MALICIOUS — 925e780a304b154bd24b49986620ebe1ea127057dae6227bc005650dd33ef543

MALICIOUS — 925e780a304b154bd24b49986620ebe1ea127057dae6227bc005650dd33ef543 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 8 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 925e780a304b154bd24b49986620ebe1ea127057dae6227bc005650dd33ef543
SHA-1: 54d002162253dc62a8522665174da669e9d2abf4
MD5: 8a10d7274a755c72fc73c04b5f86b535
imphash: 9e218d6f007cb4da304f11b6b2d58dbe
ssdeep: 1536:Zwhq8V9IpPf2lgiIJ4pivJnuNVueC39GdBR3MU:ZqV9MziU4piRun7C3CP3MU
TLSH: T10A3A169DC5F227C8DBE323341F25841D2CE44DD8C17F8C660A86E164A7E2A67E1D609B
Submitted as: 925e780a304b154bd24b49986620ebe1ea127057dae6227bc005650dd33ef543
File type: pe · Size: 93257 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Malware.Urelas-6717394-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: Trojan:Win32/Urelas!pz
Emsisoft (Emergency Kit): Gen:Heur.Mint.SP.Urelas.1
Trellix Stinger (McAfee): Obfuscated-FAQF!9883DC86EF9D
Kaspersky (KVRT): Backdoor.Win32.Plite.bhtm

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Malware.Urelas-6717394-0 (rule Win.Malware.Urelas-6717394-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.SP.Urelas.1 (rule Gen:Heur.Mint.SP.Urelas.1) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Obfuscated-FAQF!9883DC86EF9D (rule Obfuscated-FAQF!9883DC86EF9D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Plite.bhtm (rule Backdoor.Win32.Plite.bhtm) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

15633 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\huter.exe - 2475d51b4f319686e7bc70b7b6caacbc78af85b11272fbd9e62c59d04e452ce0
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 77fcdadc9ba56daa81edb3f0ef876e38a8c7de56187c28c7d02992cd9e0a243d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.98
4.144.132.223
4.230.171.124
172.64.154.167
40.84.97.4
112.175.88.209
162.159.142.9
112.175.88.208
52.110.12.1
112.175.88.207
20.42.179.192
4.247.188.224
135.234.160.245
51.11.192.48
52.148.114.188
72.145.35.111
52.110.12.51
52.110.12.50

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report