK0n49HI1tmDT:WJW2KjJ4Td3kJnbsPhnzq+osk49oy
TLSH: T1A9519CEC04E36A86CE757B00A4996C4D3C63FB5D20BE60B81226C6A77AD3CC33565E15
Submitted as: 7bae201622a2fd3469b18ec98e7c94aac40c5dd27bec3fc03876aeffc33c45b7
File type: pe · Size: 835584 bytes
Verdict: malicious (100/100) · Family: Expiro

Detections (5 of 56 engines)

ClamAV (daily): Win.Virus.Expiro-9891445-0
YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure
Microsoft Defender: Virus:Win64/Expiro.PABG!MTB
Emsisoft (Emergency Kit): Win32.Expiro.Gen.6
Kaspersky (KVRT): HEUR:Virus.Win32.Expiro.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Virus.Expiro-9891445-0 (rule Win.Virus.Expiro-9891445-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Virus:Win64/Expiro.PABG!MTB (rule Virus:Win64/Expiro.PABG!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Expiro.Gen.6 (rule Win32.Expiro.Gen.6) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Virus.Win32.Expiro.gen (rule HEUR:Virus.Win32.Expiro.gen) - engine signal, weight 0.55, confidence 0.85
2 behavioral detection(s) across 2 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.43, confidence 0.90
YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 29 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12789 behavior events · 2 ATT&CK techniques · 35 dropped files.

Dropped files

C:\Windows\Sysnative\refsdedupsvc.exe - 3c89df787cf94ec3261cd94e0e3f99b4d049df28a0fb754a775a2d19aab8537c
C:\Windows\Sysnative\sensordataservice.exe - e8c621fd8d3b9b80c877f4b1237d0e41ca9783190001a0804afbbbd5c1149197
C:\Windows\SysWOW64\perfhost.exe - 7d63d6840b29f6f7a536d7af1fe4a887168f43f5565968f5859b8def533bb025
C:\Windows\Sysnative\tieringengineservice.exe - 246344a9e46f75d9ae957ac3b6e9c744a927d65cd81934ce5f94504df07eac31
C:\Windows\Sysnative\MidiSrv.exe - 00310940eff9ab45d9edd106ea9aabd99e15b3185e464cf88689190b591176d6
C:\Windows\Sysnative\vds.exe - f35540d8adbf0664bd1a9b9272d69d0a3b6471cb1dc63104cc8cd4f5a748dbd6
C:\Windows\Sysnative\msdtc.exe - e9a78ba0ce24afa5e3799ea92e478e889a85e0796a33b5de5ae20e2c63ad8a80
C:\Windows\Sysnative\Agentservice.exe - df9eda323cd16bfca6a0aa012d5a9aa8a6975c02e8719257d5202b02499e13c0
C:\Windows\Sysnative\Appvclient.exe - 784ef9463073d5778270085d842b1668ba5e862a0236ff612fb0e6a8c4509bc4
C:\Windows\SysWOW64\dllhost.exe - a3824f3c17fdf646b6ccb32e96b01933cfeff3a06bcd8dba724a5d47f71bc173
C:\Windows\Sysnative\msiexec.exe - 2fcb477a98eaf54295303080dee8a59d1a9c7b597d73e7a18f7901f73342544f
C:\program files\Google\Chrome\Application\151.0.7922.174\elevation_service.exe - e08e5ec54d4f3aaea4ff3d24dd7979ee93aefd3ea03ac859d74518bca6534dfd
C:\Windows\SysWOW64\svchost.exe - 773ee05def2fc6aef56ef3e40b47cb53efa4ffe48ac77899572297de86b98a0b
C:\Windows\Sysnative\gameinputsvc.exe - d89619871a7aabda01e4541baf234910d7fef1c44b32233a5870b3e76e835c88
C:\Windows\SysWOW64\msiexec.exe - 4956ea7107224d2f9ecce724f7e3864123b9f0ae7f86eaf284ae065f6e425985

Embedded URLs

http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.175
52.230.60.54
4.230.171.124
20.165.94.54
57.154.63.210
52.182.143.212
74.178.76.128
20.184.175.21
135.234.160.244
135.233.45.222
135.233.45.223
57.150.192.97
172.178.240.162
172.178.240.161
20.209.154.161
135.234.160.246
135.233.45.221
72.154.7.98
52.148.114.188
52.110.12.1
52.110.12.40

More Expiro samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report