MALICIOUS — a7dc6fc01acfff7b26f46cdb351efa6680c53a739f377107d5ffcace07d25c46

MALICIOUS — a7dc6fc01acfff7b26f46cdb351efa6680c53a739f377107d5ffcace07d25c46 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Mira family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a7dc6fc01acfff7b26f46cdb351efa6680c53a739f377107d5ffcace07d25c46
SHA-1: 42574318c1a6b8cec182bccb0ccba95cc7dc70e3
MD5: 0b959c96417e7d7f5e25e194127436bd
imphash: b81db2e58d7c6d491ab09e9b935feb54
ssdeep: 12288:H1/aGLDCMNpNAkoSzZWD8ayX2MQCw7D02EvB+fXD2G3JLw+Vzf9:H1/aGLDCM4D8ayGMvB+fCe3H
TLSH: T1204C6C29D11E7A25D423C0F9C93DAE1CC076AD6CDDB54388CA5202C8C7D25BBA53A4F6
Submitted as: a7dc6fc01acfff7b26f46cdb351efa6680c53a739f377107d5ffcace07d25c46
File type: pe · Size: 524013 bytes
Verdict: malicious (100/100) · Family: Mira

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Mira-1
Microsoft Defender: Trojan:Win32/Mira!pz
Emsisoft (Emergency Kit): Generic.Mira.1E14642B
Trellix Stinger (McAfee): W32/Worm-FUC!0B959C96417E
Kaspersky (KVRT): Trojan.Win32.Agent.icgh

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Mira-1 (rule Win.Trojan.Mira-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Mira!pz (rule Trojan:Win32/Mira!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Mira.1E14642B (rule Generic.Mira.1E14642B) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Worm-FUC!0B959C96417E (rule W32/Worm-FUC!0B959C96417E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Agent.icgh (rule Trojan.Win32.Agent.icgh) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload (Persistence): scoobe-fix.cmd - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

6618 behavior events · 1 ATT&CK techniques · 38 dropped files.

Dropped files

C:\bake.ps1 - 82b3883814ced5d2faa364c5830367374e02b8366850f654f4c4293a6f5223a0
C:\p.ps1 .exe - 0e23ead9770d7cd9d507acc2e0f442b5175c8a1a5e7b6b6130a811001d206081
C:\Windows .exe - f7355183c6d846591efcc43f28561617f4ba7399901bb30a197051a28f175a78
C:\uac-done.txt .exe - 09064d14e3ef705684fe06550270f0b30b7dfdb2140a8f824e150bd464caab53
C:\ThreatLens .exe - 5c56061c59b48713b3cf1838df1d8fca7740d84b8e84a2d6e5d7f9b27ba8181d
C:\bake.ps1 .exe - 7d25e9c770b78883092affb843c4a985268ac14bdf18c6525335154f93b95af4
C:\pagefile.sys .exe - 10179d942fe659a52a2b65bead0ea8cecbc6be33228c6bec3654441bf9c2081d
C:\uac-done.txt - ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a
C:\swapfile.sys .exe - 3382d94273820fdb2b4b5278558cd823f2483fa7049938def02e7b3ca068100a
C:\ProgramData\Saaaalamm\Mira.h - 22972cfc5b13ea8cedef1adca83358f89fea716b3e775bd70553ed44ef04e668
C:\scoobe-fix.cmd .exe - 0ae60ab0d5a3df535bee1a07ca95874d7fddb4bd68c4124e51bf3a91276d2b28
C:\Python3 .exe - 8c883119034430022e66ff7cbb98f022897285af2b9d7ccf98c2bb0a595fc3c8
C:\Program Files (x86) .exe - a015e5e3d136324805908e08db1a5d94a629163126f8117c1bfea18b50eb9dfb
C:\Config.Msi .exe - 7c23640c9eb3c763abc6b0a1614ed4edfbadeec71b4397e460d5f58726e42c8f
C:\Sysmon64.exe .exe - 31c63040efb8555e6a517483c71941178f15dd67dcd2e9daf539dd930c2235f5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788051961&P2=404&P3=2&P4=hHrDea5zSNj0u8DfkV9PotTdP2hfHVznQUn8bYgEs3QSiDCnXSYTRFseaxMr4COtxej%2btStKqGbUWq4zH1o%2bWw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.100
52.123.252.247
52.230.59.222
4.230.171.124
40.84.97.4
74.179.77.164
74.179.77.204
52.168.117.170
74.178.76.128
74.178.76.44
203.26.79.13
72.153.5.140
52.168.117.168
20.184.175.17
52.148.114.188
52.110.12.21

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report