SUSPICIOUS — f2af712080b24187de39f17185873affcd50a66c580a036fdc5338084c4b0cbd

SUSPICIOUS — f2af712080b24187de39f17185873affcd50a66c580a036fdc5338084c4b0cbd is a pe sample analyzed by MalwareAnalyzer by Cyble with a suspicious verdict (68/100), attributed to the Hematite family. 2 of 55 detection engines flagged it, exhibiting 1 ATT&CK technique.

Identification

SHA-256: f2af712080b24187de39f17185873affcd50a66c580a036fdc5338084c4b0cbd
SHA-1: 0998041ddbbe779768806caa7937a6db58896426
MD5: f6569df3b1ab41e7fdb28bb1d43d7a0c
imphash: 2ba629f434c3ca1b21fe81af6412d628
ssdeep: 96:ZSdr9d9VQk4YqmOm+t/ptS5yxO9OYqmOm+t/p:e5QlmTMpVxOwmTMp
TLSH: T12A1B23AA967435D8CA81F7B1B203984DE10254F3B7778F646D12948171247BFF822629
Submitted as: f2af712080b24187de39f17185873affcd50a66c580a036fdc5338084c4b0cbd
File type: pe · Size: 5120 bytes
Verdict: suspicious (68/100) · Family: Hematite

Detections (2 of 55 engines)

Microsoft Defender: Trojan:Win32/Hematite.DHA!MTB
Kaspersky (KVRT): UDS:Trojan.Win32.Generic

MITRE ATT&CK

T1105

Why this verdict

The suspicious score of 68/100 is the fusion of 3 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 29 external host(s) at runtime (27 HTTP) - network signal, weight 0.40, confidence 0.80
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60

Dynamic analysis (windows)

22 behavior events · 0 ATT&CK techniques · 1 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\_bxdrrvtt.exe - f2bc456914d31852af7421b7579eaf4006dcf0f402b8d3ad823c0dec6e759132

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/fa5c4269-9d03-4a47-8d97-be6931f0b22c/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/fa5c4269-9d03-4a47-8d97-be6931f0b22c?P1=1787921475&P2=404&P3=2&P4=CQf2Cdxcs%2fbHvn0ohB%2bhMxgT4c7ZLSw9%2bxS8%2b4aaiGhc8cXtTB7C%2bptA%2fOXOuRW6K6eO%2bVgsFH7VluJSY3JyEg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787921503&P2=404&P3=2&P4=iRWrIU7xh1op2voELVjf0QDmPXtpmTzjWdtXIZCdkPXJXS2QXMotprPSPRl7ICgrWGwkeP%2fnGj29e1Ynrm%2bYzg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9c0462dd-f6cd-4ff7-a7ac-708d0e9dadc5?P1=1787318241&P2=404&P3=2&P4=EOZlx4%2bVZMYGJFUcj6nQW1vLsyRPk1dBcYTqh3Pa2jj4rUttwd6DeYjMzUnq9nQMN4mLDvVYaurGkCaF1vZXQg%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/b56480f9-8215-4de7-ba7e-8e690088d21d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/b56480f9-8215-4de7-ba7e-8e690088d21d?P1=1787317805&P2=404&P3=2&P4=LQkyKjNzmNv9JSn%2fJdi42VFRWHu831SRQzpHpHzqAnQxUGJVrKLMFsH0Zm9ekz4wFTLedvPKB3yoDUQW14iS9w%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

20.42.73.28
52.123.252.222
4.247.188.224
4.230.171.124
20.247.184.197
135.232.92.137
135.233.95.135
20.184.175.17
40.99.133.226
20.236.44.162
40.99.134.18
52.123.129.14
52.123.128.14
172.66.2.5
52.123.252.244
135.233.45.222
203.26.79.13
52.123.252.193
20.165.94.46
52.123.252.194
52.123.252.195
52.148.114.188
172.170.180.133
40.74.98.198
72.145.35.107

More Hematite samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report