MALICIOUS — 9f78722362eb22b85aecd9616701bd6b65e1658084433fc163f1a4112095a3d0

MALICIOUS — 9f78722362eb22b85aecd9616701bd6b65e1658084433fc163f1a4112095a3d0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Small family. 4 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: 9f78722362eb22b85aecd9616701bd6b65e1658084433fc163f1a4112095a3d0
SHA-1: e7a2905196702c2d23158b44b9912350d5f80d64
MD5: ff781cf629744c735b4d866354f6971c
imphash: 1e4c0da5737da53aff5e6e0ab7de1efa
ssdeep: 384:dFvRvx4EcmZO2Zp+Nye8pqrmub8TyztsDN:dx/4EoKK8o8TyJc
TLSH: T10D28FB84D7E13B20CA4BD84921115C5CBF9167B3E68229DD830A9362D345BF7CEE2782
Submitted as: 9f78722362eb22b85aecd9616701bd6b65e1658084433fc163f1a4112095a3d0
File type: pe · Size: 17920 bytes
Verdict: malicious (100/100) · Family: Small

Detections (4 of 56 engines)

ClamAV (daily): Win.Malware.Fugrafa-9806497-0
Microsoft Defender: TrojanSpy:Win32/Small.M
Emsisoft (Emergency Kit): Gen:Variant.Oberal.8
Kaspersky (KVRT): Trojan.Win32.Small.xxd

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Fugrafa-9806497-0 (rule Win.Malware.Fugrafa-9806497-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Credential Access: LSASS memory access [critical] (rule tl-cred-lsass) - dynamic signal, weight 0.83, confidence 0.90
Microsoft Defender flagged TrojanSpy:Win32/Small.M (rule TrojanSpy:Win32/Small.M) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Oberal.8 (rule Gen:Variant.Oberal.8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Small.xxd (rule Trojan.Win32.Small.xxd) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

142622 behavior events · 3 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
..localmachine

Embedded IP addresses

20.42.179.204
186.233.185.155
72.145.35.100
20.42.73.28
4.247.188.233
48.211.4.16
203.26.79.13
20.42.179.192
52.148.114.188
172.172.255.218
72.145.35.96
20.165.94.46
57.155.101.212
72.145.35.97
52.168.117.174
52.110.12.38
57.155.104.224
52.110.12.46
13.89.179.15
57.154.63.210
85.210.193.152
4.150.223.105
40.84.85.40
52.168.117.171
20.42.73.31

More Small samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report