MALICIOUS — d1ff8c962ae3063d47fc3c319eb66f12345dafc6c8865c5977195ae9072ba3a1

MALICIOUS — d1ff8c962ae3063d47fc3c319eb66f12345dafc6c8865c5977195ae9072ba3a1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: d1ff8c962ae3063d47fc3c319eb66f12345dafc6c8865c5977195ae9072ba3a1
SHA-1: 59a35d59686cd590567339328859f1f4f6f5f670
MD5: 2b5c2587d3819bc90c033182adbd8b19
imphash: e64c588944c2ac10400ed12764c26b03
ssdeep: 1536:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdaT:K0GAqjuVZ6rNOaT
TLSH: T1873502698006EA69F5BEF7043858AC2D7B5E53741CEDB5EDBF10526C6238313920932B
Submitted as: d1ff8c962ae3063d47fc3c319eb66f12345dafc6c8865c5977195ae9072ba3a1
File type: pe · Size: 62296 bytes
Verdict: malicious (98/100)

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:HSUDHUHW
ClamAV (daily): Win.Trojan.Generic-9909987-0
Detect It Easy (packer/type): DIE:Packman
Microsoft Defender: Trojan:Win32/Urelas!pz
Trellix Stinger (McAfee): Trojan-FEXT!87EE44CB458B
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Generic-9909987-0 (rule Win.Trojan.Generic-9909987-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Packman (rule DIE:Packman) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:HSUDHUHW, Packman - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12466 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\biudfw.exe - d0bc03bf2bd21fddb5ddf96284acea04333615a2fa5557549fd7f0d7fccde2c6
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787834469&P2=404&P3=2&P4=AJ%2b5HdtzylubZ9kb5ukt5JMbfWEajAHGBHdwL3Lu4MqzgCtVWhmhglqjC0TRdG5YeicZB4ycKfRSRB7vyZMNgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787834560&P2=404&P3=2&P4=VDjbPi%2bTa9YXvC9gh4uqL1sWzuQ4CiQSKoZ3mSSDPBsJ0geQv%2bvKN7DxFF%2bUisoZitlajBsB27lsLMg2anMIdw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.184.175.2
4.230.171.124
20.42.179.204
20.247.184.197
74.178.240.61
20.165.94.54
51.132.193.104
20.165.94.63
20.112.250.133
40.103.64.226
52.123.128.14
52.123.129.14
135.233.45.222
52.123.252.216
218.54.47.76
203.26.79.13
218.54.47.74
52.148.114.188
135.233.45.223
162.159.142.9
218.54.47.77
52.123.252.233
74.178.232.29
52.123.252.246
72.145.35.97

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report