MALICIOUS — fc7a6033b3beae1f70fdebbfaab741bae3b76348d5395f81412f167ab259b61e

MALICIOUS — fc7a6033b3beae1f70fdebbfaab741bae3b76348d5395f81412f167ab259b61e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the Bingoml family. 3 of 25 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: fc7a6033b3beae1f70fdebbfaab741bae3b76348d5395f81412f167ab259b61e
SHA-1: ed53dab6cd1d2c2934ef134caa199ed2930092c9
MD5: 56beb10250091ee35c6a42783cdd061a
imphash: 95122753ea27818b35f9b51859e4c692
ssdeep: 49152:Qoa1taC070dCYfseoWSM956DbCkU+Xtd:Qoa1taC0oEL8eP7DXj
TLSH: T1915A234656496F0CE2F6C4843D6D266EC042E8E2577C188E428FF19EB3DB95738221DB
Submitted as: fc7a6033b3beae1f70fdebbfaab741bae3b76348d5395f81412f167ab259b61e
File type: pe · Size: 1958400 bytes
Verdict: malicious (87/100) · Family: Bingoml

Detections (3 of 25 engines)

Kaspersky (KVRT): Trojan.Win32.Bingoml.ckfs
Microsoft Defender: Trojan:Win32/Salgorea!pz
Emsisoft (Emergency Kit): Dump:Generic.Dacic.17983.C83B492E

MITRE ATT&CK

Why this verdict

The malicious score of 87/100 is the fusion of 5 weighted signals:

Kaspersky (KVRT) flagged Trojan.Win32.Bingoml.ckfs (rule Trojan.Win32.Bingoml.ckfs) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 33 external host(s) at runtime (14 HTTP) - network signal, weight 0.40, confidence 0.80
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

98 behavior events · 2 ATT&CK techniques · 2 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/9112/files/773a71231bde87c571ee9bad4ce0d7a6492ae2aaeec7317ffaa74d4ef6752a7b - 773a71231bde87c571ee9bad4ce0d7a6492ae2aaeec7317ffaa74d4ef6752a7b
4eac6434bcbdb98c430ff829c96c92b3a4495fe02f4caaf42fa8937bf4143d89 - 4eac6434bcbdb98c430ff829c96c92b3a4495fe02f4caaf42fa8937bf4143d89

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786390815&P2=404&P3=2&P4=a7IeEBaP1gu1h8fehrPCxK1Rdca3MJrMx3nLDMOcku70ZiPnod60muDOdN1up41uXkZN5pga6ePtZW2l1%2f%2fJSw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786390846&P2=404&P3=2&P4=kdM%2betNEzGvsbgPMXMh8gjzPb1fjFDuPMMSlPjIl6tLU0hICreLMLSZXA67FThXiAfk9xHE18nUd4oJJXc1wdA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

s.es
schemas.microsoft.com

Embedded IP addresses

125.56.205.187
4.150.223.109
4.230.171.124
172.215.188.232
4.247.188.224
4.144.132.223
74.178.240.61
125.56.205.178
74.178.240.51
104.208.16.94
74.179.71.159
172.178.240.161
203.26.79.13
52.168.112.67
125.56.205.155
125.56.205.24
125.56.205.17
72.154.7.99
57.155.104.224
52.148.114.188
52.110.12.14
52.110.12.3

File paths

n:\]L#

More Bingoml samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report