MALICIOUS — c0ab34e7069b0ed21b18bce1c19fa93f7686389646efdaacb69512ceb2a273e3

MALICIOUS — c0ab34e7069b0ed21b18bce1c19fa93f7686389646efdaacb69512ceb2a273e3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Obfuscator family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: c0ab34e7069b0ed21b18bce1c19fa93f7686389646efdaacb69512ceb2a273e3
SHA-1: bb64182fcdbd93986fa59a9a7e3ec9c1600ea05c
MD5: 9002d67ab7809d6d26a5da99a574870c
imphash: 058a0c5fda4ee61f73a11e45ca8952af
ssdeep: 1536:Co0nTOnQGUvb9OdLwGINMIB6jZxHJ6P6D5Ol:uJGQ8XJjD5Ol
TLSH: T17034B5941679E4E5F2B5E20F4EC5AD7C0B9E8546927B1C95258A8F0F0CD38F3A03462E
Submitted as: c0ab34e7069b0ed21b18bce1c19fa93f7686389646efdaacb69512ceb2a273e3
File type: pe · Size: 57344 bytes
Verdict: malicious (99/100) · Family: Obfuscator

Detections (5 of 55 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: VirTool:Win32/Obfuscator.NM
Emsisoft (Emergency Kit): Gen:Variant.Midie.100609
Trellix Stinger (McAfee): Downloader-CJX.gen.o
Kaspersky (KVRT): Worm.Win32.VBNA.brmq

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

50358 behavior events · 3 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\kiuiri.exe - a117d9b0d5bf60233914da5c2e27a50e284286cd50ffbb96a5a85945d18b3ee6
c799a67596dd1ab47cb47e9469fd648126c5deb4b95af1d9b8d4120ef91a4df1 - c799a67596dd1ab47cb47e9469fd648126c5deb4b95af1d9b8d4120ef91a4df1
49be41c972ca692963866b4f0f755c2ae02f78fc80f9799dde3e9a0d818be700 - 49be41c972ca692963866b4f0f755c2ae02f78fc80f9799dde3e9a0d818be700
9dd808ecf5b97d25e3811cd34774a70eb70fc493cb26b1b48f42f68fdab43933 - 9dd808ecf5b97d25e3811cd34774a70eb70fc493cb26b1b48f42f68fdab43933
3cd374fffc40a07889fb7192deaa39b9bff2ab3c2458b820fc0d7981b553d629 - 3cd374fffc40a07889fb7192deaa39b9bff2ab3c2458b820fc0d7981b553d629
3c8fd020db0783977d160c374f5ace96d8e79932bea8c567e22b7f0b2f46f5d3 - 3c8fd020db0783977d160c374f5ace96d8e79932bea8c567e22b7f0b2f46f5d3
931901291642dac7d3099b97501eed19f6b5a55320b47df12d4dda598f25cab3 - 931901291642dac7d3099b97501eed19f6b5a55320b47df12d4dda598f25cab3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787916973&P2=404&P3=2&P4=WvLWx49CIrh0zUAFCP0rtkI1eJUOJOYpWO0Cn9mfkfQ%2bsRVELfUHpAvMMcxV%2fJCKG2yABnyGUygrpA5wC0eokA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787917021&P2=404&P3=2&P4=MH6BjjmNpZ7IWVHNVIGlCp5nqmB6jFyKFUQh0d2L19tUUulZgU8l7bBQ14Nv2R50984jTW2f94lWMlZerfatJQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787313735&P2=404&P3=2&P4=NhCZxbiYwhu5sc6EIcX%2fVwhKRa%2fh9c9BtAysJgyv3wCZsrTYQX66W5i77nb4jiZsPneZUVyZIuCmhfqEeIi%2b1w%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787313320&P2=404&P3=2&P4=M82n87Kafvw6MhdaBInUvxz2fCEGqEzVDyWGL2Ar2vGiMCaoUggf2pGteA0LSTROYvnCuuGswCt2Cwd7ZMjVow%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns1.player1253.com
ns1.videoall.net
ns1.mediashares.org

Embedded IP addresses

20.184.175.12
52.123.252.232
4.144.132.114
57.155.101.212
4.230.171.124
135.232.92.137
20.89.1.8
74.178.240.51
20.112.250.133
52.123.128.14
52.123.129.14
172.178.240.163
74.178.232.29
203.26.79.13
135.233.45.222
52.148.114.188
52.110.12.30
52.110.12.47
72.145.35.100
104.46.162.230
52.178.17.232
172.175.111.170
48.192.143.121
4.207.44.69
4.150.223.108

File paths

E:\Program

More Obfuscator samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report