MALICIOUS — b0f1e23b633f2bdaad255e4cf846a84417ba16b593ad83d5316b5809fdee2cd6

MALICIOUS — b0f1e23b633f2bdaad255e4cf846a84417ba16b593ad83d5316b5809fdee2cd6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b0f1e23b633f2bdaad255e4cf846a84417ba16b593ad83d5316b5809fdee2cd6
SHA-1: ee55f5fa46f38264e477affea65daa295cfe7483
MD5: 6b79177ce9730f2088bb274a45ffc821
imphash: 3bf52cce958af28c47ecfbb6d0a01caa
ssdeep: 384:ck11/A7Jirv5wjSyC8M4iSoa5am/i1O1p0Z:Z1/A74roSyC8Ji65aTZZ
TLSH: T13A2C1E8E81A9CA5AC1EA04B4D532D51D90A7BCD247DC304B9CA9D03FD3C18E7EDA1971
Submitted as: b0f1e23b633f2bdaad255e4cf846a84417ba16b593ad83d5316b5809fdee2cd6
File type: pe · Size: 24626 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (6 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Downloader.Upatre-5744092-0
Microsoft Defender: Trojan:Win32/Trickbot.GML!MTB
Emsisoft (Emergency Kit): Trojan.GenericKD.1627005
Trellix Stinger (McAfee): Downloader-FWW!6B79177CE973
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Upatre.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Downloader.Upatre-5744092-0 (rule Win.Downloader.Upatre-5744092-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Trickbot.GML!MTB (rule Trojan:Win32/Trickbot.GML!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.1627005 (rule Trojan.GenericKD.1627005) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Downloader-FWW!6B79177CE973 (rule Downloader-FWW!6B79177CE973) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Win32.Upatre.gen (rule HEUR:Trojan-Downloader.Win32.Upatre.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 1 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497.001, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://notepad-plus-plus.org/contributors - static signal, weight 0.35, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

21443 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tezin.exe - 1930d8d0969d933f5d0f717103328019c7c3740941d054b69222d53cf60e71b6
cf4d1f735951ded88ba8efb2e7f53ddc4737fe539e8764dd4e7a2a02092e15fd - cf4d1f735951ded88ba8efb2e7f53ddc4737fe539e8764dd4e7a2a02092e15fd

Embedded URLs

http://notepad-plus-plus.org/contributors
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com

Embedded domains

notepad-plus-plus.org
peterjwarren.com
egodesign-home.com

Embedded IP addresses

52.168.112.66
57.155.101.212
4.230.171.124
4.144.132.114
135.232.92.97
135.233.95.144
104.18.33.89
51.105.71.136
74.179.77.204
40.84.85.40
172.66.2.5
52.110.12.10
52.110.12.14
20.89.1.9
92.223.78.30
135.234.160.244
135.233.45.222
20.184.175.7
172.175.111.170
203.26.79.13
52.148.114.188
4.150.223.99
72.154.7.110
52.110.12.31

File paths

C:\DOCUME~1\RBRICK~1.ARC\LOCALS~1\Temp\Temporary
C:\B340Rz53.exe
C:\upMQcWPf.exe
C:\0WOcGIhQ.exe
C:\cd63fcaa06afe2d16c7d67ad536c20a13ac67a61caba907302de2e19eea68101
C:\yFc4gfZs.exe
C:\u19VIcHT.exe
C:\cOXXnIf5.exe
C:\iedToiJh.exe
C:\79uLDDYU.exe
C:\etE3b8VQ.exe
C:\PvUC8BLI.exe
c:\analyse\1628534638.8025599_cbd7867a-feea-4b4d-bb23-fff9416580f1
C:\9db2744bab8a6e1041683bea57be57ae48d22f9bda1fa5ee4a8d30a377c0b441
C:\Users\george\Desktop\tezin.exe
C:\ec2edcac93b766341d93bea263cccc195c17388de32bb0a9de4543e314f4fc7d
C:\fb43c8d27b1b775d2e139333560d85922023650e56c3b986d36f7e8e8dbefce4
C:\Users\admin\Downloads\tezin.exe
C:\Users\Virtual\AppData\Local\Temp\9481f5f0b147dbe69ca52d536d4589edc5ea6ab2aa745d6639c1c63f24ee46c7.exe
C:\566157c6b39860af12e26f6df8737c87687af720ef5c2dd637df9a9edfced5f3
C:\2994ce5a8301df1e9fda88da9f7e6caaa2dca3686a5f7901053405062dcef857
C:\Users\r.vult\AppData\Local\Temp\61aa167fcbf5ea5cb7a3c373772f9776.exe
C:\050b8ff89be83164e96eaef619d021b2a7eebd9e09a8c8cdda2cc5d8df446559
C:\29e48a85a4727775bde493dbef49d66e1eb360e806bf4e080cb5097d2160749a
C:\671b2d643a71ee0b52a415ff6608eb9baa0968e01971d611550504620a15ebca

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report