MALICIOUS — b7407be110b3bcb1c0ac01f4506fb23c30147ccb75301d1a98f6c1809c6195ab

MALICIOUS — b7407be110b3bcb1c0ac01f4506fb23c30147ccb75301d1a98f6c1809c6195ab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Wacatac family. 5 of 54 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: b7407be110b3bcb1c0ac01f4506fb23c30147ccb75301d1a98f6c1809c6195ab
SHA-1: 12f155f078c984b8fd63f45690bef47101f25271
MD5: 56fadf6aa0025a36a96960ac89a8e8b0
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 196608:VCuML07wTM2CuZYLLc0eT5yaSU6GH2Th2TTgv4Ra6NUqDdK0wq7U:VV20qDgY0WyNUHKoTgAg6HxIq7
TLSH: T116681286D96D6F26C8AE782035F7D9CF6CCA8D56742CDCC14B16B45E223A733013849A
Submitted as: b7407be110b3bcb1c0ac01f4506fb23c30147ccb75301d1a98f6c1809c6195ab
File type: pe · Size: 7857664 bytes
Verdict: malicious (98/100) · Family: Wacatac

Detections (5 of 54 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Kaspersky (KVRT): UDS:Trojan.MSIL.Agent.a

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 12 weighted signals:

Memory forensics: 3 finding(s), e.g. RWX/private injected region in tsk_ef73e8023b (pid 3496) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
2 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 26 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 1.0.175.0, 5.15.3.0, 2.0.2.0 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (5 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

20019 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

0b6b88ebf43742513af1761cbf83efe9ca905cb6629f5a442b7eaf693ef36f3d - 0b6b88ebf43742513af1761cbf83efe9ca905cb6629f5a442b7eaf693ef36f3d
8c69f5df110bc1a61bdc3d8754ebfd3f49d9d995b9dd129accaf88371ce71e30 - 8c69f5df110bc1a61bdc3d8754ebfd3f49d9d995b9dd129accaf88371ce71e30
65221748c5c5ea34c7b24f5f42d3fe1512aaf040c6687e98d437ab9711221f90 - 65221748c5c5ea34c7b24f5f42d3fe1512aaf040c6687e98d437ab9711221f90

Embedded URLs

https://docs.microsoft.com/windows/win32/fileio/maximum-file-path-limitation
http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2016/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787818857&P2=404&P3=2&P4=GHghXI%2f6laSiCz3f3qQvIM69I%2fH3KZ%2bcOiChdjL%2f1oEbA21oS5mhej2r9V5c3idkAhJyTeL2dyDrWQJlm64Jgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787818953&P2=404&P3=2&P4=lYqTsp5TNehPVw7w1BZM%2fF3Y%2bdJgqgz17p3ckPQz4YnE0mcP03NAHo38Fz1gbnn1sIx11BgT3FYCBDEUEXWP1Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

z.ir
y.ca
lw3.uk
docs.microsoft.com
schemas.microsoft.com
api.auth.gg

Embedded IP addresses

1.0.175.0
5.15.3.0
2.0.2.0
4.0.1.0
4.1.3.0
4.150.223.110
4.144.132.223
4.247.188.224
4.230.171.124
172.66.2.5
74.179.77.204
135.232.92.97
4.150.223.104
52.123.128.14
20.76.201.171
40.103.64.242
92.223.78.30
162.159.142.9
52.123.129.14
203.26.79.13
135.233.45.223
104.21.58.53
52.110.12.54
52.110.12.2
74.178.76.44

More Wacatac samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report