MALICIOUS — a614c86e6c11abfc4cd1992ee5bee2a6c0804f7f897ab55fbb1c94251525000b

MALICIOUS — a614c86e6c11abfc4cd1992ee5bee2a6c0804f7f897ab55fbb1c94251525000b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: a614c86e6c11abfc4cd1992ee5bee2a6c0804f7f897ab55fbb1c94251525000b
SHA-1: 3a73813366247b709b46bb2839d081b47d0e3932
MD5: 26a3d8fa939b79cb87fa3b8283b605b3
imphash: c8f5d813ad77b1cc23dc456b66a87d26
ssdeep: 768:7Ur/oXyRnc/XOXVLW2qZ1RisVDaWGNMMMNMUF7//mk8KacrZxbjARZ+U3e:gMecvwNWhZ1X7//mkjZxbURZ+U3
TLSH: T15F3C273CBF78B10BF740632ACA455F6CF99E42A7331659258381964608365BFE2D2E0D
Submitted as: a614c86e6c11abfc4cd1992ee5bee2a6c0804f7f897ab55fbb1c94251525000b
File type: pe · Size: 122880 bytes
Verdict: malicious (100/100) · Family: Changeup

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Worm:Win32/Vobfus!pz
Trellix Stinger (McAfee): Downloader-CJX.gen.l
Kaspersky (KVRT): Worm.Win32.WBNA.ipa

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus!pz (rule Worm:Win32/Vobfus!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Downloader-CJX.gen.l (rule Downloader-CJX.gen.l) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.WBNA.ipa (rule Worm.Win32.WBNA.ipa) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

86096 behavior events · 3 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\miacuig.exe - eeb2619bd213067f1dbc095fe22bb86acf18b07a53307c5cee23a66e40367b86
7edb5702d44309625442ec9b7716b7737b3fc71597a5fbfd864f3c80b77a176e - 7edb5702d44309625442ec9b7716b7737b3fc71597a5fbfd864f3c80b77a176e
aad3cf42a696ec2a4b80095f0fb916bfcb1a4638017e3bcbe66c7289713dd90d - aad3cf42a696ec2a4b80095f0fb916bfcb1a4638017e3bcbe66c7289713dd90d
38164c255b0f193802af01d32cc63d3c777097b7cc92105983d0393b5c3d9a8b - 38164c255b0f193802af01d32cc63d3c777097b7cc92105983d0393b5c3d9a8b
f306370d9b0a5ca58de705e38218fa6926e91c649eec70475e3840d7f679ce43 - f306370d9b0a5ca58de705e38218fa6926e91c649eec70475e3840d7f679ce43
a7c1dbc810c35a16a9e43d331d0776433d174002ef54fe98170902591f67c186 - a7c1dbc810c35a16a9e43d331d0776433d174002ef54fe98170902591f67c186

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns1.player1253.com
ns1.videoall.net
ns1.mediashares.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.94
20.247.184.197
57.155.101.212
4.230.171.124
74.178.76.128
74.178.240.51
40.79.141.152
135.232.92.137
172.66.2.5
104.18.33.89
48.192.143.121
20.52.64.201
4.150.223.110
135.234.160.246
203.26.79.13
57.155.104.224
52.148.114.188
20.184.175.8
4.150.223.104
72.153.5.139
52.110.12.52
52.110.12.54

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report