MALICIOUS — b19429434dc16bb7f3a77ddc5ae4349a527f4f9dfd203659e0838c46aaba4722

MALICIOUS — b19429434dc16bb7f3a77ddc5ae4349a527f4f9dfd203659e0838c46aaba4722 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Zbot family. 5 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: b19429434dc16bb7f3a77ddc5ae4349a527f4f9dfd203659e0838c46aaba4722
SHA-1: 9f4d317f788a176fa9b610be7261b027cad18f9e
MD5: 2850f320b2b9e1692bb30d81682d214b
imphash: 5c55d83b58dbc1f7154223c32a893074
ssdeep: 768:vQz7yVEhs9+js1SQtOOtEvwDpjz9+4wYPsED3VK2+ZtyOjgO4r9vFAg2rqk63Ygx:vj+jsMQMOtEvwDpj5HwYYTjipvF2hS
TLSH: T1A136E6DD4C7B1F17C7BA88A04E36C96E8055B0E559BCB6095B4FA13D60C34A3AC61E32
Submitted as: b19429434dc16bb7f3a77ddc5ae4349a527f4f9dfd203659e0838c46aaba4722
File type: pe · Size: 68402 bytes
Verdict: malicious (99/100) · Family: Zbot

Detections (5 of 55 engines)

ClamAV (daily): Win.Trojan.Zbot-64721
Microsoft Defender: TrojanDownloader:Win32/Upatre.A
Emsisoft (Emergency Kit): Trojan.GenericKDV.1312926
Trellix Stinger (McAfee): PWSZbot-FIA!2850F320B2B9
Kaspersky (KVRT): Trojan-Spy.Win32.Zbot.qyrd

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Zbot-64721 (rule Win.Trojan.Zbot-64721) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hollowing in misid.exe (pid 7880) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10806 behavior events · 2 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\misid.exe - bd86ed918b36cef24474bdc57d841feb9486c9b47cd3ae4c48ef15fc4f9b7a69
f1994bd18c2dad05e2fc9a653d2516ac129bcc0b0cf4b186b37966a5c4fed394 - f1994bd18c2dad05e2fc9a653d2516ac129bcc0b0cf4b186b37966a5c4fed394
ac1299b8250102941f7974d1427d2df376f6b46f2f0f2bb935e98c2a4f330d1a - ac1299b8250102941f7974d1427d2df376f6b46f2f0f2bb935e98c2a4f330d1a
0bcf29725d0af19bbe2274c5f0d01d0ffbe2ee4f99411282a50888145ec941bd - 0bcf29725d0af19bbe2274c5f0d01d0ffbe2ee4f99411282a50888145ec941bd
c8e0aa59cdc374b664b2457fd556facb82446e55a53f9f56c24b41c926588d4e - c8e0aa59cdc374b664b2457fd556facb82446e55a53f9f56c24b41c926588d4e
fd6b96d6371ee66ec4569bf31e30ce2140e792f702982f36f5d126d8c513100e - fd6b96d6371ee66ec4569bf31e30ce2140e792f702982f36f5d126d8c513100e
cba568b8ff918181f23f1d3ef4145e1d519966bc6511c0c78ecb3d48a5a5bdf8 - cba568b8ff918181f23f1d3ef4145e1d519966bc6511c0c78ecb3d48a5a5bdf8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787907986&P2=404&P3=2&P4=LpYRlPhqPr%2frZTxxctX72QrTu8v%2b3K9FPurN3SzxD1ddT%2bgtaXqlwX7%2bb5cmfFjA6t8xoh3D45UKLeKNlCusTQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787908051&P2=404&P3=2&P4=ALSCXUb617jZRRpZ1YKpXKPb2MLZW6Gq0lM%2bMXM6wefDDvJcVmmYr6NeioDrPOCJ1AxQeUA6zfLjRCcMByU%2f5g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

bestccc.com

Embedded IP addresses

20.52.64.201
52.123.252.203
20.42.179.204
4.230.171.124
52.230.60.54
135.233.95.144
74.179.77.164
4.150.223.108
20.76.201.171
52.123.129.14
52.123.128.14
4.150.223.100
172.178.240.163
172.178.240.161
52.123.252.240
203.26.79.13
52.148.114.188
20.165.94.46
57.155.104.224
4.150.223.115
13.69.116.107
92.223.78.30
74.178.232.29
72.145.35.102
52.110.12.1

File paths

C:\Users\Shortys
C:\vUj4YGbI.exe
C:\9e06e04ecb49d501470433e12e26a1a6a43a8a8664332e96029ca3c68962982d
C:\bd7ab043262085e9de9fe84d518aa3b9a4efd7558f66fadcfc6d79d647ab3ff0
C:\76c6e0c4b510d3e528a925c73f0e0738d62dd60c75d256d7dc5406fbd206299f
C:\d43587c9f39b8a38aa72a9324b276831d0085b6fc077d35386f784b8b4830e4f
C:\VID56933713.exe
C:\pDP2td9W.exe
C:\b36c5def8bdfed29177016625105998d86e1aee43ed9b669cee97080ed58bb6f
C:\vig6qaGu.exe
C:\adWGhDRM.exe
C:\s71v99xa.exe
C:\431849d6c03c423634efe20afafc7c0447b7c148ea97d0fe4002f4b8df9d0c00
C:\Downloads\0defd56a59414a160792b40eadff38f9.exe
C:\27o1xXmk.exe
C:\AfpYA6yM.exe
C:\Bhs6rlwb.exe
C:\T1fGai_Y.exe
C:\5b236bfa037771e1a58e7321c65220280900ec393c104b6e3263c541c2f76000
C:\jOrQ5Ep4.exe
C:\20k0AJgi.exe
C:\gVMs0v2K.exe
C:\D_l9byLG.exe
C:\xlA7qtAR.exe
C:\ZqRI3N_I.exe

More Zbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report