MALICIOUS — b439d627c60a538bbdec74a938c041c826e19b3bb1cdaf5f0564f895c11b8945

MALICIOUS — b439d627c60a538bbdec74a938c041c826e19b3bb1cdaf5f0564f895c11b8945 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 6 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b439d627c60a538bbdec74a938c041c826e19b3bb1cdaf5f0564f895c11b8945
SHA-1: 506ef7d1f32a30bb0f5e5e5184129cae7877aede
MD5: 88a719c0242ddc001ab1edc858e495c6
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 6144:H7uSVxweTvfdyXKEIn4ctOQGwHkoktKC3WQLXgd:H7uqXmpIn4paqtKVsXgd
TLSH: T1A7434BC05A828C06ED9C56BB8365EC3C25836DD588AFE3DC85345D497A2BDB3F418239
Submitted as: b439d627c60a538bbdec74a938c041c826e19b3bb1cdaf5f0564f895c11b8945
File type: pe · Size: 238592 bytes
Verdict: malicious (99/100)

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 31 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 8 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

7900 behavior events · 3 ATT&CK techniques · 15 dropped files.

Dropped files

bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\Users\analyst\AppData\Local\Temp\GGAEwIQc.bat - af1152dc7392fb1413d400c5bea74bac376a3d784b8419de15941032a402070f
C:\Users\analyst\rSwIoccE\vcIYEIkQ.inf - 91fa008a9b56f235c7fcb246d4574cacd2233870d465dfd7bfa3f3c2dd8257a6
C:\ProgramData\xiocAsMc\yKgEskQE.exe - 612facaaa762fa2de26c5dc064f6afe23945546e6824a872d34e0aa87250ba92
C:\Users\analyst\rSwIoccE\vcIYEIkQ - 11a604192d36df9a80804e9a54cd6bdd2ae3fc193af33739c57762d6af2b9bfa
C:\ProgramData\xiocAsMc\yKgEskQE.inf - 79f57c82a01c703523a520606ff935ea35346f203f98d9974c28b15b668ea2ac
C:\Users\analyst\AppData\Local\Temp\tsk_ef6c00f3007b4119 - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
C:\Users\analyst\AppData\Local\Temp\smkUcsog.bat - 3508b87a907802ab9bca6e8beeccfe972e50f654aa418b4d6e2225da12964415
C:\Users\analyst\rSwIoccE\vcIYEIkQ.exe - 14bd7529aec877688a6a83eedfbd151dacae108ace14b9f8fc07d411dd2fdb6c
C:\Users\analyst\AppData\Local\Temp\ICkIAkQc.bat - 976445931b0e9e18d50673728f044b512dd818db21ee6eb15f0fcd8a795a0d91
C:\Users\analyst\AppData\Local\Temp\file.vbs - 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc
C:\ProgramData\xiocAsMc\yKgEskQE - 5b0454a13302f25e1082161d3821336065cdcfd1ba2afa73494a8e24961409eb
C:\Users\analyst\AppData\Local\Temp\SCgcYYwo.bat - cc9a1bc4f88f08b4fd6323641b9c66b1af996cb5dba585b0c795e276c3cedfd6
C:\Users\analyst\AppData\Local\Temp\nEsgcMUY.bat - 4d47c9945a9f4d593f974f80c6086d6d2f7333ea5c0cf57825b147026f55d9e0
7857ee9fb5d7dfd3c1f351b9e524e144547a6d0071d81d74c248d3e7b7696c7d - 7857ee9fb5d7dfd3c1f351b9e524e144547a6d0071d81d74c248d3e7b7696c7d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787896292&P2=404&P3=2&P4=Vj6VeE7f9SQViV%2beq21j%2fSa%2b8m8NVt8pNX1NMrqEOSvpgUQ7Vrs3VYL2roUa05%2f%2boH0BwE26CskqtUQszwVVVA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787896415&P2=404&P3=2&P4=ieTTv8mRqfmsxmC6dXVXfLcLYTDe9VNc%2fB01iN1XLY7D%2fw9wMFlTcjyXUGU9vuoLWDrujwygIB%2bwYA8Hfcci1w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

57.155.101.212
51.104.15.252
52.123.252.236
4.144.132.114
4.230.171.124
85.210.196.11
135.232.92.137
20.89.1.12
135.232.92.97
20.231.239.246
52.123.128.14
52.123.129.14
40.99.133.210
135.233.45.221
200.87.164.69
162.159.142.9
172.66.2.5
203.26.79.13
200.119.204.12
52.148.114.188
190.186.45.170
20.184.175.11
92.223.78.30
52.123.252.239
20.165.94.46

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report