MALICIOUS — 7f632cc3b7ee162f994575e5240423c2b7ee3022759a99f7766aaf6f67268357

MALICIOUS — 7f632cc3b7ee162f994575e5240423c2b7ee3022759a99f7766aaf6f67268357 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 7 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 7f632cc3b7ee162f994575e5240423c2b7ee3022759a99f7766aaf6f67268357
SHA-1: f04e7570f6a0daaf7a2984cdc9b87caa8de8087f
MD5: ab7d343b5afd7930dd051166657f0aba
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 24576:B5hVhTzPufuKM5sLgsNkuON2B/EpFEOkB:HRn5s7KuON+/EpFkB
TLSH: T1E1506DA953271232F5FFCD646C046BAC94B2B0B82135E41D2943E87E60D5A3BEDF11A4
Submitted as: 7f632cc3b7ee162f994575e5240423c2b7ee3022759a99f7766aaf6f67268357
File type: pe · Size: 817520 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (7 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

Dropped a malicious payload (Viking): 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 34 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

54770 behavior events · 2 ATT&CK techniques · 64 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9235/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9235/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9235/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9235/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9235/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9235/files/af2eacdc5171455ac8df56f669fdede4c190d29b3ba4439ec541beda490d28eb - af2eacdc5171455ac8df56f669fdede4c190d29b3ba4439ec541beda490d28eb
/opt/CAPEv2/storage/analyses/9235/files/4a700b8e9ff57ed6b46961a5ece441b73196e920133e72bd7864afca732b4213 - 4a700b8e9ff57ed6b46961a5ece441b73196e920133e72bd7864afca732b4213
/opt/CAPEv2/storage/analyses/9235/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9235/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9235/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9235/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9235/files/98948bb68681f3c27710c49481bf91c56b177e64dae91e5704cb71ed6b5e9c3a - 98948bb68681f3c27710c49481bf91c56b177e64dae91e5704cb71ed6b5e9c3a
/opt/CAPEv2/storage/analyses/9235/files/af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98 - af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98
/opt/CAPEv2/storage/analyses/9235/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9235/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73

Embedded URLs

http://schemas.microsoft.com/SMI/2020/WindowsSettings
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786398996&P2=404&P3=2&P4=j184GwvilDz8H4ZYKC7FdlbK0pugh8IldQBeM8U7f3oav86lHE6SbB%2f47qo%2fU5PLfIv07%2b0gZM%2fwf7Lg85C%2bsA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786399055&P2=404&P3=2&P4=C20KQ8IgiC%2bDzmS4IclRoImXaV%2fkrbGbG20Ikb5GK%2f3RW6NGVhTOmF%2bad8nz0uMompWx1mrtH1R4t6fUZptsqw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
www.microsoft.com
crl.microsoft.com

Embedded IP addresses

192.168.0.30
192.168.8.1
20.42.72.131
48.211.4.16
4.144.132.223
4.230.171.124
74.178.76.128
135.232.92.97
20.184.175.15
74.178.240.61
20.165.94.46
52.123.252.247
203.26.79.13
135.234.160.244
52.110.12.37
52.110.12.55
4.150.223.108
57.155.104.224
184.84.165.171
184.84.165.136
4.243.160.21
52.148.114.188
52.110.12.25
52.110.12.26

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report