MALICIOUS — dd2a11ead69720fee43b41251b25fc9322be1d3ec55b22fb6d9ac8ddec456c92

MALICIOUS — dd2a11ead69720fee43b41251b25fc9322be1d3ec55b22fb6d9ac8ddec456c92 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the RedLine family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: dd2a11ead69720fee43b41251b25fc9322be1d3ec55b22fb6d9ac8ddec456c92
SHA-1: fd7d87d143ef05588274d2e16dca3a79f44d36ce
MD5: d48aceb056b839e91bc6d2925d39d2b4
imphash: 83cee2560c241f54105c63fd610ad23f
ssdeep: 3072:pp56zRJ83+OJ7NoGvdwWy6k04yW/KME0jT:pOzRWu27dlOd5W0n
TLSH: T185453B29A123FA17EDD39D9D59805D6C949032DA17384C826B87C0983EF54E3912FECE
Submitted as: dd2a11ead69720fee43b41251b25fc9322be1d3ec55b22fb6d9ac8ddec456c92
File type: pe · Size: 276560 bytes
Verdict: malicious (100/100) · Family: RedLine

Detections (5 of 56 engines)

ClamAV (daily): Win.Malware.Urelas-6717394-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_AntiDebug_Checks
Microsoft Defender: Trojan:Win32/Urelas!atmnm
Kaspersky (KVRT): Backdoor.Win32.Plite.bhvl

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Malware.Urelas-6717394-0 (rule Win.Malware.Urelas-6717394-0) - engine signal, weight 0.90, confidence 0.95
Extracted RedLine config (3 C2) - engine signal, weight 0.80, confidence 0.60
Microsoft Defender flagged Trojan:Win32/Urelas!atmnm (rule Trojan:Win32/Urelas!atmnm) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Backdoor.Win32.Plite.bhvl (rule Backdoor.Win32.Plite.bhvl) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 external host(s) and 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
YARA: Yara-Rules community flagged YR_AntiDebug_Checks (rule YR_AntiDebug_Checks) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: http://www.sysinternals.com, 218.54.47.76, 218.54.47.74 - static signal, weight 0.35, confidence 0.60
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12510 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\biudfw.exe - c5484949621b36df2a52b24dad08ee03c51cf1f638234f86b6500c84da9d93a5
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 3a3cfa6f4786dab0ac8bc76204948f32a3a2cbd094922f87c251ec80d22baae5

Embedded URLs

http://www.microsoft.com/exporting
http://crl.verisign.com/tss-ca.crl0
http://crl.microsoft.com/pki/crl/products/CodeSignPCA2.crl0O
http://www.microsoft.com/technet/sysinternals
http://www.sysinternals.com
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

www.microsoft.com
crl.verisign.com
crl.microsoft.com
www.sysinternals.com

Embedded IP addresses

218.54.47.76
218.54.47.74
218.54.31.226
218.54.47.77
52.168.117.170
20.247.184.142
52.123.252.241
4.230.171.124
172.64.154.167
51.105.71.137
52.110.12.33
52.110.12.53
40.84.97.4
135.233.45.222
48.211.4.16
72.153.5.135
52.148.114.188
52.110.12.18
92.223.78.30
52.110.12.30

File paths

C:\\Documents
E:\Src\AccessEnum\Release\AccessEnum.pdb

More RedLine samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report