MALICIOUS — c1c4bb461ff536b48f3d2567162cd1db27593f783b3d85191f1967ec71790f38.exe

MALICIOUS — c1c4bb461ff536b48f3d2567162cd1db27593f783b3d85191f1967ec71790f38.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 1 of 54 detection engines flagged it, exhibiting 8 ATT&CK techniques.

Identification

SHA-256: c1c4bb461ff536b48f3d2567162cd1db27593f783b3d85191f1967ec71790f38
SHA-1: be316f6157585df8d819ec5d865a876f853c7e75
MD5: 2c5eda0b1bb81ce0b40e283b426ede55
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 196608:SwE3OPCCMimCtMgYVi3nBHF5jbADWv+jvmrmnwKmccJdEjvqWKuj7xJn6qYEzr/:GUmCNAohjKWvCmrfBTH+r6MXolBuxf8
TLSH: T17B6D33AEBE0A5900C8E249785A09457C71E497D640D8D0E1D6B7398827EFC3B14E9CFE
Submitted as: c1c4bb461ff536b48f3d2567162cd1db27593f783b3d85191f1967ec71790f38.exe
File type: pe · Size: 12203520 bytes
Verdict: malicious (99/100)

Detections (1 of 54 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Memory forensics: 4 finding(s), e.g. process hollowing in tsk_038d1b36c3 (pid 9212) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Dropped a malicious payload: __PSScriptPolicyTest_dp53mjyg.g0l.psm1 - dynamic signal, weight 0.62, confidence 0.90
7 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

27627 behavior events · 3 ATT&CK techniques · 15 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_dp53mjyg.g0l.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
5f34d0bfd072c78baaa649202ea8eaeb8ea283099719c6c4eed693ade053c0ef - 5f34d0bfd072c78baaa649202ea8eaeb8ea283099719c6c4eed693ade053c0ef
8fdf0224124f5943b236e207899c8f2b443d99996d9a2c7463aa65b7ab6002fb - 8fdf0224124f5943b236e207899c8f2b443d99996d9a2c7463aa65b7ab6002fb
386362b4af86b02aa8f3d345bb6eac337555c337df529ee49c1c393f25544283 - 386362b4af86b02aa8f3d345bb6eac337555c337df529ee49c1c393f25544283
70295adcb69ff020b2156111db0fa489712482fd39197016fa15893e83d982b3 - 70295adcb69ff020b2156111db0fa489712482fd39197016fa15893e83d982b3
785972c0ba557f76564abf796d62df9378bc3a5aa81e480cbd845f4673690571 - 785972c0ba557f76564abf796d62df9378bc3a5aa81e480cbd845f4673690571
331ece2365a5dddf0d69405d06c3ad6e1a2b57f98d2c9315f35e719bf6413e7b - 331ece2365a5dddf0d69405d06c3ad6e1a2b57f98d2c9315f35e719bf6413e7b
1b6d623052278094db2e5a62b3e34c3ca3fb82e330e402a18c5921d6a3874779 - 1b6d623052278094db2e5a62b3e34c3ca3fb82e330e402a18c5921d6a3874779
41b5d705647b9c93cb0b26ac2fe56b4c84323ec9803588ab36e97b7a91076bea - 41b5d705647b9c93cb0b26ac2fe56b4c84323ec9803588ab36e97b7a91076bea
49baffd57a2753b9b97346e3d9b7c896900bdf92e9cacc5c6e1526c90e6e696d - 49baffd57a2753b9b97346e3d9b7c896900bdf92e9cacc5c6e1526c90e6e696d
35a1417b8becc7b02948417419b959b1fb5961bd4634fe0037af517e1f56c05e - 35a1417b8becc7b02948417419b959b1fb5961bd4634fe0037af517e1f56c05e
43349e7e90ebba5e90834e64a15f44976f2f64d7595aec2b2c9bdb648d44de23 - 43349e7e90ebba5e90834e64a15f44976f2f64d7595aec2b2c9bdb648d44de23
236c1905a4c30305b88a3e5062a4b9e1ed2efb407fd27d18bcaec3f058046115 - 236c1905a4c30305b88a3e5062a4b9e1ed2efb407fd27d18bcaec3f058046115
2a6edc189c646fade3a700aa8dc3b90796902b25dedfca6cfd952429bfed8976 - 2a6edc189c646fade3a700aa8dc3b90796902b25dedfca6cfd952429bfed8976
aacd9edc09c0e1df3750e1cf1891aa26f33d1f27381148e3b103a6026326aa7a - aacd9edc09c0e1df3750e1cf1891aa26f33d1f27381148e3b103a6026326aa7a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787635594&P2=404&P3=2&P4=ch1EQYiUGlQHeA%2fyeAk0SH6McrZoCILY3Jj60aOhCY87c0kQI86C3wlDjbpv23SUzNw3jjw4K%2bZDW%2fYVTWIxdg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/45cd9142-6feb-4946-89e7-63e58fada30a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/45cd9142-6feb-4946-89e7-63e58fada30a?P1=1787635617&P2=404&P3=2&P4=cfMppDRiyb8w6%2fnpYfdIKtMr2ZGmpXyONxH85h7VBBH2IdlEyPw7tIC5k3lilnUt%2bDGlXnKwbpqNduul7hiW3Q%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

h.nl
2.nl
7.no
k.su
rn.eu
download-windows-update.live

Embedded IP addresses

52.168.112.66
4.247.188.233
4.230.171.124
20.247.185.124
74.179.77.204
135.232.92.97
13.89.179.12
74.178.76.128
20.76.201.171
52.123.129.14
135.233.45.222
13.89.179.15
52.123.252.226
20.165.94.46
52.123.252.197
203.26.79.13
172.66.2.5
172.178.240.163
52.148.114.188
142.250.195.110
72.145.35.103
142.250.195.225
151.243.113.94
172.217.115.4
52.110.12.45

File paths

q:\^1
A:\D%g}
M:\S;
T:\e
C:\Users\Administrator\Desktop\Client\Temp\cJgQScGCaS\src\obj\Debug\rsZZ.pdb

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report