MALICIOUS — b830900523fe29628ebb96ad2ff2706ba5317d373dea05a7d92789a9052f0521

MALICIOUS — b830900523fe29628ebb96ad2ff2706ba5317d373dea05a7d92789a9052f0521 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: b830900523fe29628ebb96ad2ff2706ba5317d373dea05a7d92789a9052f0521
SHA-1: 5ae8b7acd1a7e651c1aac7154e30cc79122b388a
MD5: d00053e47279d2dfa2aae57e9036d086
imphash: 4e7f4e9f034d0a9a0d18c7188d0c2390
ssdeep: 192:0O9cFbo9PctKCvmozacfTBVUxIAnJVHwg:NPctKsmmasVUxIW7
TLSH: T105286CCD40A81F67C33614F91732D91FA197B0E519ED71192D8D603E90C39A3AE62E36
Submitted as: b830900523fe29628ebb96ad2ff2706ba5317d373dea05a7d92789a9052f0521
File type: pe · Size: 16688 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Linker
ClamAV (daily): Win.Downloader.Upatre-9783665-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: flagged
Emsisoft (Emergency Kit): Trojan.Ppatre.Gen.1
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.Upatre.pef

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Downloader.Upatre-9783665-0 (rule Win.Downloader.Upatre-9783665-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged flagged (rule flagged) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Ppatre.Gen.1 (rule Trojan.Ppatre.Gen.1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Win32.Upatre.pef (rule HEUR:Trojan-Downloader.Win32.Upatre.pef) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Linker (rule Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

21041 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\quip.exe - e2fd5a5e9a8dcc3ababfbe4ada6fca256034ae14db5c48502b4f28f9e2c71231
97043521e06a868ea743d2174ef2d266626f924998f38ae5df095252a5b92f53 - 97043521e06a868ea743d2174ef2d266626f924998f38ae5df095252a5b92f53
1ccd9f44216412a060064bb783c46b3052c20b454f70491ab361ef0b541b2ad9 - 1ccd9f44216412a060064bb783c46b3052c20b454f70491ab361ef0b541b2ad9
dca323c9f4e5febaf6468a7b65d69fe339539361e6c63a172c1b54bbad3fcf08 - dca323c9f4e5febaf6468a7b65d69fe339539361e6c63a172c1b54bbad3fcf08
b31c753f1a28e094a180860b84603a51fe03dbbf8f43f1881c14d1d196f65523 - b31c753f1a28e094a180860b84603a51fe03dbbf8f43f1881c14d1d196f65523

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

traderstruthrevealed.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

13.69.239.69
52.230.59.222
52.123.252.218
4.230.171.124
172.64.154.167
15.197.148.33
192.124.249.31
192.124.249.117
52.110.12.40
20.184.175.9
20.42.65.89
172.178.240.163
40.84.85.40
172.215.188.232
72.154.7.112
52.148.114.188
52.110.12.56
52.110.12.48

File paths

c:\analyse\1551147568.6604104_895c2bee-c371-4901-ab86-82788e92167c
C:\956981494639888a11e8a45928ed430c550d15521adbf89e883e3b5874588830
C:\bfe1fdd895f1491fd4f538db9ac15522725e7c782eed6405e194ae9b46c15166
C:\4440c9bd3561ce31099822189311984b7f6d15f4ea9eb93e6eca1d8af35c9b1a
C:\3b70b5127b310f475cf9487e7cde0100e23a1022ec1529b48da050e693bc9144
c:\analyse\1556840812.4317465_3dacf480-6d10-480d-8148-9a431cf95024
C:\cff2ff70d3ee2fcfda678efbed453cb187feb89cad0aef63cd75cf5cb071bd96
C:\Users\Lisa\Desktop\0yfCN8Wm.exe
C:\35c4e7b4f9ee6ad4a60e76a98e7c85752ad88fded989cd89387e233ad2601b14
C:\2b9121f7c95b2aa3685b8b035be8c14cdd4204a628dcb39a2751d1907b086fb1
C:\d71f7850babda56f5f7263789cc7b643f2b80559f4c543c3f1e255a6c9481da9
C:\66eb63bf44acc0913ad0a59161340f2d7d2f29710dfd4fe16ab156f8db14d949
C:\qTmU4KlL.exe
C:\9822bcfaf8a5b38ad4fcfaf4b389b232144d59ed31f1f2afcd89206e65d9ad98
c:\task\46A5F2E6C41894EB6D4A1F039708C94E.exe
c:\task\6CBB469F0A566A043C767956DB4F72B1.exe
c:\task\7D9EF81155B151BF64032FF46506779C.exe
c:\task\17F91E66B12A7D59B5DA0A3824F6DD72.exe
c:\task\ED83862FA9DC8848C4B9C728B3801630.exe
C:\5T8lo2bL.exe
C:\8c5fe45c41e8a32f3a829f4303b33e95043bdea4dae1e186a19f64c9af72af68
C:\0Up5B8t0.exe
C:\Documents
C:\GV4_qpj4.exe
C:\1bf7dadf7643235623fadd820b6714a45f9c7fbd8f0f746e6fc42d16a0977a85

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report