MALICIOUS — b000a0095a8fda38227103f253b6d79134b862a83df50315d7d9c5b537fd994b

MALICIOUS — b000a0095a8fda38227103f253b6d79134b862a83df50315d7d9c5b537fd994b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Malgent family. 5 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: b000a0095a8fda38227103f253b6d79134b862a83df50315d7d9c5b537fd994b
SHA-1: 6abf7dcc1e69ae796fe2d78b44f463fc07bb3f8c
MD5: 674216ba213ec73ef359ac5b08135be5
imphash: 9212e8a1de86ab972d89bf9237f13d78
ssdeep: 196608:zp6FUViNBYhr95dLU6TWHyd0dKbr/IteVsNKTTyKs0q:9iNBYUZW//2KHyKe
TLSH: T14B6933544FA2CF82F6F096587D806C2E9886A9D579F8CC68F342C21D37CA06F9421677
Submitted as: b000a0095a8fda38227103f253b6d79134b862a83df50315d7d9c5b537fd994b
File type: pe · Size: 8671532 bytes
Verdict: malicious (99/100) · Family: Malgent

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Cyble Vision: Cyble Vision: Cobalt Strike
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Malgent!MSR

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

Cyble Vision flagged Cyble Vision: Cobalt Strike (rule Cyble Vision: Cobalt Strike) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 5472) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Malgent!MSR (rule Trojan:Win32/Malgent!MSR) - engine signal, weight 0.55, confidence 0.85
Contacted 29 external host(s) at runtime (15 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

4969 behavior events · 1 ATT&CK techniques · 35 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/4823/files/7eebad6c78adc130aed187480861cdca1b6ba8108407e0122cff7359f5b81dea - 7eebad6c78adc130aed187480861cdca1b6ba8108407e0122cff7359f5b81dea
/opt/CAPEv2/storage/analyses/4823/files/ec2770b694de64aaa62cac95a27f83dee27e719f42b6a60e2c27997fa571a2b7 - ec2770b694de64aaa62cac95a27f83dee27e719f42b6a60e2c27997fa571a2b7
/opt/CAPEv2/storage/analyses/4823/files/39031d4cde13cbe60bfaa55fdb41047c4d8d6774e833bc3d744c8118460d217f - 39031d4cde13cbe60bfaa55fdb41047c4d8d6774e833bc3d744c8118460d217f
/opt/CAPEv2/storage/analyses/4823/files/1e82067014a197eae2d2a80b21bdb501548f8e5c320883336ccae392eb08d84a - 1e82067014a197eae2d2a80b21bdb501548f8e5c320883336ccae392eb08d84a
/opt/CAPEv2/storage/analyses/4823/files/048d23492a6bc3373fde46c52da9a29bf5a7b3d3d8a204502cfe5ad40d7ea0ea - 048d23492a6bc3373fde46c52da9a29bf5a7b3d3d8a204502cfe5ad40d7ea0ea
/opt/CAPEv2/storage/analyses/4823/files/5100911b07d4001e505e76315adef75c6cac35307c7223a13e0484af07d671d5 - 5100911b07d4001e505e76315adef75c6cac35307c7223a13e0484af07d671d5
/opt/CAPEv2/storage/analyses/4823/files/289327b03eca132af5e31edfa9b28d8a09f0d466bed212df90a17cca050d16a5 - 289327b03eca132af5e31edfa9b28d8a09f0d466bed212df90a17cca050d16a5
/opt/CAPEv2/storage/analyses/4823/files/a8f450d7aced53d81b3f6fe7223ea6301df3d836eac12355677c0a2a041fe507 - a8f450d7aced53d81b3f6fe7223ea6301df3d836eac12355677c0a2a041fe507
/opt/CAPEv2/storage/analyses/4823/files/763aaf8e157910481dc59812479919057b1e38a0a3a5d1ce4b095114787396f8 - 763aaf8e157910481dc59812479919057b1e38a0a3a5d1ce4b095114787396f8
/opt/CAPEv2/storage/analyses/4823/files/7b6eddf08d0f9ba26f2e3b40cd80068cbfe36fa9b81b0203bca6bbe26937fb51 - 7b6eddf08d0f9ba26f2e3b40cd80068cbfe36fa9b81b0203bca6bbe26937fb51
/opt/CAPEv2/storage/analyses/4823/files/47102ce9071944ee1ebb9a1da830ae042f31003ebdba211a7055ebee5375ea13 - 47102ce9071944ee1ebb9a1da830ae042f31003ebdba211a7055ebee5375ea13
/opt/CAPEv2/storage/analyses/4823/files/8253e60348baa019e61e059389debd6bdd9ff02e51acb08796228bc7e30814d9 - 8253e60348baa019e61e059389debd6bdd9ff02e51acb08796228bc7e30814d9
/opt/CAPEv2/storage/analyses/4823/files/2cc951742d3a57e20d7fcecfaca45ec96ad6a4b0e09d4c6afe93cfa1efb7631b - 2cc951742d3a57e20d7fcecfaca45ec96ad6a4b0e09d4c6afe93cfa1efb7631b
/opt/CAPEv2/storage/analyses/4823/files/5ffbdc8866abbff1289f9470462f3a9224fda5da7bb809051017d58f7c7f5163 - 5ffbdc8866abbff1289f9470462f3a9224fda5da7bb809051017d58f7c7f5163
/opt/CAPEv2/storage/analyses/4823/files/19b8f94638f416b000e2738aebda8b0085aba3679a260d5705735a12446ab18f - 19b8f94638f416b000e2738aebda8b0085aba3679a260d5705735a12446ab18f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/92621512-d997-4742-9ae0-db0593ed93c6/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/92621512-d997-4742-9ae0-db0593ed93c6?P1=1785973628&P2=404&P3=2&P4=D7zaPjt8gXXBHkdiAK%2bASSFa9YZaIQqa0q2ktNwW6f7rlsmzLZWIJ6%2fQoaKWfURyC9zZNAzDHmPNSh4YG%2fvJXA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

2.to
j.pro
2.be
2.nl
oneclient.sfx.ms

Embedded IP addresses

23.221.133.185
52.123.252.198
23.40.52.85
85.210.193.152
20.42.73.28
20.42.65.89
23.33.238.100
74.178.76.128
135.233.95.135
52.168.112.67
23.40.52.111
150.171.22.17
4.150.223.106
135.234.160.246
150.171.28.11
203.26.79.13
151.101.30.172
150.171.109.17
23.11.37.157
204.79.197.203
150.171.109.24
23.40.52.211
52.123.252.202
199.232.138.172
72.145.35.108

File paths

T:\:d:l:t:
X:\(S
N:\q
p:\~$

More Malgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report