MALICIOUS — b2262d05f0c4a31d95040d323c7b6dad68aa277c5d018e4aeecd5c01aa4eddf6

MALICIOUS — b2262d05f0c4a31d95040d323c7b6dad68aa277c5d018e4aeecd5c01aa4eddf6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Nupik family. 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b2262d05f0c4a31d95040d323c7b6dad68aa277c5d018e4aeecd5c01aa4eddf6
SHA-1: aa41a13d3607cabe3ccdef0aae9231f56862d305
MD5: 4d0997287806a4046f29549e769fced7
imphash: 532816589b7c9c3bed0fbcc3d1503ba1
ssdeep: 3072:/cT9g8immW6Pozkk2eKs/CSr2nQ/E2S5ny+bF2u1I+ddDK7Hlq/B8f:o68i3odBiTl2+TCU/K
TLSH: T1EE406C7E0F273B03C637CA644A015F8E4022B89AA27D54495B53943DA3FFC67AE5029D
Submitted as: b2262d05f0c4a31d95040d323c7b6dad68aa277c5d018e4aeecd5c01aa4eddf6
File type: pe · Size: 178772 bytes
Verdict: malicious (100/100) · Family: Nupik

Detections (6 of 55 engines)

ClamAV (daily): Win.Worm.Nupik-1
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Tor_Onion_C2
Microsoft Defender: Worm:Win32/Delf.BE!MTB
Emsisoft (Emergency Kit): Dropped:Generic.Malware.SV!p2p!u.AB9A06E4
Kaspersky (KVRT): P2P-Worm.Win32.VB.dz

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Worm.Nupik-1 (rule Win.Worm.Nupik-1) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: BalROK.HTML - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Tor_Onion_C2 (rule STRATO_Tor_Onion_C2) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: 3.6.1.0, 5.0.3.6 - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

10811 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\winhash_up.exe - c9ddae221d1c06140b079588042f4c650ea1d59e3d939b372eb4f5056cc011bb
C:\Windows\SHARE_TEMP\Icon12.ico - 67bc1cd876f5059789b0dc8dc16c0b2155e55aca8d1c8439d70c8882e1875740
C:\BalROK.HTML - 3959c5532031a58119c317dda15ac9313505df4a92c004cd2e76b071b0fad4a4
C:\Windows\SHARE_TEMP\Icon6.ico - 0df5c718b7aee9f045f804f6a53cb0727f66e1ac1df612c6ecf342aed81ce130
C:\Windows\SHARE_TEMP\Icon2.ico - 00a339ff5338d0cfe91b262175eef4e5fd07f9d28e8f980a1f5ff43a5a81e597
C:\Windows\SHARE_TEMP\Icon7.ico - 71acc5a88debfdba0eed23272ef4b09fd6609eeb4b1ec457c72444472ad8b3a4
C:\Windows\SHARE_TEMP\Icon3.ico - d2770f68db717c5335ceca3f2b0be1e294839a4904d3525f4c5e9847654d39c2
C:\Windows\SHARE_TEMP\Icon14.ico - adb0b5eb4fcfcc55c40eaa2ba3d142ed413293b2212bb2a1ddd8ed062db004bf
C:\Windows\SHARE_TEMP\Icon10.ico - 76f05dd79b2d3a08baf928e4811b0f179e96ac351ff8007f2e24f5fbb4b95253
C:\Windows\bugMAKER.bat - 99c473f6b0bd06a637bbe65047f20347a68a54a5ff6bbe019dc1b97979228754
C:\Windows\SHARE_TEMP\Icon5.ico - 462d333fc849166df8cb4e9ba6edd8404f4d79ebcd535125ecb5e8fe9d2cc0e0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787940347&P2=404&P3=2&P4=cTWZTO9DY0HujO5CjhiA%2fXktWOIW6CMbNVWURSEDTGIiEd4VaEYu3Ly8q%2fzCP3gbS%2bzm5cO9%2bhnssIjrJbsPoQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787940387&P2=404&P3=2&P4=jtHuzrF%2fhd9kP2RaujDtFXGlYHtKMYp6yGh%2bMhNKd%2bB6O448%2f%2fNnhMZ5dP%2fjcJ%2bwCrorBnpJq6r3zwKS%2bIuD7g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

3.6.1.0
5.0.3.6
13.69.116.107
52.123.252.218
52.230.59.222
20.42.179.204
4.230.171.124
135.232.92.34
135.233.95.144
104.46.162.230
74.178.240.51
74.179.77.204
203.26.79.13
40.99.134.2
52.123.128.14
20.112.250.133
52.123.129.14
40.99.134.18
4.150.223.106
135.234.160.245
135.233.45.223
52.148.114.188
162.159.142.9
72.153.5.62
52.110.12.37

File paths

C:\Programme\eMule

More Nupik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report