MALICIOUS — a7a34c952e09e8fcd76596df7ab20307c111dc85d46bd2b23efc2ed288b17a88

MALICIOUS — a7a34c952e09e8fcd76596df7ab20307c111dc85d46bd2b23efc2ed288b17a88 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Bingoml family. 3 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: a7a34c952e09e8fcd76596df7ab20307c111dc85d46bd2b23efc2ed288b17a88
SHA-1: 3d56dfd280850feb49e030780844da49f2e9870d
MD5: 76c0c7a8425227679a58b6bab5ebbfd8
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 24576:N2oo60HPdt+1CRiY2eOBvcj3u10dt5yab5w2hn5gd77WtqPVFbCVf1XTdOtGHlB1:Qoa1taC070de7zUHXTdAGHr/kQwCNph
TLSH: T1D95A2395461A770CE2F6C8802D6816AEC441E8E7A73C65CB434FF05EF3C69A7B81119B
Submitted as: a7a34c952e09e8fcd76596df7ab20307c111dc85d46bd2b23efc2ed288b17a88
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: Bingoml

Detections (3 of 25 engines)

Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 7 weighted signals:

Dropped a malicious payload (C83B492E): f22058eb896294b8474c0e017347afad9db883fe3fe6f09d9171bbe62eb985ca - dynamic signal, weight 0.80, confidence 0.90
Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 34 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

97 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9114/files/f22058eb896294b8474c0e017347afad9db883fe3fe6f09d9171bbe62eb985ca - f22058eb896294b8474c0e017347afad9db883fe3fe6f09d9171bbe62eb985ca
abc46af1848ae27d4d859a5edb0efe531f05532716a60a391fc4bca06d3a74a0 - abc46af1848ae27d4d859a5edb0efe531f05532716a60a391fc4bca06d3a74a0

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786391041&P2=404&P3=2&P4=P%2fvdCreeoJdl7I4KtWWafbbIm6csg0VkR8NolRwxuMrx27wLdQTSqbVa27NhCzop6PmU%2bI8smNtDqUpRM5MEgw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786391068&P2=404&P3=2&P4=HJeEIvEF9bM0Y8UWEL2cOKZ3K7swj3q5iCzB1mNjfOuGZA0WnBQTtZudFKlQBwDKkg7o0OIVxzS9Z8kEyaYXOw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

w.pl
schemas.microsoft.com

Embedded IP addresses

125.56.205.160
125.56.205.155
4.150.223.109
20.42.179.192
4.230.171.124
4.144.132.223
20.165.94.63
74.178.76.54
20.184.175.4
135.234.160.245
52.123.252.243
74.179.71.159
203.26.79.13
52.123.252.195
92.223.78.30
125.56.205.24
125.56.205.17
72.153.5.129
48.211.4.16
125.56.205.178
52.148.114.188
135.232.92.34
52.110.12.45
52.110.12.31

More Bingoml samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report