MALICIOUS — b1553dba597d062aecbae96d079f9ad873861f46f35da41da425095dfedbd455

MALICIOUS — b1553dba597d062aecbae96d079f9ad873861f46f35da41da425095dfedbd455 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Tasker family. 4 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: b1553dba597d062aecbae96d079f9ad873861f46f35da41da425095dfedbd455
SHA-1: 7bc63377d2c92d4a265bcd07f70d4edb85a0edfc
MD5: b20b06183e59bf12fecede4148233fd1
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 3072:z/iV/1PB3rPFTOxx3iBj8XFh5jexhFC63zbQo/wcknn4BG+4Fz:z/ebPFSxxSZSFHje1zBYnn4BG+4
TLSH: T15D40F83ECC72D6BFFF3F5AE35D0286CE2175B91D54502883101C6B50D10978B2AB66AA
Submitted as: b1553dba597d062aecbae96d079f9ad873861f46f35da41da425095dfedbd455
File type: pe · Size: 167936 bytes
Verdict: malicious (98/100) · Family: Tasker

Detections (4 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Detect It Easy (packer/type): DIE:Microsoft Linker
Emsisoft (Emergency Kit): Gen:Variant.Barys.436218
Kaspersky (KVRT): UDS:Trojan.Win32.Tasker.augd

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 12 weighted signals:

Emsisoft (Emergency Kit) flagged Gen:Variant.Barys.436218 (rule Gen:Variant.Barys.436218) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.Tasker.augd (rule UDS:Trojan.Win32.Tasker.augd) - engine signal, weight 0.55, confidence 0.85
3 behavioral detection(s) across 3 rule(s): Scheduled Task / Job [medium] (rule tl-scheduled-task) - dynamic signal, weight 0.46, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

19219 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Roaming\Microsoft\Telemetry\sihost32.exe - 2f5a4a744083b9bab7475ff12b96c220ad386980518205f0781e60eff0dc215d
C:\Users\analyst\AppData\Roaming\Microsoft\Telemetry\sihost32.log - 27754b4c776f42b6e8bf1de0dcecebcd71016b572a333155eeeae02cb3fc1ab7
2f1bad5f6e8fcd8600c727ff7e6843a323790ffc02e5f3cd084a85bfdd6bff79 - 2f1bad5f6e8fcd8600c727ff7e6843a323790ffc02e5f3cd084a85bfdd6bff79
be40464e084cb2a65be554e73ff2d2313ff81b7a4e1a75a0e6d53e6ff46fd78a - be40464e084cb2a65be554e73ff2d2313ff81b7a4e1a75a0e6d53e6ff46fd78a
e3e81ae09b8e343cbd7cbc9dcc1fd07248e1dd34efe8884fda466d6bf97853e7 - e3e81ae09b8e343cbd7cbc9dcc1fd07248e1dd34efe8884fda466d6bf97853e7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788127540&P2=404&P3=2&P4=ntwRm%2bsoj2pT%2bRfLM6JaLe4gJ2npb10G8pYUhgEH4z91%2bZVshHw3WGuIs1q0xlg3mMC8dHXjAAzxVviIk0FtVQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

sanctam.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.170
52.123.252.193
4.230.171.124
20.42.179.192
20.247.185.124
74.179.77.204
135.233.95.80
74.178.240.51
51.116.246.104
74.178.240.61
203.26.79.13
104.18.33.89
4.150.223.105
162.159.142.9
185.199.108.133
4.237.22.38
52.110.12.8
52.110.12.2
92.223.78.30
72.153.5.138
52.148.114.188
20.184.175.4
4.150.223.96
52.110.12.50
52.110.12.53

More Tasker samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report