MALICIOUS — 969f4a5665d9d8c0f732d2e1281c837ac50eced0d5985c360348fbb9b9b85069

MALICIOUS — 969f4a5665d9d8c0f732d2e1281c837ac50eced0d5985c360348fbb9b9b85069 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Small family. 4 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 969f4a5665d9d8c0f732d2e1281c837ac50eced0d5985c360348fbb9b9b85069
SHA-1: 26528c4c4a1fabe098bbdadb0184882afba20a0d
MD5: d653b3dc7090ba9e57a9509f5ab12492
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:GFeR/m35fcmZO2Zp+Nye8pqrmub8TyztsDN:GsE35foKK8o8TyJc
TLSH: T1A728FB84D3E13B24CA5BD84921114C5CBF9167B3E68269DD830A9362D345BF7CEE2782
Submitted as: 969f4a5665d9d8c0f732d2e1281c837ac50eced0d5985c360348fbb9b9b85069
File type: pe · Size: 17920 bytes
Verdict: malicious (100/100) · Family: Small

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082 - dynamic signal, weight 0.40, confidence 0.75
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

75099 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787737149&P2=404&P3=2&P4=a3QBAoP0tRNeGiq6ttODPYO%2bhAGH4dScLEzKtaDwFF50aaxj7a7vqLyNbvAzhBgwmX2A8MKL0Amr8UzwEhjtow%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787737186&P2=404&P3=2&P4=ZxA79m%2bQ98R%2f9RGwZE8UYL2LGgoEEk%2fQMmEo%2fNjtkYJgBQhnOI4kWAESpe3cexKGzmZhaKi7sI5SK8tYLTUUNQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.65.93
52.253.84.76
40.84.85.40
4.230.171.124
20.165.94.46
135.232.92.34
40.79.167.10
135.232.92.137
135.232.92.97
203.26.79.13
40.79.150.121
52.123.128.14
20.112.250.133
52.123.129.14
40.99.134.2
172.66.2.5
172.178.240.162
172.178.240.161
4.150.223.100
51.116.253.170
40.84.97.4
52.148.114.188
172.170.180.133
72.145.35.110
92.223.78.30

More Small samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report