MALICIOUS — 937422c7bb4650600897c500f6d001b3bd8a3b3c7522cebdbbabe21a64c56b73

MALICIOUS — 937422c7bb4650600897c500f6d001b3bd8a3b3c7522cebdbbabe21a64c56b73 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (96/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 937422c7bb4650600897c500f6d001b3bd8a3b3c7522cebdbbabe21a64c56b73
SHA-1: e471302c5f10c350cb7033fc6df943d9b15c5498
MD5: eb9e4aa5077bb336bafd95e16eea4299
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dNeeiW0pUUzlY4LY/nRx7Kd8AZl6Y+:Qoa1taC091W0pfYcgRNKpX6Y+
TLSH: T1DB5A234666196B0CE7F5C4853C39226EC441D4E7933829CE528FF15EA3DB97B782108B
Submitted as: 937422c7bb4650600897c500f6d001b3bd8a3b3c7522cebdbbabe21a64c56b73
File type: pe · Size: 1958400 bytes
Verdict: malicious (96/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 96/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\3052.tmp - 012c516236e9faf127b451125af1f17c9a01623b0be86e7e1403968e13bee2cf
f614a87171fd039ebc6c0ea237fdbacaa9240120679cc8f18c7f17cbdf37840a - f614a87171fd039ebc6c0ea237fdbacaa9240120679cc8f18c7f17cbdf37840a

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787947564&P2=404&P3=2&P4=KgZKjbJqAMy97X7%2fR%2fm857GrpOfXkI0VdGLGjcWUGBwbBuvqOfAc2Fq6ujU24tYmo5OmYg%2b9agiv5pAHF9dXKw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787947624&P2=404&P3=2&P4=dtDeg5Sp7zsTWNj8onHt4yVfX95gYFNhZsvCbBw%2fN0PDw8GX86aFJ50iGcrjNIIlczZOSeqzPbRyqN4QVsNtHQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

k1x.ru
schemas.microsoft.com

Embedded IP addresses

20.184.175.22
4.144.132.223
172.215.188.232
4.230.171.124
57.155.104.224
74.178.240.61
13.89.179.12
135.233.95.135
20.236.44.162
52.123.129.14
52.123.128.14
4.150.223.112
203.26.79.13
135.234.160.245
135.233.95.80
52.123.252.215
52.148.114.188
52.110.12.55
52.110.12.28
72.153.5.133
52.110.12.22
52.110.12.10

File paths

B:\K
i:\5m

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report