MALICIOUS — c0c42934680fa49a0b2903402c702330fb824b0e752c38bb61654fe8f074b337

MALICIOUS — c0c42934680fa49a0b2903402c702330fb824b0e752c38bb61654fe8f074b337 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Fileinfector family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: c0c42934680fa49a0b2903402c702330fb824b0e752c38bb61654fe8f074b337
SHA-1: 384d6348963e305fab7aa50fa488e4c71b295de6
MD5: 93aa1e718e129d336177eb4b3faf1b3c
imphash: 895fbb56c02c3d2bca3125cef5da8730
ssdeep: 1536:txft5Je6Yxft5Je6Yxft5Je6Yxft5Je6A:v15Jt015Jt015Jt015JtA
TLSH: T1A33C3DD531847610EDB4F908AD04EC2DB263C9A622363BD82802D57F75B97F706D982E
Submitted as: c0c42934680fa49a0b2903402c702330fb824b0e752c38bb61654fe8f074b337
File type: pe · Size: 113311 bytes
Verdict: malicious (99/100) · Family: Fileinfector

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Malware.Fileinfector-9831958-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Vindor!pz
Kaspersky (KVRT): Virus.Win32.Lamer.ks

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 10 weighted signals:

ClamAV (daily) flagged Win.Malware.Fileinfector-9831958-0 (rule Win.Malware.Fileinfector-9831958-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Terminates Browser, Office or Security Processes [medium] (rule tl-process-kill) - dynamic signal, weight 0.40, confidence 0.90
Contacted 57 external host(s) at runtime (25 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 15 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

75003 behavior events · 2 ATT&CK techniques · 28 dropped files.

Dropped files

C:\Windows\system.ini - 7e081e75bac1c1f6a0ab15b0c121e2b558e13ecb2096f9e9b4ab01fcb911664a
C:\Windows\System32\vcruntime140_threads.dll - ffdd3305c4a693bffc369ca7bd552dfcb225c8cf9d40f07f32fabde701f66e33
C:\Windows\System32\msvcp140.dll - a90aaf49aa29188cb5d2d81e989145c4afe1536d399f1b8e0150b5e703b152e1
C:\Windows\System32\vcruntime140.dll - fab6c569195ad84243096af01662e18880bd53eb893837db7d5b1c285d332ae4
C:\Windows\WindowsUpdate.log - ca5a969a1e7dc7b74285627fa8790b0ecdbc98ab92ad030b30f828ab8eefe327
C:\Windows\setupact.log - e3f59204bb1e39b4bc1ee0d224133c98f50f21fcf2e32bf52d8156d7082a29e6
C:\Windows\System32\mmc.exe.config - bca3b51eaf204b32f8435ab3b6efef62b11ca1d7d20c331c13032839b5cf0032
C:\Windows\System32\msvcp140_2.dll - 70ba2ca7c2886a19a5410436af976869f37c5517e2ba09ccb6ab7341284dff99
C:\Windows\System32\msvcp140_atomic_wait.dll - 42f1438061bac3f38c8e21af6e12a072cbe7a5d0e82d85b2ed67ba1c2ac4d28f
C:\Windows\System32\vccorlib140.dll - bb19410223935ae09f100b4cc609cac02488158c89998982df9f5588c0928a0a
C:\Windows\win.ini - ba842d8399fa244413aac6b6abe34a4d92de3bb965195ce00a9d0e8e19cc3b6f
C:\Windows\System32\dssec.dat - 9ba0f06b96b6d443f1e9a37315d4f4cd7cd13e58caedb94ad76cc54f08089a90
C:\exc.exe - 5b6a8f4ceab04ea4c5dfae629145e453c8850cba3ca48ef40d978af0ab49f44b
C:\Windows\System32\msvcp140_1.dll - 8f7837e06ccc52c222128b6714082d9189dffabbe7dfed8c1cfe6ee6003dfb95
C:\Windows\Professional.xml - e99bd048e445fd2d7a5ca645722fdbc8401b98b4a84ef9b742a41d1189a916eb

Embedded URLs

http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://office.microsoft.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787938256&P2=404&P3=2&P4=DQ%2bkFAqIsX1BNvmqpQ0Qma6QaouqcyHID2MIsXc1MfFa4xNYi%2f%2f4HY7AnK44UKew1PU7UJhmHWaEPRujFDdGEw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://www.freeav.com/
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787938337&P2=404&P3=2&P4=YRkz2cgJRz8F%2fkQVpF%2bulSyVI9tFqakqg%2bEzbM9JhY0EjaKlRNTOKOBuiIo7A1apx840XMos1NwtaaK%2fNV3wHA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

crl.microsoft.com
www.microsoft.com
office.microsoft.com
www.freeav.com
www.avira.com
script.crazyegg.com
assets.adobedtm.com
nexus.ensighten.com
t.nc0.co
www.webassetscdn.com
s.go-mpulse.net
doh.cq0.co
dpm.demdex.net
widget.trustpilot.com
symantec.demdex.net
symantec.tt.omtrdc.net
data.privacy.ensighten.com
www.nortonlifelock.com
rmbyy5ra.avira.com
oms.avira.com
mhubc.avira.com
getrockerbox.com
www.antispyware.com
img6.wsimg.com
img1.wsimg.com

Embedded IP addresses

20.89.1.13
57.155.104.224
4.144.132.114
4.230.171.124
4.247.188.224
74.178.76.128
20.184.175.12
135.232.92.97
135.232.92.137
20.231.239.246
52.123.129.14
52.123.128.14
4.150.223.96
135.233.45.222
203.26.79.13
135.232.92.34
51.11.192.51
52.148.114.188
52.110.12.20
52.110.12.15
85.210.196.11
52.58.28.12
4.195.116.8
40.115.75.193
72.145.35.101

More Fileinfector samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report