MALICIOUS — d78bee7b5be7fbaf731076f5c0c2c4592ac3f1bf74efc6cd3050acfde0a76445

MALICIOUS — d78bee7b5be7fbaf731076f5c0c2c4592ac3f1bf74efc6cd3050acfde0a76445 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the C83B492E family. 4 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: d78bee7b5be7fbaf731076f5c0c2c4592ac3f1bf74efc6cd3050acfde0a76445
SHA-1: ac6e496481a3345556621bf7bb6c9d836379ac31
MD5: 119f30ef0d34ade111970ff7eddba538
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070d3SYOyegdLuX1R7IGgowz8deSa:Qoa1taC0CSYOyey6X1RkGq8YSa
TLSH: T1EB5A234A57196B0CE2F6C5842D3D266EC441E4E1977C298B52CBF14FB3CBA67782009B
Submitted as: d78bee7b5be7fbaf731076f5c0c2c4592ac3f1bf74efc6cd3050acfde0a76445
File type: pe · Size: 1958400 bytes
Verdict: malicious (98/100) · Family: C83B492E

Detections (4 of 55 engines)

ClamAV (daily): Win.Malware.Zusy-9764479-0
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E
Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs

MITRE ATT&CK

T1543.003

Why this verdict

The malicious score of 98/100 is the fusion of 5 weighted signals:

ClamAV (daily) flagged Win.Malware.Zusy-9764479-0 (rule Win.Malware.Zusy-9764479-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80

Dynamic analysis (windows)

99 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\5704.tmp - 65469c7b461b9d4819ede4c2b2a2331ed373e7715ad54d447e145aa5f5636097
c30f82e37852cf1f640a78b283c397bd3b3b5d2be516ec57438ca01efe104f70 - c30f82e37852cf1f640a78b283c397bd3b3b5d2be516ec57438ca01efe104f70

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787864164&P2=404&P3=2&P4=AJ5JctyCId5eP26TsQU8Owzt8RbIdGQtcEtQ%2fqwojSgfnsIUHQCYGfEWPzwffMjaz5SHzco548A0NKOv7yVv%2bQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787864217&P2=404&P3=2&P4=ikciDCKUyy6zp415aG1EzlOU55Wc3268felZuJa267qXK4PxuRJRM1uMslxTBVBc9uJsfWxK0dKhBofTbGAFMQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

schemas.microsoft.com

Embedded IP addresses

20.42.65.94
52.230.59.222
4.230.171.124
85.210.196.11
20.42.179.204
20.165.94.63
4.150.223.105
74.178.76.54
20.184.175.12
52.123.129.14
20.76.201.171
40.99.133.242
52.123.128.14
135.234.160.245
203.26.79.13
104.46.162.229
51.11.192.51
52.123.252.229
74.179.71.159
92.223.78.30
52.148.114.188
52.110.12.26
52.110.12.45
52.123.252.193
72.145.35.103

File paths

O:\35

More C83B492E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report