MALICIOUS — 923c9a059ad190fb4c4370b92490ac0ff54071d3d398bd0953234b5296cca6e7

MALICIOUS — 923c9a059ad190fb4c4370b92490ac0ff54071d3d398bd0953234b5296cca6e7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Viking family. 6 of 25 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 923c9a059ad190fb4c4370b92490ac0ff54071d3d398bd0953234b5296cca6e7
SHA-1: 429d0302847ce487987515720abfb73d780c03d6
MD5: a1cafaf6a990ea7b7e7158258279b227
imphash: 31d1c48ee7d8e07a5706e963146db875
ssdeep: 6144:BtfDwsjPThT5zL2qMGOulmupXUG3ZYTs1MVZB91oqMZHuAx9R9zF32b3mkWQR6p:B5hVNOTs10ZC9qRzQ/rBnTWSq
TLSH: T1724D39B08F1301EDE2FB6668959C248D9016747A610F844B72AFD63EC1E1DFF86A0563
Submitted as: 923c9a059ad190fb4c4370b92490ac0ff54071d3d398bd0953234b5296cca6e7
File type: pe · Size: 583592 bytes
Verdict: malicious (100/100) · Family: Viking

Detections (6 of 25 engines)

YARA: MalwareAnalyser built-in: Windows_Injection_Api_Combo
YARA: JPCERT/CC: JPCERT_Emotet
YARA: MalwareAnalyser community pack: TL_Shellcode_VirtualAlloc_Exec
Kaspersky (KVRT): Virus.Win32.Lamer.xe
Microsoft Defender: Virus:Win32/Viking.MS
Emsisoft (Emergency Kit): Trojan.Agent.FPMF

MITRE ATT&CK

YARA

Windows_Injection_Api_Combo

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

Dropped a malicious payload (Viking): 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - dynamic signal, weight 0.80, confidence 0.90
Process injection API combination (rule Windows_Injection_Api_Combo) - yara signal, weight 0.65, confidence 0.90
Kaspersky (KVRT) flagged Virus.Win32.Lamer.xe (rule Virus.Win32.Lamer.xe) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 33 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_Emotet (rule JPCERT_Emotet) - engine signal, weight 0.35, confidence 0.70
YARA: MalwareAnalyser community pack flagged TL_Shellcode_VirtualAlloc_Exec (rule TL_Shellcode_VirtualAlloc_Exec) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://repository.certum.pl/ctnca2.cer09, http://www.certum.pl/CPS0, http://repository.certum.pl/ccsca2021.cer0 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

57459 behavior events · 2 ATT&CK techniques · 68 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9268/files/224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e - 224897747f9230bb490083fff22f31a43c90c98aca0eb57c471f48d47c56903e
/opt/CAPEv2/storage/analyses/9268/files/089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5 - 089151cb1077034b1f7ac161265281bfa4f9e0d3eceb3b96f828bb2e6255cdc5
/opt/CAPEv2/storage/analyses/9268/files/645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3 - 645e84f031f2cdd623bb342fa256fe2bb64d4ce4688f0c11a530b602fcbf1db3
/opt/CAPEv2/storage/analyses/9268/files/d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28 - d63702fe0bd5bf7e5cafddd58349a625036e9b70e78d6d80d1d6a897b9dbad28
/opt/CAPEv2/storage/analyses/9268/files/bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
/opt/CAPEv2/storage/analyses/9268/files/4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756 - 4b4aff4267767008ed9c511c369a6e01000452e5d8e2330d95689af0e35f8756
/opt/CAPEv2/storage/analyses/9268/files/821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb - 821183c2603bd5e6b268762844a45925764da6ec051dcb69a148dc0327cf8aeb
/opt/CAPEv2/storage/analyses/9268/files/bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510 - bcce98670e14be492001f9eaa24bdbc79542e3a0a0a306e9606dc8de1be3f510
/opt/CAPEv2/storage/analyses/9268/files/13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a - 13062a6adc45371149c5b205cf86b0b5f663b39771fc704129783c87cbf7b01a
/opt/CAPEv2/storage/analyses/9268/files/c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
/opt/CAPEv2/storage/analyses/9268/files/98948bb68681f3c27710c49481bf91c56b177e64dae91e5704cb71ed6b5e9c3a - 98948bb68681f3c27710c49481bf91c56b177e64dae91e5704cb71ed6b5e9c3a
/opt/CAPEv2/storage/analyses/9268/files/0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b - 0d314ba4c190c9b47945aa09bcf9d37d407f16b94944e5669dcd79245bcd935b
/opt/CAPEv2/storage/analyses/9268/files/af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73 - af9809d2f5f78db7e5bbe36497225f46a820f773710aa2beca4282669f360e73
/opt/CAPEv2/storage/analyses/9268/files/cd7e92cf52fb5abb76e6ae39b79dd406d33ec508d1821b113f45e47cf1bb1e4d - cd7e92cf52fb5abb76e6ae39b79dd406d33ec508d1821b113f45e47cf1bb1e4d
/opt/CAPEv2/storage/analyses/9268/files/713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210 - 713880aa1376670acde86e61051b770266f68c260846083a2dae59a42cc9c210

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://crl.certum.pl/ctnca2.crl0l
http://repository.certum.pl/ctnca2.cer09
http://www.certum.pl/CPS0
http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
http://repository.certum.pl/ccsca2021.cer0
https://www.certum.pl/CPS0
http://subca.repository.certum.pl/ctsca2021.cer0
http://subca.crl.certum.pl/ctsca2021.crl0
http://crl.certum.pl/ctnca.crl0k
http://repository.certum.pl/ctnca.cer09
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786401147&P2=404&P3=2&P4=gVdguKXafZMZ9d%2bQchf8SlbKQQSN9zKYPE9TZeqyj2byd5%2f4kp7Sb1W7pzJwZry81OoFIXDGqAG45V11cKwy5Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786401194&P2=404&P3=2&P4=itlzLPsqaItR%2b2LE%2fNAWVbH0Z%2fHtZ%2be1u64k0vboWkWU3ArKKeSNcq3fl8lQA9uJ6lEFg7mP8VhpYrP5yCB5cw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
crl.certum.pl
repository.certum.pl
www.certum.pl
ccsca2021.crl.certum.pl
subca.repository.certum.pl
subca.crl.certum.pl

Embedded IP addresses

192.168.0.30
192.168.8.1
26.2.5.2
52.168.117.169
4.230.171.124
85.210.196.11
4.144.132.223
74.178.240.61
135.232.92.97
52.182.143.212
172.178.240.161
203.26.79.13
135.233.45.222
135.232.92.34
184.84.165.136
72.145.35.101
52.168.112.66
52.148.114.188
135.233.95.80
52.110.12.49
4.150.223.106
52.110.12.3

File paths

E:\build\workdir\UnpackedTarball\boost\boost/property_tree/ini_parser.hpp
E:\build\workdir\UnpackedTarball\boost\boost/property_tree/string_path.hpp
E:\build\workdir\LinkTarget\Executable\soffice.pdb

More Viking samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report