MALICIOUS — f7226e294a76e1b6d69b7b11fed5344ef4fe3add8f587509d75f807a2afb4886

MALICIOUS — f7226e294a76e1b6d69b7b11fed5344ef4fe3add8f587509d75f807a2afb4886 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Xanfpezes family. 7 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: f7226e294a76e1b6d69b7b11fed5344ef4fe3add8f587509d75f807a2afb4886
SHA-1: 08a46cc3d37d211348bdb0c1747b38ea4f8b71e2
MD5: d7f4c44053fd74aaa03c0f9d2a3c4cb4
imphash: ff717ad06b5f3993c89b876c7cafd5e3
ssdeep: 98304:EcKeMCMnyniCMVnzVhzIhzHCMVnzVhzIhz5VnzVhzhIhzHCMVizKkzVhzhIhzHCv:En
TLSH: T1666E121D637AD8C8DBEED63690A11EAFAF811A14C62E0D34106641357F9B433846B27F
Submitted as: f7226e294a76e1b6d69b7b11fed5344ef4fe3add8f587509d75f807a2afb4886
File type: pe · Size: 13798865 bytes
Verdict: malicious (100/100) · Family: Xanfpezes

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:,,,
ClamAV (daily): Win.Trojan.Xanfpezes-9862383-0
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Delf.OKM!MTB
Emsisoft (Emergency Kit): Gen:Variant.Zusy.466969
Kaspersky (KVRT): HEUR:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

ClamAV (daily) flagged Win.Trojan.Xanfpezes-9862383-0 (rule Win.Trojan.Xanfpezes-9862383-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in qksb.exe (pid 2308) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Delf.OKM!MTB (rule Trojan:Win32/Delf.OKM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Zusy.466969 (rule Gen:Variant.Zusy.466969) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Generic (rule HEUR:Trojan.Win32.Generic) - engine signal, weight 0.55, confidence 0.85
Contacted 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:,,, (rule high-entropy-sections:,,,) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Packing/obfuscation: high-entropy-sections:,,,, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

19175 behavior events · 1 ATT&CK techniques · 22 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\qksb.exe - 152c859fb78b567c4cba1ca6e32faa2b2d8411b18a695784b9ae81bb13bf05d7
C:\Users\analyst\AppData\Local\Microsoft\Internet Explorer\MSIMGSIZ.DAT - b1313dd95eaf63f33f86f72f09e2ecd700d11159a8693210c37470fcb84038f7
C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\background1[1] - 94da744fcfe0b551d52825a0236caf3b22cedb850f71194e047303efca088d08
693a03aa380a91a8ba160c6d22db6398d75281b8a5ef5b52616b220c63377b41 - 693a03aa380a91a8ba160c6d22db6398d75281b8a5ef5b52616b220c63377b41
c4a256c6b1cc6ab98d0c472020418a9b90a8f5cb686973d64c41e23830b826d3 - c4a256c6b1cc6ab98d0c472020418a9b90a8f5cb686973d64c41e23830b826d3
5701cc21c8fea5227c2417b8a2461ad04eb818df9ccbc3bed131a71c36c8bb06 - 5701cc21c8fea5227c2417b8a2461ad04eb818df9ccbc3bed131a71c36c8bb06
d0499e9c7f52f6afd87c14ee1d6437efb98dcaef86aed7e53baa8ee0b75dffcd - d0499e9c7f52f6afd87c14ee1d6437efb98dcaef86aed7e53baa8ee0b75dffcd
9a06a702480fd97f853d19e9e475481773406a81f0f0b325d5c3b73536a2d81f - 9a06a702480fd97f853d19e9e475481773406a81f0f0b325d5c3b73536a2d81f
b16e7d15b62c8b694d7ba8b4503f74c56cc57cd12218afe4a7c28099aa578fe5 - b16e7d15b62c8b694d7ba8b4503f74c56cc57cd12218afe4a7c28099aa578fe5
d226bd91df5ab841ff1f3c0d88ac23fb0597ddf3891a01db6f6b6ebe15025cf9 - d226bd91df5ab841ff1f3c0d88ac23fb0597ddf3891a01db6f6b6ebe15025cf9
45c686c4e5fda6438f8a9ccdb53bc81832ea0aa5c605b12cc19df7c5fb1fdd60 - 45c686c4e5fda6438f8a9ccdb53bc81832ea0aa5c605b12cc19df7c5fb1fdd60
bf797b82376d1009771287241dc6a190467785cae1d288d679053114f3e648cf - bf797b82376d1009771287241dc6a190467785cae1d288d679053114f3e648cf
5116178dd7adbea714e63f00693afd43cd608944b0cf4a4c4973603595e4c9aa - 5116178dd7adbea714e63f00693afd43cd608944b0cf4a4c4973603595e4c9aa
c8d94de3e05323e6d97e3d2ea8c61cac334fcde0014a88db597712abaf55fe95 - c8d94de3e05323e6d97e3d2ea8c61cac334fcde0014a88db597712abaf55fe95
3231f7c6a6e08a51d98e089afa3182a938069233379606032759db6e125a5ffb - 3231f7c6a6e08a51d98e089afa3182a938069233379606032759db6e125a5ffb

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.150.223.108
4.144.132.223
52.123.252.223
4.230.171.124
4.247.188.224
52.110.12.16
52.182.141.63
20.184.175.1
52.110.12.33
72.154.7.106
52.148.114.188

More Xanfpezes samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report