MALICIOUS — bd1160d53e83bce2feba042f6e12019a7b925c19f1b1b10faaa6bee8c7f7e078

MALICIOUS — bd1160d53e83bce2feba042f6e12019a7b925c19f1b1b10faaa6bee8c7f7e078 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Ulise family. 6 of 56 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: bd1160d53e83bce2feba042f6e12019a7b925c19f1b1b10faaa6bee8c7f7e078
SHA-1: 6ac7d52e9143f4aee16663ea20ec2f3c3fc1a385
MD5: 4344bf5cc4c144d7542337cc7a18b1dc
imphash: 683b1105f11477b15337eac0e16f858e
ssdeep: 1536:9d9dseIOcE93bIvYvZEyF4EEOF6N4yS+AQmZTl/5:1dseIOMEZEyFjEOFqTiQm5l/5
TLSH: T1C5369DCE520AC74FE768DAA2AC04DE5E40B7B4ABD1F576D81AD6C03D13F1853C885298
Submitted as: bd1160d53e83bce2feba042f6e12019a7b925c19f1b1b10faaa6bee8c7f7e078
File type: pe · Size: 69632 bytes
Verdict: malicious (100/100) · Family: Ulise

Detections (6 of 56 engines)

ClamAV (daily): Win.Malware.Ulise-7170100-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Microsoft Defender: Trojan:Win32/ButeRat!pz
Trellix Stinger (McAfee): Dropper-FZK!4344BF5CC4C1
Kaspersky (KVRT): UDS:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-7170100-0 (rule Win.Malware.Ulise-7170100-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/ButeRat!pz (rule Trojan:Win32/ButeRat!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Dropper-FZK!4344BF5CC4C1 (rule Dropper-FZK!4344BF5CC4C1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan.Win32.Generic (rule UDS:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 11 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.45, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
Embedded network infrastructure: http://ow5dirasuek.com/, http://mkkuei4kdsz.com/, http://lousta.net/ - static signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

858 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Windows\System32\omsecor.exe - ff63343f5fb7119a684b1292c48068a8473c0a35882e36a1ec3e4fe1e863d194
C:\Users\analyst\AppData\Roaming\omsecor.exe - 1a6055bdd2624d386e6b6db1a542123735f12b2d42b965e0372c7354e8013e9e

Embedded URLs

http://ow5dirasuek.com/
http://mkkuei4kdsz.com/
http://lousta.net/
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://lousta.net/7/898.html
http://mkkuei4kdsz.com/999/40.html
http://ow5dirasuek.com/669/193.html

Embedded domains

begun.ru
an.yandex.ru
ow5dirasuek.com
mkkuei4kdsz.com
lousta.net

Embedded IP addresses

4.150.223.97
52.123.252.239
4.230.171.124
4.247.188.224
4.144.132.114
74.178.240.51
4.150.223.107
20.165.94.63
4.150.223.111
104.18.33.89
74.178.76.128
4.150.223.102
4.207.44.74
193.166.255.171
52.110.12.48
52.110.12.14
3.238.30.69
44.192.95.127
72.145.35.97
52.148.114.188
52.110.12.10
52.110.12.55

File paths

C:\WINDOWS\system32\gbdwpbm.dll

More Ulise samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report