MALICIOUS — 7fc19feba29b3c4365283aec4a95f2a4a4be93f14667b30e1d93708f68148312

MALICIOUS — 7fc19feba29b3c4365283aec4a95f2a4a4be93f14667b30e1d93708f68148312 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 8 of 25 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: 7fc19feba29b3c4365283aec4a95f2a4a4be93f14667b30e1d93708f68148312
SHA-1: c32f6252a49fb1d76755144ffeffcf1e5bc8d47d
MD5: bf27f63c57f9500eac8655ad1fead235
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 49152:HdrvZVOUpWEL1PhveubbG2JEOZJgq/LpqyePuTBIZdh9ARJs6dmfgTw1iGSsggvJ:CWO4UcRBBs39G0Q5KH9
TLSH: T189626C9A00177022D0F5ED45B821C9DDC063F95999349DCEC243DA2BD1A9E6BBBE00F6
Submitted as: 7fc19feba29b3c4365283aec4a95f2a4a4be93f14667b30e1d93708f68148312
File type: pe · Size: 4586312 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (8 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: Trellix/McAfee ATR: ATR_REvil_Sodinokibi
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 21 weighted signals:

Dropped a malicious payload (Viking): 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Memory forensics: 4 finding(s), e.g. RWX/private injected region in svchost.exe (pid 916) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 35 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: Trellix/McAfee ATR flagged ATR_REvil_Sodinokibi (rule ATR_REvil_Sodinokibi) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: https://perfetto.dev/docs/contributing/getting-started#community, https://crashpad.chromium.org/, https://crashpad.chromium.org/bug/new - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
inject code into another process (rule inject code into another process) - capa signal, weight 0.12, confidence 0.60
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

55691 behavior events · 2 ATT&CK techniques · 64 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9276/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9276/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9276/files/645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3 - 645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3
/opt/CAPEv2/storage/analyses/9276/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9276/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9276/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9276/files/38271223fc3d35be7fc12d5ca017a500fb37f1a121e63705e4adab19263effb6 - 38271223fc3d35be7fc12d5ca017a500fb37f1a121e63705e4adab19263effb6
/opt/CAPEv2/storage/analyses/9276/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9276/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9276/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9276/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9276/files/af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98 - af4c1d1de549cc7999310c4ee9fc5d8ba03e3c29b522ee0a3ebf9fe548bfde98
/opt/CAPEv2/storage/analyses/9276/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9276/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73
/opt/CAPEv2/storage/analyses/9276/files/713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210 - 713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210

Embedded URLs

https://perfetto.dev/docs/contributing/getting-started#community
https://test-umwatsonc.events.data.microsoft.com/telemetry.request
https://test-kmwatsonc.events.data.microsoft.com/telemetry.request
https://nw-umwatson.events.data.microsoft.com/Telemetry.Request
https://crashpad.chromium.org/
https://crashpad.chromium.org/bug/new
http://www.w3.org/2000/xmlns/
http://www.w3.org/XML/1998/namespace
http://www.w3.org/TR/REC-html40/loose.dtd
http://schemas.microsoft.com/SMI/2020/WindowsSettings
https://www.microsoft.com
http://www.microsoft.com/pki/certs/MicRooCerAut_2010-06-23.crt0
https://watson.telemetry.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786401682&P2=404&P3=2&P4=PIK%2f0zvVi6IA4qqWKwEdMfhQUYL2Z%2bgYzxNPntAeXZAS5jpuwktR4LCL9Rf1RXC8Lpymp%2fSOGcUfaYILN%2fhppw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786401732&P2=404&P3=2&P4=Fl2QzgUxMzf4G86TgzmbiRrYeyMoQU%2bdz3DKheUWEDsPJ24mRawEJfn5Rk9o4ioR2Wr3D952%2fvEThUuNSr7BCw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

openssl.org
mutex.cc
field.cc
time.cc
utils.cc
rds.descriptor.name
descriptor.name
perfetto.dev
regex.cc
allocator.cc
executor.cc
parser.cc
test-umwatsonc.events.data.microsoft.com
test-kmwatsonc.events.data.microsoft.com
nw-umwatson.events.data.microsoft.com
crashpad.chromium.org
blink.net
registry.cc
values.cc
thread.cc
sequence.cc
regexp.cc
re2.cc
tostring.cc
simplify.cc

Embedded IP addresses

192.168.0.30
192.168.8.1
0.0.0.1
57.155.104.224
40.74.98.198
4.230.171.124
40.84.85.40
20.247.184.142
135.232.92.137
135.232.92.97
4.150.223.106
172.178.240.161
203.26.79.13
172.178.240.163
52.123.252.239
74.179.71.159
52.123.252.243
20.42.179.204
40.79.163.154
4.150.223.97
184.84.165.136
72.153.5.136
52.148.114.188
52.110.12.48
52.110.12.37

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report