MALICIOUS — 87040eb5cbe4a0a9deb0cff89066d375b2315ec718cd8d8e44a1f7b5f00d1cde

MALICIOUS — 87040eb5cbe4a0a9deb0cff89066d375b2315ec718cd8d8e44a1f7b5f00d1cde is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 6 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 87040eb5cbe4a0a9deb0cff89066d375b2315ec718cd8d8e44a1f7b5f00d1cde
SHA-1: 27bd4ab628bddba9e0413179d422a789a0ac5020
MD5: cb2bb10a77894ca94099d26132728066
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 3072:qKtfDwsjPThTYszDH2fRbUDVpz8pKIbfbar4kthVIlTb3kBluAf/tzOf8iSbRmi:BtfDwsjPThT5zL2KDLz80T2qwJ
TLSH: T18A46B5B19F5320EDD2F727A5458D648E6016397A104F8987263FC33AD6E24FB0A90573
Submitted as: 87040eb5cbe4a0a9deb0cff89066d375b2315ec718cd8d8e44a1f7b5f00d1cde
File type: pe · Size: 300456 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (6 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF
Kaspersky (KVRT): Virus.Win32.Lamer.xe

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

Dropped a malicious payload: 0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Microsoft Defender flagged Virus:Win32/Viking.MS (rule Virus:Win32/Viking.MS) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent.FPMF (rule Trojan.Agent.FPMF) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://repository.certum.pl/ctnca2.cer09, http://www.certum.pl/CPS0, http://repository.certum.pl/ccsca2021.cer0 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

55438 behavior events · 2 ATT&CK techniques · 61 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9197/files/e7504fe0842b241a24fed6b303a66e2158f6fc8e865d0a851ce0c1544b55550b - e7504fe0842b241a24fed6b303a66e2158f6fc8e865d0a851ce0c1544b55550b
/opt/CAPEv2/storage/analyses/9197/files/2e8f526aac5b5b183eb78aa2b7b1638b21e2ebfa55410a204a76c1b24c69201f - 2e8f526aac5b5b183eb78aa2b7b1638b21e2ebfa55410a204a76c1b24c69201f
/opt/CAPEv2/storage/analyses/9197/files/bf0ec9166603a9b4bbf759ed0f0d5d8f46f86aafa3877a6d321be17d463539bf - bf0ec9166603a9b4bbf759ed0f0d5d8f46f86aafa3877a6d321be17d463539bf
/opt/CAPEv2/storage/analyses/9197/files/45fe762d4810946d6b7435ce152ec5225b80a44d13e675a0c4666be2e2d76ae9 - 45fe762d4810946d6b7435ce152ec5225b80a44d13e675a0c4666be2e2d76ae9
/opt/CAPEv2/storage/analyses/9197/files/6ec0ebf58e90cdb019370847732896d7470d156c7e7784e73505402a5781a126 - 6ec0ebf58e90cdb019370847732896d7470d156c7e7784e73505402a5781a126
/opt/CAPEv2/storage/analyses/9197/files/0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f - 0e30c51ac086b6b5dae2ae7039af88c090316805aa0927ab4e2f007895f3841f
/opt/CAPEv2/storage/analyses/9197/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9197/files/ca1fbad26442aea1cffb124718ed84d251d7b009bfd2fb57adbcf8d72a1de4b3 - ca1fbad26442aea1cffb124718ed84d251d7b009bfd2fb57adbcf8d72a1de4b3
/opt/CAPEv2/storage/analyses/9197/files/78331b1d758d6b25517713c934929dd55dcf204f548b508d37eae445fe2eff03 - 78331b1d758d6b25517713c934929dd55dcf204f548b508d37eae445fe2eff03
/opt/CAPEv2/storage/analyses/9197/files/134ae6efb90acaaf4fa9e214952f9ddace62e647ff56f684b4fb9c2b8d61be6c - 134ae6efb90acaaf4fa9e214952f9ddace62e647ff56f684b4fb9c2b8d61be6c
/opt/CAPEv2/storage/analyses/9197/files/96a276969e2ef1df698b4e25df03e5bf0b404b13e018b42a2640db94ba4fecf1 - 96a276969e2ef1df698b4e25df03e5bf0b404b13e018b42a2640db94ba4fecf1
/opt/CAPEv2/storage/analyses/9197/files/c2a8c85d2aa32104b4c524d35a39330a185702716249030f75cc723fc0c7e548 - c2a8c85d2aa32104b4c524d35a39330a185702716249030f75cc723fc0c7e548
/opt/CAPEv2/storage/analyses/9197/files/d111c78169c9b0dde81770c59c9d8ff2d00ce6f434e35aa545d58bdace2f0397 - d111c78169c9b0dde81770c59c9d8ff2d00ce6f434e35aa545d58bdace2f0397
/opt/CAPEv2/storage/analyses/9197/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9197/files/fd900c41fb57cdbcbb96c9fbbc3c9c86cbabbce86022785cafa5cee6fe55d16f - fd900c41fb57cdbcbb96c9fbbc3c9c86cbabbce86022785cafa5cee6fe55d16f

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl.certum.pl/ctnca2.crl0l
http://repository.certum.pl/ctnca2.cer09
http://www.certum.pl/CPS0
http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
http://repository.certum.pl/ccsca2021.cer0
https://www.certum.pl/CPS0
http://subca.repository.certum.pl/ctsca2021.cer0
http://subca.crl.certum.pl/ctsca2021.crl0
http://crl.certum.pl/ctnca.crl0k
http://repository.certum.pl/ctnca.cer09
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786396884&P2=404&P3=2&P4=DSA6hzzqNLgUxtxXO5eg0B0RHnVAbwOUHl%2fWPGP98ydB9cPMUFF6dED3Vxmc2FpUy5HzNMuQqMtX0QzpQXgK3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786396945&P2=404&P3=2&P4=TD%2fSfBqPATPfvYKkHnB2DpDVFLUCG0JKfng2UMFUN3y95R0ZKJXWKwCRz92ZzbV83FO2jPju9f5ndW1mO4EMbg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
crl.certum.pl
repository.certum.pl
www.certum.pl
ccsca2021.crl.certum.pl
subca.repository.certum.pl
subca.crl.certum.pl

Embedded IP addresses

192.168.0.30
192.168.8.1
26.2.5.2
20.89.1.13
4.230.171.124
4.247.188.233
52.253.84.76
20.42.179.204
20.165.94.63
20.89.1.10
74.178.76.54
135.233.95.80
20.42.73.28
203.26.79.13
135.234.160.246
172.178.240.161
184.84.165.171
184.84.165.136
72.145.35.100
52.148.114.188
52.110.12.38
52.110.12.30

File paths

E:\build\workdir\LinkTarget\Executable\soffice_safe.pdb

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report