MALICIOUS — 7db231242b29eddda1b73f6ca20397469b1d1984e6b220149a49851722bc834b

MALICIOUS — 7db231242b29eddda1b73f6ca20397469b1d1984e6b220149a49851722bc834b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Urelas family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 7db231242b29eddda1b73f6ca20397469b1d1984e6b220149a49851722bc834b
SHA-1: 2ca134400df022fecedc0a8bdf6ebeaa4da1f8dd
MD5: dc73b8c3990479f1255e8ff5ac81322f
imphash: 372467513fc37686aa91f0703e76e7b1
ssdeep: 6144:85SXvBoDWoyLYyzbkPC4DYM6SB6v+qLnAzYmhwrxcvkzmSBrohX:8IfBoDWoyFblU6hAJQnOZ
TLSH: T1D649BE1CC2F26786EAF793202E508F0E70E25CDED0BE4C994793D15D26E259BD2C512A
Submitted as: 7db231242b29eddda1b73f6ca20397469b1d1984e6b220149a49851722bc834b
File type: pe · Size: 414104 bytes
Verdict: malicious (98/100) · Family: Urelas

Detections (6 of 55 engines)

ClamAV (daily): Win.Trojan.Urelas-9635181-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas.WE!MTB
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Trellix Stinger (McAfee): Corrupt-FY!DC73B8C39904
Kaspersky (KVRT): Backdoor.Win32.Plite.bhty

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-9635181-0 (rule Win.Trojan.Urelas-9635181-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

29118 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - c534eaa2a68e19339d317f9f3930fce528eca7703874071eea15895fe2e23474
C:\Users\analyst\AppData\Local\Temp\ycvyh.exe - 4277aedeb7aaef30986e4ed6f49e76db06e7ba418b0494fd5c94ffa3c0291451
C:\Users\analyst\AppData\Local\Temp\moqua.exe - 20413d39e21af25b9df0c85548625cb36e5e0e8989ff6bf11c10d7714627c72e
C:\Users\analyst\AppData\Local\Temp\ycvyh.exe - 19de479a36cacade4db66f49a9c00acfc6885d89bcfb9c8a18a04764afe098a0
C:\Users\analyst\AppData\Local\Temp\duizel.exe - 7a54449ed49d0df6c577871b2d688f83e7197f1558a7ae9ca47e2b7bd46aa06d
e83b041613b28df5d8b5535c54b27ec9d5baab39928481de908a38cdfefc9ac5 - e83b041613b28df5d8b5535c54b27ec9d5baab39928481de908a38cdfefc9ac5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787803267&P2=404&P3=2&P4=l%2bKorc77CeXFZlVcc1oV8ezu8luuRWGiRAiihbDh9W8gyLjeTzqnNoCRlIP7%2bmwD6keyeg44Ky%2bt8S7jAHN02g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787803366&P2=404&P3=2&P4=ab72%2bgAwcrbJcyX8AY%2bSizMGEnjFliKovK9TjNC8BGI3CtsyMKJhzrF0tvZtDAYr%2faTa5CQq7x%2bLGJ8YaNFhhg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
40.79.167.10
20.42.179.204
4.230.171.124
20.247.185.124
135.232.92.137
20.184.175.6
135.233.95.135
52.123.128.14
20.231.239.246
40.99.134.2
52.123.129.14
203.26.79.13
135.233.45.221
92.223.78.30
40.84.97.4
57.155.104.224
52.110.12.20
52.110.12.31
52.148.114.188
135.233.45.223
52.123.252.239

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report