MALICIOUS — 740_WMIGhost.bin
MALICIOUS — 740_WMIGhost.bin is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Syndicasec family. 6 of 52 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
a3667153a6322fb8d4cf8869c094a05e995e2954fda833fe14304837ed4fd0bd - SHA-1:
0cf43f74f078fa4af30f589101a59c9860481b30 - MD5:
68bfa1b82dc0e2de10d0cf8551938dea - imphash:
f6ec70a295000ab0a753aa708e9439b4 - ssdeep:
768:j5QGuIOFwKTMAj3cdXhwlJsYd+mq8ywmgiR+hYHAGQ:VsIOFwKT/BlJsYFq8ye5WQ - TLSH:
T1C2348D582623AA91ED62CF57DF418C7D1873FAF835B10088B4D2ED5D2AF4C43A42A05E - Submitted as: 740_WMIGhost.bin
- File type: pe · Size: 57344 bytes
- Verdict: malicious (100/100) · Family: Syndicasec
Detections (6 of 52 engines)
- ClamAV (daily): {MD5}bin.trojan.syndicasec.9300.UNOFFICIAL
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Syndicasec
- Emsisoft (Emergency Kit): Gen:Variant.Symmi.59398
- Trellix Stinger (McAfee): Trojan-Thrip!24196F6CFFDE
- Kaspersky (KVRT): Trojan.Win32.DLLhijack.ei
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged {MD5}bin.trojan.syndicasec.9300.UNOFFICIAL (rule
{MD5}bin.trojan.syndicasec.9300.UNOFFICIAL) - engine signal, weight 0.90, confidence 0.95 - Memory forensics: 3 finding(s), e.g. RWX/private injected region in cmd.exe (pid 7720) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Trojan:Win32/Syndicasec (rule
Trojan:Win32/Syndicasec) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Gen:Variant.Symmi.59398 (rule
Gen:Variant.Symmi.59398) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged Trojan-Thrip!24196F6CFFDE (rule
Trojan-Thrip!24196F6CFFDE) - engine signal, weight 0.55, confidence 0.85 - Contacted 19 external host(s) at runtime (4 HTTP) - network signal, weight 0.40, confidence 0.80
- YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
602 behavior events · 1 ATT&CK techniques · 3 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- licensing.mp.microsoft.com
- watson.events.data.microsoft.com
- settings-win.data.microsoft.com
- edge.microsoft.com
- time.windows.com
- ctldl.windowsupdate.com
- geo.prod.do.dsp.mp.microsoft.com
- kv801.prod.do.dsp.mp.microsoft.com
Dropped files
- /opt/CAPEv2/storage/analyses/6786/files/bdfc1fa349f5a653d3038d2d99197be5379562b4a089dad18c6901379547e64f -
bdfc1fa349f5a653d3038d2d99197be5379562b4a089dad18c6901379547e64f - /opt/CAPEv2/storage/analyses/6786/files/ad123605f4088bb925c2e59d75df4fd4c90b6cb8f5d90e4b2a45c522e264ba07 -
ad123605f4088bb925c2e59d75df4fd4c90b6cb8f5d90e4b2a45c522e264ba07 - 7f185d953cbc26b9cfd9401510cf3e58ab636e9f95da94aa0d00a623bdd8615a -
7f185d953cbc26b9cfd9401510cf3e58ab636e9f95da94aa0d00a623bdd8615a
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
Embedded IP addresses
- 51.116.246.106
- 52.123.252.247
- 4.230.171.124
- 52.230.59.222
- 172.178.240.162
- 85.210.196.11
- 72.153.5.133
- 52.110.12.44
- 52.110.12.20
- 52.148.114.188
More Syndicasec samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report