MALICIOUS — ed4d7ee70d1c4e25552aae00864c63f702e9d4f5c31d26be494497341a28a7a8

MALICIOUS — ed4d7ee70d1c4e25552aae00864c63f702e9d4f5c31d26be494497341a28a7a8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: ed4d7ee70d1c4e25552aae00864c63f702e9d4f5c31d26be494497341a28a7a8
• SHA-1: 07939dd4ca0cb3609b81527c3bb976e4fa11b869
• MD5: 2d7b0f021caaff802facb94e6eb13aac
• imphash: e64c588944c2ac10400ed12764c26b03
• ssdeep: 1536:nK0GjMeQG3iaQREuVZ6ro29p4YxbKdrP1:K0GAqjuVZ6rNOrP1
• TLSH: T1D03502698006E965E5BEF3043868ED2D7B5E63740CADB5B9EF10526C7238213924932F
• Submitted as: ed4d7ee70d1c4e25552aae00864c63f702e9d4f5c31d26be494497341a28a7a8
• File type: pe · Size: 62623 bytes
• Verdict: malicious (100/100) · Family: Urelas

Detections (6 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:HSUDHUHW
• ClamAV (daily): Win.Trojan.Generic-9909987-0
• Detect It Easy (packer/type): DIE:Packman
• Microsoft Defender: Trojan:Win32/Urelas!pz
• Trellix Stinger (McAfee): Trojan-FEXT!87EE44CB458B
• Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

• ClamAV (daily) flagged Win.Trojan.Generic-9909987-0 (rule Win.Trojan.Generic-9909987-0) - engine signal, weight 0.90, confidence 0.95
• Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
• Trellix Stinger (McAfee) flagged Trojan-FEXT!87EE44CB458B (rule Trojan-FEXT!87EE44CB458B) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 30 external host(s) and 12 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Detect It Easy (packer/type) flagged DIE:Packman (rule DIE:Packman) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:HSUDHUHW (rule high-entropy-sections:HSUDHUHW) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:HSUDHUHW, Packman - static signal, weight 0.25, confidence 0.55
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

20021 behavior events · 2 ATT&CK techniques · 2 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• 76.0.240.10.in-addr.arpa.
• 218.54.47.76 KR · AS9318 IP Manager
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 218.54.47.74 KR · AS9318 IP Manager
• ecs.office.com
• update.googleapis.com
• desktop-hsgcbep
• login.live.com
• self.events.data.microsoft.com
• oneocsp.microsoft.com
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 251.0.0.224.in-addr.arpa
• 1.0.240.10.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

Dropped files

• C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - a945a44cfe50423c01f26a16445ed177a347052e791364a9cb7de6bcaa18f3c1
• C:\Users\analyst\AppData\Local\Temp\biudfw.exe - 87a76bc39b3ced85e9849f28fba39c09e8d65945a9470aad6aeb3eb3edb12f1d

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 218.54.47.76
• 218.54.47.74
• 172.215.188.232
• 52.123.252.230
• 218.54.47.77
• 40.79.167.9
• 72.145.35.103
• 92.223.78.30
• 52.168.117.171
• 52.148.114.188
• 40.74.98.198
• 72.145.35.96
• 72.145.35.105
• 135.233.95.80
• 51.132.193.105
• 52.123.252.233
• 104.208.16.94
• 172.172.255.217
• 51.105.71.137
• 52.123.252.213
• 52.168.117.175
• 72.145.35.97
• 172.172.255.218
• 20.184.175.23
• 85.210.193.152

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report