MALICIOUS — fb302cfd8f26b5e96cbfba5fc44057148d3f729c647f6ddc68095e4d10008612

MALICIOUS — fb302cfd8f26b5e96cbfba5fc44057148d3f729c647f6ddc68095e4d10008612 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: fb302cfd8f26b5e96cbfba5fc44057148d3f729c647f6ddc68095e4d10008612
SHA-1: 49d7f623bec15f1cc7be5cfb9a3f1bc384625076
MD5: ea1cfc87d3e574aca634c9ad63c225e4
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 3072:CfTiD8m6jEEUFGfcRhH+KVvyJr5RKg0rr57A1Wu0ZS+BmhSASTLrz+hSXjwOwkmd:C7iD8dz0GcW5RKgKV7AOM+BmhKrKhS8n
TLSH: T1F4412951C5C4EAE3DACC22A6A435CACC4D9491BF25047F2F18E2A3F5448C7436DE25EA
Submitted as: fb302cfd8f26b5e96cbfba5fc44057148d3f729c647f6ddc68095e4d10008612
File type: pe · Size: 193024 bytes
Verdict: malicious (100/100)

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.4 (rule Win32.Virlock.Gen.4) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 17 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

18181 behavior events · 3 ATT&CK techniques · 43 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tsk_fae16e8976df41c0 - c4af48aac8cab4c192b0ac01d3cb6947c611276f0ff683bb3169bed51f994f4c
bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\ProgramData\xiocAsMc\yKgEskQE - 7c1cff7faabc6ee700defd3b41a36b553b08d0c2597c03de0c129b6845ebe3d3
C:\Users\analyst\rSwIoccE\vcIYEIkQ - d69d01f3e7b9573d0094952221244a58f1def6218b0ab96f6a147091773b6b9e
C:\Users\analyst\AppData\Local\Temp\wYIUcksE.bat - dc40b5c4bfa8af748d804c33af9dc05d8b7194cdba39ee3042ab733e635ec801
C:\Users\analyst\AppData\Local\Temp\JCscMMIQ.bat - ff0edb3949a0ab815cbe4cd540dacc21b76415dcc192b75f75da8321c02e62ae
C:\Users\analyst\AppData\Local\Temp\sUcoEswI.bat - a35e786fd883fbbb48daa21f2cc6ca36e1bb54254583d2e04bdf43723077ab06
C:\Users\analyst\rSwIoccE\vcIYEIkQ.exe - 38d8a61ed5e54497fdd8c39341245579ebe57bcc53960bdad9bf6103fdfc398d
C:\Users\analyst\AppData\Local\Temp\UYssgcgk.bat - 34184e56da5df2887ccb83e451e1d08a8ae0a875cec278fecbd0945b9ce223bf
C:\Users\analyst\AppData\Local\Temp\QOUIsUwE.bat - b2c748dd832b2938ad8b0009199d42e97938507d0e23f7c17bca9de40bdd01ed
C:\Users\analyst\AppData\Local\Temp\gIgQcIEs.bat - 3684ad44c5938a57e7f629ec9ca3746e0d972ce71b107b75d418fb5db82338c6
C:\Users\analyst\AppData\Local\Temp\GQcK.ico - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
C:\Users\analyst\rSwIoccE\vcIYEIkQ.inf - 97161aef0155a1f2d50d08c38d50f679e575d15b553f787de699f2170a23b0fe
C:\ProgramData\xiocAsMc\yKgEskQE.inf - efe8c4b84b56dc82f6a1958e6c30828c574f9d5004e5e426efbd43db9c42c988
C:\ProgramData\Microsoft\Device Stage\Device\{8702d817-5aad-4674-9ef3-4d3decd87120}\background.png - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/

Embedded IP addresses

51.116.246.105
52.123.252.242
4.230.171.124
20.42.179.204
74.178.240.51
104.46.162.230
104.18.33.89
4.144.132.223
74.179.77.204
200.87.164.69
200.119.204.12
190.186.45.170
52.148.114.188
52.110.12.52
72.145.35.110
52.110.12.16
52.110.12.56

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report