MALICIOUS — ba0e0c0087cb3b7265fb65f21016dd6f8046bf9061872f3999773103807c4b2b

MALICIOUS — ba0e0c0087cb3b7265fb65f21016dd6f8046bf9061872f3999773103807c4b2b is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100). 0 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: ba0e0c0087cb3b7265fb65f21016dd6f8046bf9061872f3999773103807c4b2b
SHA-1: 97135fbbc05b69a481e530698832ed0d2e3c6055
MD5: 772f5688af7bef597230fe77fbf1334e
imphash: e2a1496c94d52a035fe47259ee6587b7
ssdeep: 49152:L+clb1BRntmeSKUzYqBzBgRG/F+XOcBEzUx0aOpidGotqjeyBz7cxQIxa3zAsCwu:hmm2zuc4fm20Thje27lAsCKUEy
TLSH: T1BE602389491F2363D1B5C824A85049ECC0A2F2AC747CE66E8F87CD1D64F2937D9F1256
Submitted as: ba0e0c0087cb3b7265fb65f21016dd6f8046bf9061872f3999773103807c4b2b
File type: pe · Size: 3629170 bytes
Verdict: malicious (87/100)

Detections (0 of 55 engines)

No engine flagged this sample.

MITRE ATT&CK

Why this verdict

The malicious score of 87/100 is the fusion of 6 weighted signals:

Memory forensics: 4 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

5442 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\RarSFX0\rarreg.exe - 52aa279742ca906335be418cd8e498fcbed894e0678fc465098dbb0268aaf541
C:\Users\analyst\AppData\Local\Temp\RarSFX0\Winrar.cmd - 66f211886a16399fa9d8f5ab2d7d6b919d29909d2b5effd853ac9ee65d762080
C:\Users\analyst\AppData\Local\Temp\RarSFX0\winrar-x64-602es.exe - 4280854a84f4977ac3a41806a90722947d64e6875432cd771737e5b7614f1cc4

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787821553&P2=404&P3=2&P4=Yd7Lx1D75NEXkE6SkY6nDdc6xW5UUa3x%2f%2bbVrU%2fCQqY83r4i0Qgv%2bRztT18w7ug6rt02b9I2tDp62p8OdXq0Rw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787821621&P2=404&P3=2&P4=VCTOyJGluiRIsV1Vra4W7spC4N23JM4a4eda%2f2JCR%2fsXTOiLBb%2b0fR2wvxoY8f215tyXzWQMeRvf4V7OhQYXIQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com
hw.fr

Embedded IP addresses

20.184.175.7
20.42.179.192
4.144.132.114
4.230.171.124
4.247.188.224
74.179.77.204
20.165.94.54
20.50.73.15
203.26.79.13
20.231.239.246
52.123.129.14
135.234.160.246
52.123.252.202
135.232.92.34
172.178.240.161
172.178.240.163
52.148.114.188
92.223.78.30
162.159.142.9
72.153.5.97
4.247.188.233
20.42.65.84
52.110.12.45
52.110.12.25

File paths

D:\Projects\WinRAR\sfx\build\sfxrar64\Release\sfxrar.pdb

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report