MALICIOUS — ED49.tmp

MALICIOUS — ED49.tmp is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Salgorea family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: bd7cf152adcaf293623252be8f49c3eab04e620a24b901f593b8e4063375fb4b
SHA-1: dfead10a79e1b915b4bca6391de0b338d25ff8a9
MD5: 24669a961ef748288799b76786e15c2a
imphash: 6dca3e9fb3928bbdb54dbce669943ec8
ssdeep: 12288:wU5rCOTeiD702OZT5cmJT3kxvNZ+3/v+I9hUG2VA:wUQOJD70B93m1NGEA
TLSH: T1B54EE1CE9100F341D573AF5224545ECE64B2B8D294763E8C0BC2F03B16B5D27BC6A5AA
Submitted as: ED49.tmp
File type: pe · Size: 667648 bytes
Verdict: malicious (99/100) · Family: Salgorea

Detections (4 of 55 engines)

ClamAV (daily): Win.Trojan.Cuegoe-6336261-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: TrojanDownloader:Win32/Upatre
Kaspersky (KVRT): HEUR:Backdoor.Win32.Salgorea.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 6 weighted signals:

ClamAV (daily) flagged Win.Trojan.Cuegoe-6336261-0 (rule Win.Trojan.Cuegoe-6336261-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Cuegoe): A013.tmp - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70

Dynamic analysis (windows)

2983 behavior events · 1 ATT&CK techniques · 33 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\A013.tmp - 4e6b0148e4eb2fcff132a3e4440be19727b3101bfd6270de1290486087d04181
C:\Users\analyst\AppData\Local\Temp\DED6.tmp - c2daa60621754ef490408c33e69fd0dcecd9e90f3935767ece1701a221b4ca00
C:\Users\analyst\AppData\Local\Temp\2D9.tmp - 439f06c1010aa8a98980ca817fa0d1843ef5b297ddd713da4be5f7e876530a5b
C:\Users\analyst\AppData\Local\Temp\ED2E.tmp - 59b85791342f75621126330627c01ab9b8b7184ac66de5a9fbc130ba9e31c2da
C:\Users\analyst\AppData\Local\Temp\8562.tmp - 4aff1d5ac6a1c830b867f42614ef2a35da1d78265091ce753baf101c61d81ddd
C:\Users\analyst\AppData\Local\Temp\7054.tmp - 1e87d3ec25bac54e9c3b7f6e69176c060b66d6cf8ab8b62eaed5c04528b351ba
C:\Users\analyst\AppData\Local\Temp\5B93.tmp - 8e26048125084c6381094d3fd29fb7405fb1c5a7b14d0bec273cc5e62be31642
C:\Users\analyst\AppData\Local\Temp\DC1.tmp - b690468c6862b0b4a26b1cf9a01c85b10036c09a5e5286de52113fa936b24454
C:\Users\analyst\AppData\Local\Temp\450E.tmp - 85703d4d563e1ae2b17219f6e2d356f56f15bc692292d38abdfe4c7661b24133
C:\Users\analyst\AppData\Local\Temp\528F.tmp - 64e3c7dd5c6edb825502c35bf0da251961d5e4f4e754d4956c3f4b42df755f18
C:\Users\analyst\AppData\Local\Temp\FA2A.tmp - c020cbf2365ffd0ea56b7f168e9e35958df5db8d5caf95ca5ca876b8f6b208a3
C:\Users\analyst\AppData\Local\Temp\CCC.tmp - c2361f3ab8537504482d7979f985f20f6e7417e8a8a2c4b38556e2745505a793
C:\Users\analyst\AppData\Local\Temp\88E2.tmp - 1a3e9f707b6960039e316fc7fdec8e2cc8c312da17486d94e35a9906445d52ed
C:\Users\analyst\AppData\Local\Temp\AFC3.tmp - fbd9aefe1bf791bdcefdd41f6e5dacf5d05e94aa489091902215b0861e09f64f
C:\Users\analyst\AppData\Local\Temp\AD1E.tmp - b1b37f8e344704fd7139a637f21ca96b4fe9781785fd9ec44a5ddf189e380748

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/ado/2007/08/dataservices/metadata
http://schemas.microsoft.com/ado/2007/06/edmx
http://schemas.microsoft.com/ado/2006/04/edm
http://schemas.microsoft.com/ado/2007/05/edm
http://schemas.microsoft.com/ado/2008/01/edm
http://www.w3.org/2001/XMLSchema-instance
http://schemas.microsoft.com/ado/2008/01/edm:OpenType
http://schemas.microsoft.com/ado/2008/09/edm
http://schemas.microsoft.com/ado/2006/04/edm/ssdl
http://schemas.microsoft.com/ado/2009/02/edm/annotation
http://schemas.microsoft.com/ado/2007/08/dataservices/scheme
http://www.w3.org/2005/Atom
http://www.w3.org/2000/xmlns/
http://schemas.microsoft.com/ado/2006/04/edm/ssdl:StoreGeneratedPattern
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787695302&P2=404&P3=2&P4=Z%2fZ7murCIMDJqTm36S%2f6JFFaknNeBZ9w7Kd5jhNM%2bKqI8DAGvIDb95iraeYbzAEF3zK8im9tuNauk7KlHDndyg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com

Embedded domains

2.ml
schemas.microsoft.com
www.w3.org

Embedded IP addresses

20.184.175.11
52.123.252.193
20.42.179.192
4.230.171.124
52.230.59.222
74.179.77.204
20.165.94.54
51.116.246.105
74.178.240.61
20.112.250.133
52.123.129.14
52.123.128.14
162.159.142.9
13.69.116.109
135.233.45.221
203.26.79.13
52.148.114.188
104.46.162.230
4.150.223.101
74.178.232.29
72.153.5.134
74.179.71.159
52.110.12.8
52.110.12.49

File paths

D:\:p:
f:\dd\tools\devdiv\EcmaPublicKey.snk
U:\:c:j:q:x:
P:\:d:

More Salgorea samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report