MALICIOUS — 984d6bb740bc1833cf32652341c332c704cff88f38ec7c1da48f60fa65be79e5

MALICIOUS — 984d6bb740bc1833cf32652341c332c704cff88f38ec7c1da48f60fa65be79e5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: 984d6bb740bc1833cf32652341c332c704cff88f38ec7c1da48f60fa65be79e5
SHA-1: 067a87dbdcb7569383f0b10b9db370516ac5a9ac
MD5: 413153f2668479717b28f24f27172452
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d65P9JLB4z0t8zAPxhmI4Qq9PPsf:Qoa1taC0HtXB4wqAN+c
TLSH: T1595A239656193B0DF5FAC484781512AEC442F8A7937C2886428FF04FB3DB99B38211DB
Submitted as: 984d6bb740bc1833cf32652341c332c704cff88f38ec7c1da48f60fa65be79e5
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

150 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\B5BE.tmp - fa72b57c5410dd0a93cb6c2bfe407bb362a539bd43b8d540e49944384a304322
54e0a20ea566a57072749b5f8f5ae03ec940462cae50bf71edae06f7c170f72b - 54e0a20ea566a57072749b5f8f5ae03ec940462cae50bf71edae06f7c170f72b

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787819465&P2=404&P3=2&P4=EHycorBa59poBSsOEvYRsHO8r28Hv86NST6TcTWDDTmys1SslZbDV70xTmduI%2bRhbFIpHv37l0Dq0yRlDoUf7Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787819535&P2=404&P3=2&P4=XXGlkRRjAYtM7cInYJl8%2bConwy0dElrVVxRxbJgJ0WnJ7lckZR5zEibLVB82%2fXYfrKwaCMbNP%2b7zPPDuzkfZdA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.65.93
4.230.171.124
4.144.132.114
85.210.196.11
4.247.188.224
135.232.92.137
13.89.179.12
74.178.240.51
20.236.44.162
52.123.128.14
40.99.134.18
52.168.117.171
135.232.92.34
203.26.79.13
135.233.45.222
52.110.12.1
52.148.114.188
162.159.142.9
72.145.35.102
4.150.223.108
52.182.143.212
92.223.78.30
52.110.12.18

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report