MALICIOUS — D4DA.tmp

MALICIOUS — D4DA.tmp is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Cuegoe family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 87567061ca5846c29986c056a74cd3c108fe63aa061b8358dac4d974623684f5
SHA-1: c3f1630fbfdef809bf233d7f4c50dacbb9221c93
MD5: d14375dd79868e18d82e6e3e79f0b559
imphash: 6dca3e9fb3928bbdb54dbce669943ec8
ssdeep: 12288:wU5rCOTeiDB0PyQqc5cMlXiGNZ+3/v+I9hUG2VA:wUQOJDBTGXFiGNGEA
TLSH: T1284EE1CE9100F781D9739F2225545DCD24A278C2A8753E8C0BD2F03B17B5D27BC6A5AA
Submitted as: D4DA.tmp
File type: pe · Size: 667648 bytes
Verdict: malicious (97/100) · Family: Cuegoe

Detections (4 of 55 engines)

ClamAV (daily): Win.Trojan.Cuegoe-6336261-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: TrojanDownloader:Win32/Upatre
Kaspersky (KVRT): HEUR:Backdoor.Win32.Salgorea.gen

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 97/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Trojan.Cuegoe-6336261-0 (rule Win.Trojan.Cuegoe-6336261-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 21 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

2795 behavior events · 1 ATT&CK techniques · 31 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\68B3.tmp - d1102d971989c5bc0a12693d0499eaf2fc8a3d7bc008aab0540f00b5b65a68e9
C:\Users\analyst\AppData\Local\Temp\D845.tmp - 714a47ef6bfa91cb13349dca8ab0965acb25340c57c81d2250499aaa86be1c8c
C:\Users\analyst\AppData\Local\Temp\D992.tmp - a19b182a07f639c644756baa789f292e9743f6a6a49bcc1833809d6582df2e19
C:\Users\analyst\AppData\Local\Temp\BA42.tmp - f4ae0ddb0a9cb9aea3b79e1de9513628de1d4a29385e67842807ede4074c37bf
C:\Users\analyst\AppData\Local\Temp\62DB.tmp - 9eb7733397a00a87e1cfbc4db27d4823c5f22eb2caf2b2d153230bc2316bc089
C:\Users\analyst\AppData\Local\Temp\195F.tmp - d911b801fa46496b64c90a71354b0722737bb90dc374757f475d1d013fbe5d5c
C:\Users\analyst\AppData\Local\Temp\F306.tmp - f3305df8795132350a93c3e8f8c76cf63a10e729c8c4a21ad1d946a9ea46f82a
C:\Users\analyst\AppData\Local\Temp\C4DC.tmp - e1032f5183450cadb6ba9134107eeec82a7472f828b57162c39216a4754af2e3
C:\Users\analyst\AppData\Local\Temp\8112.tmp - 0977d455b5a487e012809e6ff415116472e2c6b075422725e8bdfed4996a7e5a
C:\Users\analyst\AppData\Local\Temp\C83C.tmp - 40adc4a611c27910b0f6117c432e21bc2c3d5325cf857e936c14c87bb995b905
C:\Users\analyst\AppData\Local\Temp\2565.tmp - b68c32b7c0f842c038d2821e1424f16776219bfbffb85899eb580be0e53b5a62
C:\Users\analyst\AppData\Local\Temp\B13A.tmp - ad9256ab0377ef66487fcc5a0b77db397c11130f40cf9720e44c68bfd84173cd
C:\Users\analyst\AppData\Local\Temp\503E.tmp - 8230fdcaaa5048083ae164fc132b0d5425508844e16e7014a1c9fe8b1795d96f
C:\Users\analyst\AppData\Local\Temp\2E88.tmp - 8c3942b9e087047f9e6dbfec8302aaa03f696504cb4298560e4bf090ff87e373
C:\Users\analyst\AppData\Local\Temp\9843.tmp - e40c6af56d7c5674d07f6e990084e9b535e08dd67782f7e4ea35dc4bc9598588

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/ado/2007/08/dataservices/metadata
http://schemas.microsoft.com/ado/2007/06/edmx
http://schemas.microsoft.com/ado/2006/04/edm
http://schemas.microsoft.com/ado/2007/05/edm
http://schemas.microsoft.com/ado/2008/01/edm
http://www.w3.org/2001/XMLSchema-instance
http://schemas.microsoft.com/ado/2008/01/edm:OpenType
http://schemas.microsoft.com/ado/2008/09/edm
http://schemas.microsoft.com/ado/2006/04/edm/ssdl
http://schemas.microsoft.com/ado/2009/02/edm/annotation
http://schemas.microsoft.com/ado/2007/08/dataservices/scheme
http://www.w3.org/2005/Atom
http://www.w3.org/2000/xmlns/
http://schemas.microsoft.com/ado/2006/04/edm/ssdl:StoreGeneratedPattern
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787722097&P2=404&P3=2&P4=kCB4uWH8VNHIQtVheD1DlGnRrGBYSMLYr%2bvXlRuEUH9NE3oW2srNz%2fQ6KEPxx14AgBQWdwJNDvHJLv8ck1c1vw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787722217&P2=404&P3=2&P4=Mn8gqMCl9rlHh%2bmfYui1NNkarbTNiETBKl0myrq2fSNFrvoQC7moGG14iivU7qDy2h1i0mvPRVRJtXnjNHL%2fdg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
www.w3.org

Embedded IP addresses

20.52.64.201
4.247.188.233
4.230.171.124
20.247.184.142
135.232.92.137
135.232.92.97
20.42.73.30
20.231.239.246
40.99.133.210
52.123.128.14
52.123.129.14
52.123.252.203
135.234.160.245
203.26.79.13
40.79.141.153
52.148.114.188
135.233.95.80
72.153.5.132
135.232.92.34
52.110.12.52
52.110.12.56

File paths

D:\:p:
f:\dd\tools\devdiv\EcmaPublicKey.snk
U:\:c:j:q:x:
P:\:d:

More Cuegoe samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report