MALICIOUS — d1d7e16e33df5051eeea9368e54e7fac7f92696b26bc8f3eb838da778bbe9841

MALICIOUS — d1d7e16e33df5051eeea9368e54e7fac7f92696b26bc8f3eb838da778bbe9841 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Upatre family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: d1d7e16e33df5051eeea9368e54e7fac7f92696b26bc8f3eb838da778bbe9841
SHA-1: 865f1443f3265a6c18ade369a38d02c0a81e374a
MD5: e33a6ffa10f6d87cfcf1401ace49721c
imphash: 222e7b320f36011feb1642000d8fa826
ssdeep: 768:kf1Y9RRw/dUT6vurGd/pkUOyGAv+rCBsPGTWikRyyyxOjylAYylGPMq3lylQ:GY9jw/dUT62rGdiUOWWrC6P6TfR/
TLSH: T15732B88E81A80A93D63308F31233FFED665BB4E207ED2659CCDDB0D944D29438C5186A
Submitted as: d1d7e16e33df5051eeea9368e54e7fac7f92696b26bc8f3eb838da778bbe9841
File type: pe · Size: 44060 bytes
Verdict: malicious (100/100) · Family: Upatre

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Upatre-6726345-0
Microsoft Defender: Trojan:Win32/Upatre.MA!MTB
Emsisoft (Emergency Kit): Trojan.GenericKD.1801883
Trellix Stinger (McAfee): Packed-CA!E33A6FFA10F6
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Malware.Upatre-6726345-0 (rule Win.Malware.Upatre-6726345-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Upatre.MA!MTB (rule Trojan:Win32/Upatre.MA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.GenericKD.1801883 (rule Trojan.GenericKD.1801883) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Packed-CA!E33A6FFA10F6 (rule Packed-CA!E33A6FFA10F6) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

10791 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\szgfw.exe - f6f7281f5ae9f4a40b0cce2dfac7eff94280c4456f39fee442accdcb8c07c879
729ef674af39d88a4efe35c58e80e4466c5485de90f2487cde352639ab1ab8a3 - 729ef674af39d88a4efe35c58e80e4466c5485de90f2487cde352639ab1ab8a3
b615550c6a83672ee4fd862eacafbf4b7ba6e4aabd085ac521cf88765d6cb4cc - b615550c6a83672ee4fd862eacafbf4b7ba6e4aabd085ac521cf88765d6cb4cc
46e5a2482cf183f04d8f19e5754e90f7517eb6877fb63f33954efe0497cc7149 - 46e5a2482cf183f04d8f19e5754e90f7517eb6877fb63f33954efe0497cc7149
8171c6d65ddae033438e13f122acc0ef94b3ed147bae803e59d060d7a3338f07 - 8171c6d65ddae033438e13f122acc0ef94b3ed147bae803e59d060d7a3338f07

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/afb4c1e7-5ab6-4274-bbe6-fa4639876844/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/afb4c1e7-5ab6-4274-bbe6-fa4639876844?P1=1787350513&P2=404&P3=2&P4=hPXnleCiB9KFQ4NRbqYeeghmod3YwFu3rr9u1dSWiMPau3fH8ayNmoxsXeGYw0HQYtbTaDTHKbjAVSOC%2b0lU%2bA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.179.204
20.42.65.85
4.144.132.223
52.123.252.193
4.247.188.224
4.230.171.124
20.165.94.54
20.184.175.19
74.178.240.61
4.150.223.109
52.123.252.195
74.178.76.128
104.18.33.89
52.110.12.48
52.110.12.3
51.11.192.48
4.150.223.110
135.233.45.223
4.209.250.170
20.42.72.131
52.148.114.188
203.26.79.13
51.104.15.252
20.42.65.88
72.154.7.110

File paths

C:\Documents
C:\a06be67d585e68cc273f590e2f2ddeda71a2315eecd34e6309c6cbcbdb1700be
C:\5836bb806de14caadf8f612013c3e15d4376b87c3808b64c26569b546ef13372
C:\WJGEcsHZ.exe
C:\27602e960f45f3b8dfb2655ad63932c61d4f85bd375b623caad64cdfce421bf5
C:\HN7LfbAL.exe
C:\6Q6YjpZb.exe
C:\ec7e9a0002524e329da53523db52a0d703fa6f049db8f3147ab739559f332fe1
C:\86fef6cdf1c49ec45dc06cfb878d6103424ddebc1c0f0808e27758d73f152d3e
C:\LWiZYhT1.exe
C:\R4vhmmig.exe
C:\d3wOpEIX.exe
C:\9c1e699f978d138fd0361b5b400fdeca020d2d7f46f394fd1fd9eddcd74d972c
C:\0c9523b00d8aef996656b84c5477b00800a6588b850b65968dcf4ef925ffe00f
C:\Q4mOtJeJ.exe
C:\X1bNTGGY.exe
C:\F7XC0J6J.exe
C:\MdrncZ7n.exe
C:\Qbqup827.exe
C:\258c20b64192af91c4795887fbc226c5f01896ba33f7f4325818cff0a018a482
C:\UuAlrQyJ.exe
C:\cIsfDfv2.exe
C:\PZRtjA7u.exe
C:\4dUDBxOv.exe
C:\0d1MUdnf.exe

More Upatre samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report