MALICIOUS — 897007a1c8be47dba52de49b469ab8865932d87af684e62c208f7e03afb457ae
MALICIOUS — 897007a1c8be47dba52de49b469ab8865932d87af684e62c208f7e03afb457ae is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the C83B492E family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
897007a1c8be47dba52de49b469ab8865932d87af684e62c208f7e03afb457ae - SHA-1:
5a20b203c8d0ea9d7f5535704579d691db5944f2 - MD5:
65d7fb0c2bb019fc67107ae130358a01 - imphash:
95122753ea27818b35f9b51859e4c692 - ssdeep:
49152:Qoa1taC070dqblHBw2DK48nYvWZ2OGtp3223+:Qoa1taC0dHBTDKngz1O - TLSH:
T1CB5A238A5649770DE2F6C584282C266DC841ACF7A33D298E41CFF06EB7D79673820197 - Submitted as: 897007a1c8be47dba52de49b469ab8865932d87af684e62c208f7e03afb457ae
- File type: pe · Size: 1958400 bytes
- Verdict: malicious (99/100) · Family: C83B492E
Detections (4 of 56 engines)
- ClamAV (daily): Win.Malware.Zusy-9764479-0
- Microsoft Defender: Trojan:Win32/Salgorea!pz
- Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
- Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs
MITRE ATT&CK
Why this verdict
The malicious score of 99/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule
Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:Win32/Salgorea!pz (rule
Trojan:Win32/Salgorea!pz) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Dump:Generic.Dacic.17983.C83B492E (rule
Dump:Generic.Dacic.17983.C83B492E) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule
Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 13 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Memory forensics: 6 finding(s) elsewhere in the guest, not attributed to this sample, e.g. RWX/private injected region in SppExtComObj.E (pid 5964) (rule
windows.malfind.Malfind) - memory signal, weight 0.05, confidence 0.30
Dynamic analysis (windows)
14716 behavior events · 2 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 252.0.0.224.in-addr.arpa.
- 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
- 114.223.150.4.in-addr.arpa.
- nexusrules.officeapps.live.com
- 211.110.171.150.in-addr.arpa.
- c.pki.goog
- x1.c.lencr.org
- x2.c.lencr.org
- 54.133.221.23.in-addr.arpa.
- 35.183.250.142.in-addr.arpa.
- ye.c.lencr.org
- yr.c.lencr.org
- 106.238.33.23.in-addr.arpa.
- 107.238.33.23.in-addr.arpa.
- desktop-hsgcbep
Dropped files
- C:\Users\analyst\AppData\Local\Temp\D6B8.tmp -
24e8b991dbf358d65a846c4f277cf43fba57314699e19a1316c5fb86704ce603 - 1d8094d44fdd3450ec608cb07a1b2e027fe5293dd244feae1d0a00590e0f44f1 -
1d8094d44fdd3450ec608cb07a1b2e027fe5293dd244feae1d0a00590e0f44f1
Embedded URLs
- http://schemas.microsoft.com/SMI/2005/WindowsSettings
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded domains
- 36.no
- 3.ru
- schemas.microsoft.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 4.150.223.109
- 4.150.223.114
- 72.145.35.110
- 4.150.223.97
- 72.145.35.97
- 52.148.114.188
- 20.42.179.192
- 40.79.150.121
- 20.42.65.89
- 4.150.223.111
- 13.69.109.131
- 172.172.255.217
- 172.215.188.232
- 20.42.73.25
- 4.150.223.110
- 52.110.12.22
- 4.230.171.124
- 20.247.184.197
- 40.79.150.122
File paths
- A:\t
- t:\3B
More C83B492E samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report