MALICIOUS — Silent Hill 4 + nocd.exe

MALICIOUS — Silent Hill 4 + nocd.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: a4828cfc01ed15492892b274ea5efcd0e3c53b5841efd04613b10c93ee21bfd2
SHA-1: 14deba504ec2566480fdd8e8262c48f5b2732f3c
MD5: 7074aa53ac4a5597d68224033138413f
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 12288:5wawSwaw1wawSwaw9zJwawSwaw1wawSwaw9zswawSwaw1wawSwaw9zJwawSwaw1k:nQx
TLSH: T11C60D100327A399CD7709F605524598DA22552C1897D3EEA9B03072D3CB78BBB9E8F71
Submitted as: Silent Hill 4 + nocd.exe
File type: pe · Size: 3531720 bytes
Verdict: malicious (98/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Upantix-9886651-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Upantix-9886651-0 (rule Win.Malware.Upantix-9886651-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 7 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1746 behavior events · 0 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2_codes.exe - 9efde9630d88b4a785e4e38895622cac3ef6599f97a192ec9ebd5b02d5673a42
C:\Windows\win32dc\Sims 2_fix.exe - 2bc7c1d6dbc7313306b93da7b15c65a6eb60dfd225d05d509dca295caf561256
C:\Windows\win32dc\UT2004_hack.exe - 75870f028bdb29e8c54f7fc17826d0dede2134a786af71e6f174161d4ef2c933
C:\Windows\win32dc\UT2004 trainer.exe - de91491343ae7867c10b8bd60e20d7f96202e3e0cd0c47304ab7db6d406d0194
C:\Windows\win32dc\Counter-Strike cdfix.exe - 8998c7d4f34bb1933ce513595640cc78b999a9405b6202dd50fd583156cbf07f
C:\Windows\win32dc\FlatOut + codes.exe - 56b4aad3945a7fad8cc94b40b3488ddd51a42be11737a6ebaf15fa9cd8f9dfa3
C:\Windows\win32dc\Half-Life 2 serial.exe - 284c1b03358169334cd5d88134a12470d61a710449ed6eff3b3db117204b7962

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787667597&P2=404&P3=2&P4=OCCjHka90RFZN5y6DLBxMXaO9vBFEzy2wocgvGt0hEhFaQrc7HVv5lj0koSpUiNUIjcSt%2fyZ7iT7vNDRTjRInw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787667669&P2=404&P3=2&P4=Ay8YFSeDAax4p3nj3bcK64BoczD8eFJuwni5xXcLlMdQlf7iCLXPJcJlBqyR8PX%2f62pJJ1%2b%2bSrd2B5IvOb2BXw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

135.232.92.34
203.26.79.13
20.42.65.90
52.123.252.232
57.155.104.224
4.230.171.124
4.144.132.114
74.179.77.204
74.178.240.51
20.42.65.84
20.50.73.15
52.123.129.14
20.112.250.133
40.99.133.226
52.123.128.14
40.104.4.2
135.233.45.223
186.233.185.155
74.178.76.44
52.148.114.188
172.217.25.163
72.145.35.112
20.184.175.14
52.110.12.25
52.110.12.56

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report