MALICIOUS — 7c63256a4b7a5c41547367c9d1f142c1847e58cabb267b810e6abaa4cd0b80ee

MALICIOUS — 7c63256a4b7a5c41547367c9d1f142c1847e58cabb267b810e6abaa4cd0b80ee is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upatre family. 3 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 7c63256a4b7a5c41547367c9d1f142c1847e58cabb267b810e6abaa4cd0b80ee
SHA-1: 2b741150a63ef50df36343d78bdef7dedfe6fe64
MD5: d9c8904eaad393446d05d418bdb28afc
imphash: dadb12329976145c6a364992dc8ec07f
ssdeep: 768:HT1g40wSXvdMx+v3fUFqFRFo6kF7xNvCMUM33ScGyTjUOXNXkchUl:Hxg2SfdMw3KeE52ayEjNDc
TLSH: T14534BDCD41AC0B6BC33A05E51672D95EA1DBF0E10EAD751A0D5CA03E90C7CA3AD52E36
Submitted as: 7c63256a4b7a5c41547367c9d1f142c1847e58cabb267b810e6abaa4cd0b80ee
File type: pe · Size: 53336 bytes
Verdict: malicious (99/100) · Family: Upatre

Detections (3 of 56 engines)

ClamAV (daily): Win.Malware.Upatre-6997924-0
Microsoft Defender: Trojan:Win32/Zbot!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.Bublik.pef

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Upatre-6997924-0 (rule Win.Malware.Upatre-6997924-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Zbot!pz (rule Trojan:Win32/Zbot!pz) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Bublik.pef (rule HEUR:Trojan.Win32.Bublik.pef) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10586 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\budha.exe - 4b38fc08b5ffae42682eb9645072c602a27a8ab5643bc6c69c4252e9ae404c02
d40932c8f30a34d3a5b8ea979887f1a65790936601c161065fe1277fb71173f5 - d40932c8f30a34d3a5b8ea979887f1a65790936601c161065fe1277fb71173f5
c93b0cea40901974146fffad888d2948b54bfc869e895659f852ba063c8287ba - c93b0cea40901974146fffad888d2948b54bfc869e895659f852ba063c8287ba

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://protecca.com/fonts/2005USdp.zip
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

protecca.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.169
52.123.252.216
4.230.171.124
20.42.179.192
4.144.132.114
20.165.94.54
4.150.223.98
135.232.92.137
135.233.95.144
172.64.154.167
79.98.25.1
72.145.35.107
52.148.114.188
52.110.12.4
52.110.12.21

File paths

C:\Users\admin\Downloads\important_document.exe
C:\ea9b2058e80dbf84d29d4fc085346cacc6edb7379006e8d34c55bd723960ff37
C:\Users\Lisa\Desktop\MWHOwraz.exe
C:\4f070fe04df6a94127a9e5ba0e81c079437fba07559dffe06547b08570752721
C:\Users\admin\Downloads\budha.exe
C:\1aehQaFr.exe
C:\50ed631a44c0fa6b39965f7ebd567bcbcbb99e07dff6fe5c4d4a6a1d46e355f6
C:\a147e4580c00005c970c7d9e0fdd11ee3aa7d08db9404da3fc4eb085b07445cc
C:\99ac3cf73cb0fce47dacff836c50fd886c9e6560311af94a2b017800bd4765e5
C:\2fcb6cebb522eeacb5363a4f37d21b520911d412870e6952822160ffc737e62c
C:\841f378daa8a4d52182113947793cfd4783308c9e56c901a6aba36e2a31d498f
C:\Documents
C:\eddc249b60b4c4e55d9e0ca92688d483fd94aecf08f474bb53dbe2ba19135ea9
C:\0b47ce78dbe7138dfe1cad47db8db7cf51d360ecae4b4dd4435c3b34d1ccf069
C:\7713915b413e88d566171adf52ce672ae06f01a4a653d2a5337f958ae30eebc0
C:\017f5c4084b0bc648262e486c0c48141201f4cef5591a5e38aeaeb9965c53b04
C:\0272afd3dd90adc44dbd982745d1ec02c6caf944747d0bfb35e334a633d573f2
C:\fa8c7fe9467b46a95b0a50707f1264ca02e1af9374057d09ecc600ccf44655ae
C:\Users\Petra\AppData\Local\Temp\budha.pe32
C:\af6fbe707f3e93439520a7acdf81dc49fb316233e85b2c5aa3e2bccb3ed86984
C:\Users\admin\Downloads\b886efcd18f04a68_budha.exe
C:\eb765c84141f57a6b6c679f50216da327f017c95abd62bcfb22ff347de1c7e76
C:\06c02b1eafbd01f400dac93647bc668f3b048c24404a082cf7ef2c482dbb3c85
C:\55b0b5b9fe349e47f052dbe8dda648f1264afb8b144fcafe788bbfa37a4cb870
C:\003781e4391db8f9e139ae9ec64fc74a26b49020017a3be956d5d47eee8faecd

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report