MALICIOUS — ba2c3a313c95be9da7ed09e0f06dcdbabf90e2fb2a042efb9482b711b3b16619

MALICIOUS — ba2c3a313c95be9da7ed09e0f06dcdbabf90e2fb2a042efb9482b711b3b16619 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the STRATO family. 6 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: ba2c3a313c95be9da7ed09e0f06dcdbabf90e2fb2a042efb9482b711b3b16619
SHA-1: ac458c8915fb2bca80de3a14581b44431936ae1b
MD5: 683fb3a0f4c2d8806c5f80984ed04647
imphash: ca7caff8af8b760bc5fb58366cb987f4
ssdeep: 3072:MPCSgEQ5iPrzbswmm+f9WrpUl/lyeV+l76wYDJFrWljnk1o:TEQ8Pvb5GloQWzk
TLSH: T126437D9D522A7304FBB6CA102C446D4D61A7B4DA627E2C5D0A83C42F33F7C5FB8A415A
Submitted as: ba2c3a313c95be9da7ed09e0f06dcdbabf90e2fb2a042efb9482b711b3b16619
File type: pe · Size: 225280 bytes
Verdict: malicious (99/100) · Family: STRATO

Detections (6 of 55 engines)

ClamAV (daily): Win.Trojan.Maener-1
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Upatre
Trellix Stinger (McAfee): Trojan-FESQ!683FB3A0F4C2
Kaspersky (KVRT): HEUR:Trojan-Banker.Win32.CoinMiner.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Trojan.Maener-1 (rule Win.Trojan.Maener-1) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): WMI process execution [medium] (rule tl-wmi-exec) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3934 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\$WINDOWS.~BT\WMIC.exe - 31bea45556daf1444f28c1f612bb9c65ac2dcfb72fddd4d69c48b0024716151b
C:\$WINDOWS.~BT\tmp-0.bin - ae63af677c6bc533c48578e53047ddc5c0f446610ca4a89da3d9ed708bed71dc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787796346&P2=404&P3=2&P4=V%2fuFgcdOodg9j13frbD1WqZTBXKcYuvNM1VB1nnwu0v3Ys29MAtEh8vU7WsN%2bK1A%2fsxN4LnEwtn2HoYXHx73gw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://api.vk.com/method/wall.get.xml
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787796418&P2=404&P3=2&P4=BBBuTwgUjDhGq%2b9Tu3fhhCZmalzEWyE0tWYOX8KeQMqpcGauiS3VQeuzyQdfyEPMYAWIFCdXhDrEzXjZSQ4uhg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

api.vk.com
1.raumrev.z8.ru

Embedded IP addresses

4.150.223.105
4.247.188.224
52.230.59.222
4.230.171.124
20.184.175.19
74.178.240.61
74.178.240.51
40.103.64.242
52.123.128.14
20.231.239.246
52.123.129.14
52.182.141.63
203.26.79.13
172.178.240.162
87.240.139.193
52.148.114.188
74.179.71.159
52.110.12.48
52.110.12.40
135.233.45.222
52.123.252.218
104.46.162.230
4.150.223.96
72.154.7.98
52.110.12.5

File paths

X:\551b45c5a2e3acc57690b0469d26f1a3\intel.exe
C:\Users\kali\Documents\GitHub\Revived-Raum\RevivedRaum\Release\Raum_core.pdb
v:\$WINDOWS.~BT

More STRATO samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report