MALICIOUS — DAoC + cheat.exe

MALICIOUS — DAoC + cheat.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Upantix family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: be355945d0d12fe33a2cb37244c5b594aaa850898e5adb71820b266e8a2d5af8
SHA-1: 81efc1488d5103ac731ea32f59ed4221f422b574
MD5: 0015f1094b3bea224a6d8b31dcdee408
imphash: 24b60c57cc33f3e633431b7ad497fda7
ssdeep: 1536:3UUUUUUUUUUHdTD+vvvvvvvvvh+UUUUUUUC9mIkkkkkkTyhhhhhhhMSTZM+9m2OR:blN9RkkkkkkTLSBvyiW
TLSH: T1083BD040757A388CCB349F511924595DA12152C2CA7C2DDB9B030B2D3D7B8BBB8E8E76
Submitted as: DAoC + cheat.exe
File type: pe · Size: 103533 bytes
Verdict: malicious (99/100) · Family: Upantix

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Trojan.Generic-9908425-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Upantix.GM!MTB
Kaspersky (KVRT): HEUR:Packed.Win32.Upantix.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9908425-0 (rule Win.Trojan.Generic-9908425-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 5600) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
1 behavioral detection(s): C2: connection to non-standard port [medium] (rule tl-c2-rare-port) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 6 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

1524 behavior events · 0 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Windows\win32dc\Sims 2_crack.exe - c9bb94310bd3cfd1586e76ccad8e64eef14155cdef4bf00dda252f9b2d0d4385
C:\Windows\win32dc\Quake3(nocd).exe - 21b619c57e765fe5994ff259089e12268a209fbe42fc69d5084933a39e036c18
C:\Windows\win32dc\Quake3 + nocd.exe - 7efc70c5a385efea0220733072d3aab44d281a850747afb7bd57213164a1e820
C:\Windows\win32dc\Doom 3_hack.exe - c8eb85f16a2e04418237ea3ae8ddcdf6dfe2d2123562b26acdc573128cfadd02
C:\Windows\win32dc\BattleField 1942(cheat).exe - ee39395228108525d5dfc4fca46ea6f1fd0e8a0508e0169a1fabca6fbca3bb97
C:\Windows\win32dc\Silent Hill 4(cheat).exe - 7e07f33cd54fdcf396e1dee4c9015f86f14ea129639287f0bf31f7f4808b74cf

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787643205&P2=404&P3=2&P4=i8bXcTlAAZj3vl%2bbBJz4fR%2fNdBhAGJVYcEsxKiBagVxR3Psnz6egrscKHaDFb%2b%2bkA1NxENN4DMk2qcOzOqsQDA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787643264&P2=404&P3=2&P4=FcTQOKpoG9Bh%2fR82Rh19J7SmibVsciEQJ4Ku%2bFbgkR6MeM8COoCLfQjeKjdt51cDWDTan8F%2blsu7K3Q7qpFfjQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

us.undernet.org

Embedded IP addresses

13.89.179.15
4.230.171.124
20.247.185.124
85.210.193.152
135.233.95.144
20.165.94.54
20.184.175.21
52.123.128.14
20.231.239.246
52.123.129.14
92.223.78.30
20.165.94.46
52.110.12.14
52.110.12.19
203.26.79.13
4.150.223.108
162.159.142.9
135.233.45.222
172.83.156.122
52.123.252.215
135.232.92.34
52.148.114.188
48.200.63.27
72.153.5.131
142.250.195.131

More Upantix samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report