MALICIOUS — c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
MALICIOUS — c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the GameThief family. 5 of 25 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc - SHA-1:
c5d806a93899dc08b3dc4dacd65dbfcf9b167bd7 - MD5:
9c5f34412577cfad6294df759b501b61 - imphash:
a3cb65cc4bd6d4b6d92a3951cc3eb29e - ssdeep:
192:nrF6bzPOfrPjteBBpa4UhS/T2n/8xca7sUqWMHOsPPuns3xFqj4PpzjBE:p6bzckBj/UhkTbxczW4PunixFrxzN - TLSH:
T1C626BFA209FD4C93E2F6D224751C790D98F30E3ED15A11402AAAF0B5440E07F16BEB29 - Submitted as: c2af39cd735fff0c32600813866ae952325cd64757a8855552c7fa4583da80bc
- File type: pe · Size: 14848 bytes
- Verdict: malicious (97/100) · Family: GameThief
Detections (5 of 25 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- Detect It Easy (packer/type): DIE:UPX 1.20
- Microsoft Defender: Virus:Win32/Viking.MS.dll
- Emsisoft (Emergency Kit): Trojan.GenericKD.38973762
- Kaspersky (KVRT): Trojan-GameThief.Win32.Lmir.xe
MITRE ATT&CK
Why this verdict
The malicious score of 97/100 is the fusion of 8 weighted signals:
- Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8312) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Microsoft Defender flagged Virus:Win32/Viking.MS.dll (rule
Virus:Win32/Viking.MS.dll) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.38973762 (rule
Trojan.GenericKD.38973762) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged Trojan-GameThief.Win32.Lmir.xe (rule
Trojan-GameThief.Win32.Lmir.xe) - engine signal, weight 0.55, confidence 0.85 - Contacted 37 external host(s) at runtime (17 HTTP) - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:UPX 1.20 (rule
DIE:UPX 1.20) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1, UPX 1.20 - static signal, weight 0.25, confidence 0.55
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
65 behavior events · 1 ATT&CK techniques · 0 dropped files.
Runtime network
- www.msftconnecttest.com
- inference.location.live.net
- vrnk774.nease.net
- ctldl.windowsupdate.com
- login.live.com
- v20.events.data.microsoft.com
- desktop-hsgcbep
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- settings-win.data.microsoft.com
- licensing.mp.microsoft.com
- assets.msn.com
- www.bing.com
- msedge.api.cdp.microsoft.com
- tas02.sls.update.microsoft.com
- geo.prod.do.dsp.mp.microsoft.com
- fe3cr.delivery.mp.microsoft.com
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786399189&P2=404&P3=2&P4=EdSkU%2bnzJwtnro5AOo7J5UUB6nkg%2fEOgqoF3ByxOw2GAwaWVIFp9l9RIr8xTFz4wynTzgsfYIVDJWpyBwPdNTA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786399221&P2=404&P3=2&P4=V9dKm5KHSl55ZK6oytL6o0%2bmSNl9hGaw%2bt3u1Vkcy55vpLSStfRFWYfbLveo1U5sWqR%2brpltKArD6sDbUzRHFA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- vrnk774.nease.net
Embedded IP addresses
- 4.150.223.100
- 52.123.252.246
- 57.155.104.224
- 4.230.171.124
- 52.230.60.54
- 74.178.240.61
- 135.232.92.97
- 20.42.73.25
- 52.123.252.216
- 20.165.94.46
- 135.233.45.221
- 203.26.79.13
- 52.123.252.204
- 184.84.165.171
- 57.154.63.210
- 20.89.1.12
- 20.165.94.63
- 72.145.35.108
- 48.199.12.1
- 20.42.65.94
- 52.148.114.188
- 92.223.78.30
- 52.110.12.1
- 52.110.12.18
More GameThief samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report