MALICIOUS — 9bc179211df1495b972c87dc90029973085cca4fea0c26630f33d5dea2a9137f

MALICIOUS — 9bc179211df1495b972c87dc90029973085cca4fea0c26630f33d5dea2a9137f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Brresmon family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 9bc179211df1495b972c87dc90029973085cca4fea0c26630f33d5dea2a9137f
SHA-1: a7834c3d4cec9de41ec05bd004019f8f0efd1b28
MD5: 85ed4ca41df72e39d732b34c1dfbc3c5
imphash: 9cb74a5d5fdfae123a5712e8c68aa921
ssdeep: 6144:syjHSQxXXq84QYm7NbNkmWaGkQ8/tgKPEpYsBlzO6EpncbK1h6JL6U8QR:ttXqJxz8/tz6K7cO1h++U8Q
TLSH: T1184522AB92D1606CD2A036A1B847B39FA1901EEF1CF49DCEE3B9546C580112370B5D6F
Submitted as: 9bc179211df1495b972c87dc90029973085cca4fea0c26630f33d5dea2a9137f
File type: pe · Size: 278528 bytes
Verdict: malicious (100/100) · Family: Brresmon

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.MPRESS1
ClamAV (daily): Win.Malware.Brresmon-9877165-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:MPRESS
Kaspersky (KVRT): VHO:Trojan-Ransom.Win32.Convagent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Malware.Brresmon-9877165-0 (rule Win.Malware.Brresmon-9877165-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Kaspersky (KVRT) flagged VHO:Trojan-Ransom.Win32.Convagent.gen (rule VHO:Trojan-Ransom.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.MPRESS1 (rule high-entropy-sections:.MPRESS1) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:.MPRESS1, MPRESS - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

22381 behavior events · 3 ATT&CK techniques · 1 dropped files.

Dropped files

c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315 - c9755626dc83b13f603a7add12ae1e9e3970354b44c707f4ffab459f19ef7315

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

kiomanito.freemyip.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
default.exp-tas.com

Embedded IP addresses

52.182.143.212
52.123.252.232
4.230.171.124
85.210.193.152
20.247.185.124
20.165.94.54
74.179.77.204
51.116.246.104
104.18.33.89
52.110.12.28
52.110.12.30
48.200.63.27
20.50.201.205
135.233.45.222
203.26.79.13
20.42.72.131
52.168.117.168
4.150.223.107
4.150.223.111
40.84.97.4
52.148.114.188
72.145.35.104
172.172.255.216
52.110.12.44
92.223.78.30

More Brresmon samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report