MALICIOUS — dd06f309e1a4e51f8bb39df420cf9d26ed971b374a014d801b055b5ae7b52b8d
MALICIOUS — dd06f309e1a4e51f8bb39df420cf9d26ed971b374a014d801b055b5ae7b52b8d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Urelas family. 4 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
dd06f309e1a4e51f8bb39df420cf9d26ed971b374a014d801b055b5ae7b52b8d - SHA-1:
18020b9d7c4181c167487a2e3b49f5a8426f90a6 - MD5:
9092053cd95ceb70869dc33be64f0b00 - imphash:
1c26db1d7cc549e6a7fc7308a866b93d - ssdeep:
1536:GRwT8ukP5sZK20EGIBpwW6NeleEQ77nuUWXJmU2AjpZWoI23A4ty:APuk8QsH47nW5ppsoI23A4 - TLSH:
T12740288CC5F2A7C9EBF793201E144E0D68E16CDCD17E5D480A83E02D67E2A67D6E105A - Submitted as: dd06f309e1a4e51f8bb39df420cf9d26ed971b374a014d801b055b5ae7b52b8d
- File type: pe · Size: 166554 bytes
- Verdict: malicious (97/100) · Family: Urelas
Detections (4 of 55 engines)
- ClamAV (daily): Win.Malware.Urelas-6717394-0
- Microsoft Defender: Trojan:Win32/Urelas!pz
- Trellix Stinger (McAfee): PWS-FDJS!9092053CD95C
- Kaspersky (KVRT): Trojan-Ransom.Win32.GenericCryptor.czo
MITRE ATT&CK
Why this verdict
The malicious score of 97/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Malware.Urelas-6717394-0 (rule
Win.Malware.Urelas-6717394-0) - engine signal, weight 0.90, confidence 0.95 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 29 external host(s) at runtime (21 HTTP) - network signal, weight 0.40, confidence 0.80
- Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
- Embedded network infrastructure: 112.175.88.209, 112.175.88.208, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
- Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
12550 behavior events · 2 ATT&CK techniques · 2 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
Dropped files
- C:\Users\analyst\AppData\Local\Temp\golfinfo.ini -
fe485dd700b9b8c95e9de719dc1eb9ecf25b8f554fc23a3baa679ff12aa173b5 - C:\Users\analyst\AppData\Local\Temp\huter.exe -
cbc427a1911fe1e89157f7070a3a23add541349499f0dc83622b59f0f18d92f1
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787843200&P2=404&P3=2&P4=KXVYeSZhbE0OEQ9DjCE4LX3UZlrVJyniUJaAUpYcvgEVbzE%2fmpz5MjwiXgEBLWmY0s0CzqX%2fLQMkL0W7fwGsrw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787843287&P2=404&P3=2&P4=BNXVV7CVrAv7mwmWIg7PCcuf9ijK1B%2fnBHU1P%2fatQMo83iJwwGmy1n67wn9iXlsvfSy4NMlsNjc2m5YjDoMa3g%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 112.175.88.209
- 112.175.88.208
- 218.54.31.226
- 112.175.88.207
- 4.150.223.99
- 52.123.252.243
- 40.84.97.4
- 4.230.171.124
- 52.253.84.76
- 20.247.184.197
- 74.178.76.128
- 20.165.94.54
- 20.42.65.94
- 20.231.239.246
- 52.123.129.14
- 52.123.128.14
- 4.207.44.76
- 135.233.45.222
- 135.233.45.221
- 20.42.179.204
- 203.26.79.13
- 52.148.114.188
- 52.123.252.222
- 135.232.92.34
- 52.123.252.234
File paths
- T:\:p:x:
More Urelas samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report