MALICIOUS — cbf6c038e6ed5c3c0e40d892151dc74039052d1567e80eaa69c39ab880eb7c47

MALICIOUS — cbf6c038e6ed5c3c0e40d892151dc74039052d1567e80eaa69c39ab880eb7c47 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: cbf6c038e6ed5c3c0e40d892151dc74039052d1567e80eaa69c39ab880eb7c47
SHA-1: 7f591e0948f3bac01592f429e1da798983a3ea38
MD5: 941dcd4a235bebd4284dc8a528feb582
imphash: 5da7833669e1658fe071bf31df00f9a3
ssdeep: 3072:HlFv8dvfdEDRmycmX260ps0GAqjuVZ6rNOjhi:H/v8trzlOYqjuCNeA
TLSH: T13E429E8D41177294F3B7DA415D00AF8E91A2B1EE217DAC981EC3C01E37F29279F64296
Submitted as: cbf6c038e6ed5c3c0e40d892151dc74039052d1567e80eaa69c39ab880eb7c47
File type: pe · Size: 198798 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:HSUDHUHW
ClamAV (daily): Win.Trojan.Generic-9909987-0
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Urelas!pz
Trellix Stinger (McAfee): PWS-FDJS!941DCD4A235B
Kaspersky (KVRT): VHO:Backdoor.Win32.Plite.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9909987-0 (rule Win.Trojan.Generic-9909987-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWS-FDJS!941DCD4A235B (rule PWS-FDJS!941DCD4A235B) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged VHO:Backdoor.Win32.Plite.gen (rule VHO:Backdoor.Win32.Plite.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 21 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:HSUDHUHW (rule high-entropy-sections:HSUDHUHW) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 218.54.47.76, 218.54.47.74, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:HSUDHUHW - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

13026 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\biudfw.exe - 0002d484de6b7294bebd719da906080db01816678a864232e700a2624414d9e6
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

218.54.47.76
218.54.47.74
218.54.31.226
218.54.47.77
20.184.175.10
52.123.252.216
4.230.171.124
172.215.188.225
20.3.1.41
74.178.240.51
135.233.95.144
51.105.71.137
51.11.192.49
52.123.252.198
20.165.94.63
48.200.63.27
4.150.223.103
172.178.240.161
20.89.1.13
203.26.79.13
34.104.35.123
40.79.141.154
172.64.154.167
52.148.114.188
40.84.97.4

File paths

T:\:b:
X:\:`:d:h:l:p:t:

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report