MALICIOUS — d1c5501363dbb5ccac017075179589547596ba9616d2f03d9fb1bb4e29f1d8ec

MALICIOUS — d1c5501363dbb5ccac017075179589547596ba9616d2f03d9fb1bb4e29f1d8ec is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d1c5501363dbb5ccac017075179589547596ba9616d2f03d9fb1bb4e29f1d8ec
SHA-1: f107c8e999ab29e92d9a8ee89c0d2b7e68bd875c
MD5: eedfe176dc10b974cc13f6938e816086
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dCK4mR5menm/hatPTcCGlg:Qoa1taC0JKX5ctCD
TLSH: T13C5A23420709370CD3F6C4542D1A26AEC442E8D7A37C1ACB528BF15EB7D7A6B78111AB
Submitted as: d1c5501363dbb5ccac017075179589547596ba9616d2f03d9fb1bb4e29f1d8ec
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\2CE7.tmp - 0c436cea2ece791f8a97ee8bff1b9623b31e3f98d32aad16cc9e77f3a84efaf5
6ad016ad2a7c5aa0d5165658a091b230c508f3a9f3abc5f11f0a54e2174ccf55 - 6ad016ad2a7c5aa0d5165658a091b230c508f3a9f3abc5f11f0a54e2174ccf55

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787835688&P2=404&P3=2&P4=ntqUa0C5PwaBRopUWuuWp75iS5Vx2f4S8kliC2aZc9xw1a%2fU9uoA8Zc%2boJbjh6nCX1bDvR3O%2bnF4GV4d3K20Uw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787835745&P2=404&P3=2&P4=PGx5rLk5rFD7YD1FMwT%2fqxcdkz6t7hpAQEJwpKfeIPJX3%2brlaOOWPObHqyUJNpMWdmug2dstgMAfLA10Ce5wcA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

52.168.117.168
52.123.252.243
4.230.171.124
48.211.4.16
20.247.184.197
20.165.94.63
20.184.175.6
85.210.193.152
74.179.77.164
52.123.128.14
20.236.44.162
40.99.133.210
52.123.129.14
52.168.117.170
135.234.160.244
203.26.79.13
52.148.114.188
52.110.12.8
52.110.12.37
135.233.95.80
74.179.71.159
72.153.5.131
52.110.12.21
52.110.12.10

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report