MALICIOUS — e66b9c42a98a552f5e4189ed22540f13823fac905f929eda4eb12d552b2bbed3

MALICIOUS — e66b9c42a98a552f5e4189ed22540f13823fac905f929eda4eb12d552b2bbed3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Changeup family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: e66b9c42a98a552f5e4189ed22540f13823fac905f929eda4eb12d552b2bbed3
SHA-1: df62c37edec41c641502bfff48553ae59fe98e80
MD5: 8be30d8eccf579c51b593bc10835d47b
imphash: b806352ebc796e5060cd13bc5e12711d
ssdeep: 1536:sul0cc+BnMOB+dGrNjjmJ2NuKuFr1M5B4QbCcINT:u+BMOB++jOWgT
TLSH: T1FA3B91D40CE8E0A1CE6497878E8569FC058EEDABB222507418C9AA1BD7C21FF507D15F
Submitted as: e66b9c42a98a552f5e4189ed22540f13823fac905f929eda4eb12d552b2bbed3
File type: pe · Size: 102400 bytes
Verdict: malicious (100/100) · Family: Changeup

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Changeup-6169544-0
Microsoft Defender: Worm:Win32/Vobfus.EH
Emsisoft (Emergency Kit): Gen:Variant.Injector.836
Trellix Stinger (McAfee): W32/Autorun.worm.ru
Kaspersky (KVRT): Trojan.Win32.Jorik.Vobfus.ahog

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Changeup-6169544-0 (rule Win.Trojan.Changeup-6169544-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Worm:Win32/Vobfus.EH (rule Worm:Win32/Vobfus.EH) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Injector.836 (rule Gen:Variant.Injector.836) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Autorun.worm.ru (rule W32/Autorun.worm.ru) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Jorik.Vobfus.ahog (rule Trojan.Win32.Jorik.Vobfus.ahog) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

56330 behavior events · 3 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Users\analyst\koeyai.exe - 230649c30d299960cac1161335e97597418db7a68a14d21d7930ffba43fabbcf
5314a631c1fbe3d35e1ed3dfd0b7e22b8d4d0bceffb87f826422e66fe50a2584 - 5314a631c1fbe3d35e1ed3dfd0b7e22b8d4d0bceffb87f826422e66fe50a2584
4d2aba894cc2f40710e7b3a92365daad851a1741a62e5f2a2a70737fe046749c - 4d2aba894cc2f40710e7b3a92365daad851a1741a62e5f2a2a70737fe046749c
6fc51dcc6dae14613d33cfdf2105fc99391bb90dd7db8ccdc29bb8a8e4909ba8 - 6fc51dcc6dae14613d33cfdf2105fc99391bb90dd7db8ccdc29bb8a8e4909ba8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://203.26.79.13/filestreamingservice//files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/6c2dbffa-872a-4f74-b39c-0ab782eea5bf?P1=1787354299&P2=404&P3=2&P4=ElLaAGSqvHE%2fud1oOy9cHTUmePvNSsovOeUG0kb6%2bBU6%2b%2bMYS0cpPMllI2X7kLzG0p4YKwEcdFNAK2Q5UFj2GA%3d%3d&cacheHostOrigin=tlu.dl.delivery.mp.microsoft.com

Embedded domains

ns1.spansearcher.net
ns1.spinsearcher.org
ns1.player1352.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

40.79.141.154
52.123.252.224
4.230.171.124
20.42.179.192
57.155.101.212
4.144.132.114
74.178.240.51
40.74.98.198
74.179.77.204
52.123.252.234
135.234.160.244
48.200.63.27
20.184.175.16
34.104.35.123
20.42.73.24
203.26.79.13
125.56.205.25
125.56.205.123
52.168.117.168
51.104.15.252
172.178.240.162
40.79.150.123
52.148.114.188
13.69.116.109
72.145.35.106

File paths

C:\Program
C:\Windows\system32;C:\Windows\system;

More Changeup samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report