MALICIOUS — c894ed71694fd28d60113b5594f9e61e5133a18f410960849e868b60b8beb973

MALICIOUS — c894ed71694fd28d60113b5594f9e61e5133a18f410960849e868b60b8beb973 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Malgent family. 3 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

SHA-256: c894ed71694fd28d60113b5594f9e61e5133a18f410960849e868b60b8beb973
SHA-1: 2a5e7de67590ca8a60e1e3d518ac505ada2d5c28
MD5: 5d4037b55e48dad64c3fdd1fe565ff5c
imphash: fcf1390e9ce472c7270447fc5c61a0c1
ssdeep: 12288:2zxzTDWikLSb4NS7eX+t/0XiLNAhzJkSVgF9D3rMlVJNY+aO3RX2m:QDWHSb4N2NCddVgF930Y+a0RXD
TLSH: T18C4EF1CD43116385EEB2DE507C907D5E91A1F8CA11797CEA5B87C01F32E288FA85168B
Submitted as: c894ed71694fd28d60113b5594f9e61e5133a18f410960849e868b60b8beb973
File type: pe · Size: 658872 bytes
Verdict: malicious (99/100) · Family: Malgent

Detections (3 of 55 engines)

Hash: abuse.ch ThreatFox: known-malicious-hash
Microsoft Defender: Trojan:Win32/Malgent!MSR
Kaspersky (KVRT): HEUR:Trojan.Multi.Donut.b

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Hash: abuse.ch ThreatFox flagged known-malicious-hash (rule known-malicious-hash) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 22 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

24211 behavior events · 3 ATT&CK techniques · 7 dropped files.

Dropped files

C:\ProgramData\Telephony.exe - 9b4e496e28d0dd2c22dafab7b91114d58be3c9f2b07eaa1200709b5fe84dd046
C:\ProgramData\1.log - 534d71cadd3552439fd7de01b8eb92187bc084a922bc96af3fd63aed1b43d45c
C:\ProgramData\DisplaySessionContainers.log - 9cbbe9c05d7b2c03b16733cded0834298968133f0ef621622fd45502f41bba20
C:\ProgramData\中文包.bat - 9f483fcda5bbb1209ac02f81fcb196c781e4799a9a047fc7ceaf6727bb86711a
7d16249bc61ec9613539941df1d6cc5d0a494814887e71cce2926f8b1a32861d - 7d16249bc61ec9613539941df1d6cc5d0a494814887e71cce2926f8b1a32861d
85a17eb8de80dc938dfa9921c5c89e23a097d1ec473ba8aac40e0b25964f7816 - 85a17eb8de80dc938dfa9921c5c89e23a097d1ec473ba8aac40e0b25964f7816
c2282b038c1a4e477faa37a998b09bb587e2e5be86bffb52d316379bdb5ad469 - c2282b038c1a4e477faa37a998b09bb587e2e5be86bffb52d316379bdb5ad469

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787855409&P2=404&P3=2&P4=T0e9ZbS8lj5qGlaftUNu8YGVc62KWzJa2ppUPZRgse7AlLcphOutDCXSTtXmakiULt6cNLEDvD%2fJ4aBNpdNOvg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787855504&P2=404&P3=2&P4=SlJ3U8PRaQQ33HsvtvxWFeFu%2bhGCDgRuIkaZ8jDy3UD34MAussczY1q7U5j59blcs8ZoQ5xUW57KyMQR2nZ2lQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

to9.uk
schemas.microsoft.com
windonws.com

Embedded IP addresses

52.168.117.175
4.230.171.124
85.210.193.152
52.230.59.222
135.232.92.137
4.150.223.114
74.178.240.51
40.84.85.40
135.233.95.144
20.236.44.162
52.123.128.14
52.123.252.242
135.234.160.246
203.26.79.13
52.148.114.188
52.123.252.202
74.179.71.159
52.123.252.230
72.145.35.104
137.220.155.75
52.110.12.21
52.110.12.54

File paths

D:\Projects\WinRAR\sfx\build\sfxrar32\Release\sfxrar.pdb
T:\:d:l:t:
C:\ProgramData

More Malgent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report