MALICIOUS — dccb7326573aba120cf420544f0b4804e7aa39a9f529dcf716e68fa0e2b3071c

MALICIOUS — dccb7326573aba120cf420544f0b4804e7aa39a9f529dcf716e68fa0e2b3071c is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Kryptik family. 8 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: dccb7326573aba120cf420544f0b4804e7aa39a9f529dcf716e68fa0e2b3071c
SHA-1: c70571a08529981d6532ec8cd286cd1e3ddf5007
MD5: d82649f640dad0e67bed4af8eb8d1580
imphash: a5491ddab3ab64c1c40fad74c1ea58b8
ssdeep: 24576:dgdhhQGGnnazLpj4VHogiuGPYEZmwDXwcI2O8EPL/+S3CljwJouY:dqgazxcGP4wDA58ET/+Nw2
TLSH: T19155F1661F3F3613E626C6B4F602BE5E88B7E429C33BFC0CD0A6741E929449B652051D
Submitted as: dccb7326573aba120cf420544f0b4804e7aa39a9f529dcf716e68fa0e2b3071c
File type: pe · Size: 1220737 bytes
Verdict: malicious (98/100) · Family: Kryptik

Detections (8 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Malware.Ulise-9786791-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_VMProtect
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Wacatac.B!ml
Emsisoft (Emergency Kit): Gen:Variant.Genie.59
Kaspersky (KVRT): HEUR:Trojan.Win32.Kryptik.gen

MITRE ATT&CK

T1105

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Malware.Ulise-9786791-0 (rule Win.Malware.Ulise-9786791-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 22 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_VMProtect (rule YR_Packer_VMProtect) - engine signal, weight 0.35, confidence 0.70
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: Themida/VMProtect, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

94 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Program Files (x86)\xgskp\hw.exe - ab64a26ffe95c74f14a60757ac9814a9135f715f94a5260b91d40ab8aa91cdd0

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787806557&P2=404&P3=2&P4=RRf3X2XXi3Fdp4mMkGfIEIDBc2iLjWM08k%2fG6BtaPScb1m%2fNTYMtme%2fj4MPmGWSF%2bA9xLmZRvT%2brSWFpNgFWgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

t.ml

Embedded IP addresses

20.184.175.16
40.84.85.40
4.230.171.124
20.247.185.124
135.232.92.137
52.168.112.67
74.178.76.54
20.165.94.63
104.46.162.230
20.112.250.133
40.99.133.242
52.123.129.14
52.123.128.14
203.26.79.13
172.178.240.163
52.148.114.188
74.178.232.29
125.56.205.65
52.110.12.26
72.154.7.103
125.56.205.105
52.110.12.44

File paths

C:\=hC

More Kryptik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report