MALICIOUS — gchrome.exe

MALICIOUS — gchrome.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Dynamer family. 5 of 51 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d23b4a30f6b1f083ce86ef9d8ff434056865f6973f12cb075647d013906f51a2
SHA-1: c5d8f155209badd278437d0e534648f8d5c35aae
MD5: 49fd4020bf4d7bd23956ea892e6860e9
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 49152:sVic4rcPjPlzIWJDn8Ss2y44enoerL/TrRCxREX4x+va:42etHsFenjvT9/X44
TLSH: T1745EE03E072A3066F5B611E06833C99C0E2B946FD015AF746777AD533A6703BD14B82A
Submitted as: gchrome.exe
File type: pe · Size: 2930176 bytes
Verdict: malicious (99/100) · Family: Dynamer

Detections (5 of 51 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Cyble Vision: Cyble Vision: Malicious
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Dynamer!rfn
Emsisoft (Emergency Kit): Gen:Trojan.Olock.1

MITRE ATT&CK

T1112

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Cyble Vision flagged Cyble Vision: Malicious (rule Cyble Vision: Malicious) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Dynamer!rfn (rule Trojan:Win32/Dynamer!rfn) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Olock.1 (rule Gen:Trojan.Olock.1) - engine signal, weight 0.55, confidence 0.85
Contacted 48 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: 9.89.11.5 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections:.text, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30

Dynamic analysis (windows)

3118 behavior events · 1 ATT&CK techniques · 0 dropped files.

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/92621512-d997-4742-9ae0-db0593ed93c6/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/92621512-d997-4742-9ae0-db0593ed93c6?P1=1785974374&P2=404&P3=2&P4=N5KO8HHnzyYkscoTiQwZeMzOPbRbfDcXoEMZdtk0nYpWUEPLMCJOq4Vk1I%2fHCRXlfgYxUhxQ%2bVQ1pM%2fCW9yKeA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/095b6cce-5952-42aa-a19f-9268ce8ce016/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/095b6cce-5952-42aa-a19f-9268ce8ce016?P1=1785974438&P2=404&P3=2&P4=Ki%2fXFk3W7llE%2bma7So7QpJ6ovOVZn9CwjUJUMh3DAMICtoTa8%2fiW5QihJ96YdmBWHTGfoja6TxqiHuRRPyG0FQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

staging.to-do.officeppe.com
oneclient.sfx.ms

Embedded IP addresses

9.89.11.5
150.171.22.17
20.42.179.204
74.178.76.128
52.123.129.14
40.99.134.18
20.76.201.171
52.98.142.98
92.223.78.30
23.11.37.157
40.104.4.2
131.253.33.203
23.40.52.85
48.211.4.16
20.42.73.24
52.168.117.170
172.178.240.161
135.233.95.80
203.26.79.13
74.179.77.204
135.233.95.135
4.150.223.104
74.178.240.61
20.184.175.13
23.33.238.117

More Dynamer samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report