MALICIOUS — b430d29788f4496031df630d0e7039a50dcfd2a712547bbc6900f5f9f5b9a14d

MALICIOUS — b430d29788f4496031df630d0e7039a50dcfd2a712547bbc6900f5f9f5b9a14d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b430d29788f4496031df630d0e7039a50dcfd2a712547bbc6900f5f9f5b9a14d
SHA-1: 5238f4031062ff341f09c624a6b9a4011f7a5cd0
MD5: cfe89ed0a36d0e5cbeade65d5b354517
imphash: b8e38d6e701dd0baea1499caf2a327e5
ssdeep: 768:1lvMav2Jq72JwbjMPkG1VuW/wqvRXMXp677yCzdXZRT2Nq1MaQnepMri14PGBEj:1RlOJq72elGVs4emEFbMP0
TLSH: T1C34421C9D2488869F35FD41E42339EBF158DC845686D7C0A8C15A98737CB8B32782BD9
Submitted as: b430d29788f4496031df630d0e7039a50dcfd2a712547bbc6900f5f9f5b9a14d
File type: pe · Size: 249856 bytes
Verdict: malicious (100/100) · Family: Changeup

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Trojan:Win32/Fareit.CV!MTB
Emsisoft (Emergency Kit): Gen:Variant.Ser.Zusy.342
Kaspersky (KVRT): Worm.Win32.VBNA.c

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Fareit.CV!MTB (rule Trojan:Win32/Fareit.CV!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ser.Zusy.342 (rule Gen:Variant.Ser.Zusy.342) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.VBNA.c (rule Worm.Win32.VBNA.c) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 7 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

45662 behavior events · 3 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\neuameb.exe - db0c5664697563e2d9afa0bca07da6831f2d86d880e49d75dc948116756dc453
502c20f561c20bb67f8c85124ec4b60471afe41078de11ba6fc7018b3c64fe79 - 502c20f561c20bb67f8c85124ec4b60471afe41078de11ba6fc7018b3c64fe79
8358b52347e702a98378f80f1cc983f49cf13cd4e5650f48ce71ad11cfaed4e7 - 8358b52347e702a98378f80f1cc983f49cf13cd4e5650f48ce71ad11cfaed4e7
3f7dbab145b44eddf5a85ff28294d905f842a47947c84f3b99ee04186d7d7fdb - 3f7dbab145b44eddf5a85ff28294d905f842a47947c84f3b99ee04186d7d7fdb
05d5d7698ede7db0e39eac01c3e28eefdc3a8c4db0054ed882bce1df58a1989d - 05d5d7698ede7db0e39eac01c3e28eefdc3a8c4db0054ed882bce1df58a1989d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

ns1.codeconline.biz
ns1.player1523.com

Embedded IP addresses

4.150.223.105
52.230.59.222
4.230.171.124
172.64.154.167
20.165.94.54
20.184.175.4
135.232.92.137
57.154.63.210
85.210.196.11
135.234.160.245
135.233.45.223
172.178.240.163
20.209.154.161
72.154.7.107
52.148.114.188
52.110.12.55
52.110.12.47

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report