MALICIOUS — d3f44635bf9ee526dbdfd996aae2c7a7212785b6eb9314fab5c0c48d01c88d3a

MALICIOUS — d3f44635bf9ee526dbdfd996aae2c7a7212785b6eb9314fab5c0c48d01c88d3a is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Rozena family. 4 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: d3f44635bf9ee526dbdfd996aae2c7a7212785b6eb9314fab5c0c48d01c88d3a
SHA-1: 09ae13d84b0ce1c3697b98f58d896fd1bb373e8b
MD5: 045a1d81e03f4392326da1132d8380ae
imphash: 5877688b4859ffd051f6be3b8e0cd533
ssdeep: 3072:3q6+ouCpk2mpcWJ0r+QNTBfdBl+X0zdiqMgeOs8aF6zoUhou3WvujV4CiV7E7dem:3ldk1cWQRNTBFHe0p0gPskoRdfudd
TLSH: T1A845D06117622325F1F7FAE10AD0BE1C5042A5A110BC98D8504BE91DA7EBC735B7A0FE
Submitted as: d3f44635bf9ee526dbdfd996aae2c7a7212785b6eb9314fab5c0c48d01c88d3a
File type: pe · Size: 275456 bytes
Verdict: malicious (98/100) · Family: Rozena

Detections (4 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): PureBasic
Detect It Easy (packer/type): DIE:PureBasic
Microsoft Defender: flagged
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 10 weighted signals:

Extracted Rozena config (1 C2) - engine signal, weight 0.80, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Scheduled Task / Job [medium] (rule tl-scheduled-task) - dynamic signal, weight 0.40, confidence 0.90
Contacted 29 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:PureBasic (rule DIE:PureBasic) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PureBasic - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10539 behavior events · 2 ATT&CK techniques · 5 dropped files.

Dropped files

C:\ProgramData\update\windows.exe - 82a2a9fe4df257978befa1181e52fade7f622dcab24d5ba8d37fba90ea76af76
C:\Users\analyst\AppData\Local\Temp\D30F.tmp\update.xml - 92176d5cffebdb304e823f8f3e0aa7d16958a7a684e166b3e584b1fe5b9903ce
C:\Users\analyst\AppData\Local\Temp\D30F.tmp\D31F.tmp\D340.bat - 5a364f423416ce3e9c2417b514f34dbea49a42e8b76a6287eb92ee8d637421f7
471c79a9eb39c52aaa97b372d8bfe0493fcc0e6aa85c42d2f5ec8555da457d92 - 471c79a9eb39c52aaa97b372d8bfe0493fcc0e6aa85c42d2f5ec8555da457d92
0a22a9951534c82716e56b563836f0644f06f8ceb718498539c9be5d856c11a6 - 0a22a9951534c82716e56b563836f0644f06f8ceb718498539c9be5d856c11a6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787861461&P2=404&P3=2&P4=nhotbWR1RGo900Ny%2fDO%2f2GcUOn0Tu%2fr16xYX%2fvgw8Ta5rwBEjfwrTOurx1v8w4Ghiqc3QryqLnZVLvRlIkT%2bXA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787861584&P2=404&P3=2&P4=BdChDxD5SgcTyRq1mbG3jJwXPCPuHlJtqMOiJiJBfJs8X1s2DT2y%2fOf6B0iel9sG8PAE0Zm%2fG2%2bunHF17Ml6Aw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.97
20.42.179.192
4.230.171.124
52.253.84.76
135.232.92.137
74.178.76.54
52.168.112.67
20.165.94.63
40.79.163.154
52.123.129.14
52.123.128.14
20.112.250.133
40.99.134.18
40.103.64.242
172.178.240.161
203.26.79.13
172.66.2.5
52.148.114.188
172.178.240.163
57.155.104.224
52.110.12.28
52.110.12.3
74.179.71.159
72.153.5.141
52.123.252.245

More Rozena samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report