MALICIOUS — f03b639f002fd8b17ae6ae39f48a4340b019ffe2f7ee9edd50ba9db258c356a4

MALICIOUS — f03b639f002fd8b17ae6ae39f48a4340b019ffe2f7ee9edd50ba9db258c356a4 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Urelas family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f03b639f002fd8b17ae6ae39f48a4340b019ffe2f7ee9edd50ba9db258c356a4
SHA-1: 4fbb87a69555ae14bc6c7f6abbe7ca0e1a85cd22
MD5: d23e80ca50e13fb48ca118f48cb51f4a
imphash: e77246b3d14bf4cc4fcd12f0ba31740f
ssdeep: 6144:PEK25f5ySIcWLsxIIW4DYM6SB6v+qLnAzYmhwrxcvkzmSOpo/:PMpASIcWYx2U6hAJQnT
TLSH: T1FA4ACE69C2F2A789EBF797302E509E0D20E25CDDD0BF4D984383C15D62E299BD1D112A
Submitted as: f03b639f002fd8b17ae6ae39f48a4340b019ffe2f7ee9edd50ba9db258c356a4
File type: pe · Size: 459275 bytes
Verdict: malicious (100/100) · Family: Urelas

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Urelas-9635181-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Urelas!pz
Trellix Stinger (McAfee): Corrupt-FY!D23E80CA50E1
Kaspersky (KVRT): HEUR:Backdoor.Win32.Plite.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Urelas-9635181-0 (rule Win.Trojan.Urelas-9635181-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Urelas!pz (rule Trojan:Win32/Urelas!pz) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Corrupt-FY!D23E80CA50E1 (rule Corrupt-FY!D23E80CA50E1) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Plite.gen (rule HEUR:Backdoor.Win32.Plite.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Contacted 5 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Embedded network infrastructure: 1.234.83.146, 133.242.129.155, 218.54.31.226 - static signal, weight 0.35, confidence 0.60
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (3 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

30325 behavior events · 1 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 6d0ee9c0f863ec73edea5cf259b7920e3fc9bbb8d173f95308331384ae329a48
C:\Users\analyst\AppData\Local\Temp\ydevc.exe - 91c3aa42b1fc23d9d196d8b9e97d5e39aa2f567dbf829031963f77dd35b0bc47
C:\Users\analyst\AppData\Local\Temp\jimur.exe - 2974a8a79770e9d4eec822f8dfd9d20f2c4c8662090ce796c5cc503d8052c222
C:\Users\analyst\AppData\Local\Temp\jycyne.exe - 83549205af005d1dc8f34fa4f57ca78eb3a7b1beefbb8cca735cb3272de57bb1
C:\Users\analyst\AppData\Local\Temp\ydevc.exe - 3ad08729b4a66fdb3e3d429d7835cd12189beca18e5e455103e1158df6b8da8f
37fff5b527b0cd8902754e74f03aa71f7eea2078952688b12e45b042dc64a756 - 37fff5b527b0cd8902754e74f03aa71f7eea2078952688b12e45b042dc64a756

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/89c77c08-6078-44b6-8f27-85720154df65/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/89c77c08-6078-44b6-8f27-85720154df65?P1=1788325577&P2=404&P3=2&P4=QStM3iE4h1VBLfGzFDxV39mhnBS%2fpSE222M4BtUSKXgJ%2b%2fKzKyUUF9O2wY2XiA7FBNHe%2f63fuaGe4%2b7yOrLodA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

aefd.nelreports.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

1.234.83.146
133.242.129.155
218.54.31.226
218.54.31.165
52.168.117.168
52.123.252.247
4.230.171.124
85.210.193.152
20.247.184.142
40.84.97.4
4.207.44.66
74.178.240.51
172.64.154.167
74.179.77.204
135.232.92.137
203.26.79.13
52.168.117.171
52.168.117.175
135.233.95.80
72.145.35.98
52.148.114.188
52.110.12.49

More Urelas samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report