MALICIOUS — ProgramData .exe

MALICIOUS — ProgramData .exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Mira family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: dcbf9ce2f446741bacafb5b9286b07f50adbe8c2f372a4a5b6bd0f80cf6e06c6
SHA-1: d7c763dedc235b3d34c208ce910714a244bf96b3
MD5: d2344b857ba66f25dec31d57069899d9
imphash: 3a2003ea545fe942681da9e7683ebb58
ssdeep: 6144:6BxIK3CTW8TMjp41u6nyHwnZB7s5t3c5uOU1CHtXJl+QPBY18nvVPsWMCaCgkclJ:CxIK9V14ImyHYUt3IuOZHZzJBY188j
TLSH: T10F498C412261B2C2EE19C54C88EEA31D855CB49981F4FCD1797B6DF9E9AECCB04C1278
Submitted as: ProgramData .exe
File type: pe · Size: 420288 bytes
Verdict: malicious (99/100) · Family: Mira

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.lol 1
ClamAV (daily): Win.Packed.Mira-7330891-0
Detect It Easy (packer/type): DIE:MinGW
Microsoft Defender: Trojan:Win32/Krap!pz
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Packed.Mira-7330891-0 (rule Win.Packed.Mira-7330891-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (20 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MinGW (rule DIE:MinGW) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.lol 1, MinGW - static signal, weight 0.25, confidence 0.55
Dropped 29 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

5980 behavior events · 1 ATT&CK techniques · 34 dropped files.

Dropped files

C:\swapfile.sys .exe - 49ef163fe2da2daf15bf95f187b6ded69848c8225c3897f57fa9fd0354abf509
C:\DumpStack.log.tmp .exe - d8a9f79b1035befb81970df25b2689111cd3ec597e9d9169965e0715c36e987e
C:\$Recycle.Bin .exe - 4f118947622d9899bca4733409e59f4f98b75470e94f2472ce6a8c1e6dbeeefb
C:\Windows .exe - e633f01cd465cae49ec7ce5cc45eeeda550445cf4e7cc775a21dbd1d46d7df26
C:\Config.Msi .exe - c4d43a375821d227bcf46a357cce740d8c0d452d28e83db51a3b04cbea6ff794
C:\Program Files (x86) .exe - b989d59a7aa4ada85ae09b4d75834d2429d3f55845a7377bad36e20d545001c4
C:\PPLFaultTemp .exe - 4cde40f2afbf92bddf0c51fc283b64b9fb84c103f8b1414ad213116719be7694
C:\PerfLogs .exe - 3b1aa4f2059c17ae913d37d2e684bda011a1fbb3ab417be366397840ab07ee42
C:\Recovery .exe - 262667c24a2e07ad0e1903ad4c58c710a489eb0f7ee56b23182183d4a0024549
C:\uac-done.txt - ad38b76382f56940b22fc920702dbd4bff308a93bf3ad3b0b705686aa4245e9a
C:\ProgramData\wftkqr.exe - ba27b7c61b67ccae03c3439b23fd8d489fcf48579195631a31eabb40ea56c605
C:\uac.ps1 .exe - 55c5e8a5397c4c6917d380888206d7f78b9dc998c9f3a83f8ad59c439b6b79b4
C:\pagefile.sys .exe - 5e0fcac3b28c52b3585afd7017b22531e9ba02d4b5b04fae2dcd519160403821
C:\System Volume Information .exe - 7e0be045fef4c3a5f4b084b41c0f2f31c5f33c80d1342e4aa5afa41c4d03f00d
C:\Program Files .exe - ade6166c721a4ebbc638c58d59ec1a77221882f16e10b21afd353287ce81545d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787695286&P2=404&P3=2&P4=Hh%2btgNRmQOlU4KWn5zYYceNGGh0Glyce4uhLwYw9wLhf4bIQCP0kNprZ6p9MO9%2b9%2f7nsrlqBojvIvJrqFaEWVw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787695382&P2=404&P3=2&P4=e9FpjdBAnY3PIAO4Ifcv4EO5KN1HrpAuKIP%2fxhBxk%2fEnVP1wmMAQ3mxOgaUVl6nsN4fL%2f4p%2f%2fks8FSSxnGWHpg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.123.252.233
20.184.175.11
4.230.171.124
20.42.179.192
52.230.59.222
74.179.77.204
20.165.94.54
51.116.246.105
74.178.240.61
20.236.44.162
40.103.64.242
162.159.142.9
52.123.129.14
52.123.128.14
13.69.116.109
135.233.45.221
203.26.79.13
172.66.2.5
52.148.114.188
52.123.252.227
74.178.232.29
40.84.85.40
13.89.179.12
52.168.117.169
72.153.5.134

More Mira samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report