MALICIOUS — b7ed730b6386f5160e5ea1f10c9dc35790567b98ba22aa6893eee6ce27bba3a0

MALICIOUS — b7ed730b6386f5160e5ea1f10c9dc35790567b98ba22aa6893eee6ce27bba3a0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b7ed730b6386f5160e5ea1f10c9dc35790567b98ba22aa6893eee6ce27bba3a0
SHA-1: 13a9d868ba9b25e6284abdc10adbb1378bf4726e
MD5: 0537a5e98dc26b7efa8ff8c6231c0e46
imphash: e5b9052eec03deaa531e95108555ea48
ssdeep: 1536:dviZolSpy8tXG06YpqdXTsYJ/F+FBFIFGFYF7DUZxTZ29a:AZISs0G0mZHk
TLSH: T1C4394D8C1364E897F3A5930B6D6CACAD4DEEC023D727C5A006E25D8E58D636FD82205D
Submitted as: b7ed730b6386f5160e5ea1f10c9dc35790567b98ba22aa6893eee6ce27bba3a0
File type: pe · Size: 90112 bytes
Verdict: malicious (100/100) · Family: Changeup

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Worm:Win32/Vobfus!pz
Emsisoft (Emergency Kit): Gen:Variant.Lazy.209946
Trellix Stinger (McAfee): Downloader-CJX.gen.az
Kaspersky (KVRT): Worm.Win32.WBNA.ipa

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus!pz (rule Worm:Win32/Vobfus!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Lazy.209946 (rule Gen:Variant.Lazy.209946) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Downloader-CJX.gen.az (rule Downloader-CJX.gen.az) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Worm.Win32.WBNA.ipa (rule Worm.Win32.WBNA.ipa) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 24 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497.001, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

41191 behavior events · 3 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A - 7a125ce6876b77c737513f4364866714ce31a8df9b9f3045c5824892c1f87208
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 - f3d0d36afbcf3e77248a3417dced83028445a888c611e1d9231126e2a024a0c7
C:\Windows\Temp\ArmReport.ini - 18a0d4847c4f3ded086cce2db55cb4cbb748903b3ec3b3bc609fa35c51a60152
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\C8E534EE129F27D55460CE17FD628216_1130D9B25898B0DB0D4F04DC5B93F141 - c73a611258421ae4d5865dba2683423cab5cbe19260b69cafead055360dae5c6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB - 56f33c731cb6df76a74cc2b95b9e80b62f3ebfd6bb5edbe6782aa0644643b618
C:\Users\analyst\lczoz.exe - 4059fc6011c9b01ec2e72fdb4e16efd03a9a763ea3f7b26d0f9979844d1f041a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EC9B1D0ABBD7F98B401D425828828CE_5809FDAACC125718B26BC11DC8E8116A - e6d0e551a9d4d5d3f5db9bb525d9203d9a62ea72a90d5b1baa1089ff4e8111b0
C:\Users\analyst\AppData\Local\Temp\Tmp5D16.tmp - aaaced351a90b2029c44c6ebb68084a331f296a0ace8115d9889f549d596564b
C:\Users\analyst\AppData\Local\Adobe\ARM\S\ArmManifest3.msi - 4a96463a1112ebe2c25293aacb1a4c4550d67cb827fd9333b8ed4d99ea60a0b3
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\698460A0B6E60F2F602361424D832905_8BB23D43DE574E82F2BEE0DF0EC47EEB - df94e9436a1e9233ae00ae20fa0b17bc2ff99a1baa8d44e43d47164561e9423c
47e12bbee66473fca63085e02ce285e0c7301e763f58e4cf1cdeeafd4adfcc59 - 47e12bbee66473fca63085e02ce285e0c7301e763f58e4cf1cdeeafd4adfcc59
6aa6eb25a6debe981638873d64477eb0c63eb147b4ec4bbee19f79bb5a87c056 - 6aa6eb25a6debe981638873d64477eb0c63eb147b4ec4bbee19f79bb5a87c056

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

ns1.player1253.com
ns1.videoall.net
ns1.mediashares.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org
oneclient.sfx.ms

Embedded IP addresses

40.74.98.198
20.165.94.63
4.230.171.124
85.210.196.11
74.178.76.54
20.184.175.23
20.247.185.124
172.215.188.225
20.184.175.15
52.123.252.236
20.42.179.204
52.110.12.53
104.18.33.89
52.110.12.10
20.42.65.89
51.116.246.105
52.148.114.188
57.154.63.210
52.168.112.66
135.234.160.246
57.155.101.212
20.50.201.205
57.155.104.224
40.84.97.4
52.123.128.14

File paths

C:\Program

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report