MALICIOUS — fd2479e51259747153a3ce46264e0f3f3fac1d6eadcc0efb915ba5f35ccc5b18.exe

MALICIOUS — fd2479e51259747153a3ce46264e0f3f3fac1d6eadcc0efb915ba5f35ccc5b18.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Sabsik family. 6 of 52 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: fd2479e51259747153a3ce46264e0f3f3fac1d6eadcc0efb915ba5f35ccc5b18
SHA-1: 802f55bbb5a7039babe432b2d784dcc699fa7a13
MD5: 7da1c529f1cde0f28f08d5e90a64f19c
imphash: 75c721f1755f04cc47f7598bb55e4e6f
ssdeep: 393216:Yq5VDBCDxXQEZq5VDBCDxOq5VDBCDxdq5VDBCDxq:YpCEZp4pjpQ
TLSH: T1986D12CE5702E320EAF0E920786449DD7053B09861BD2CDC0B83E57922E59BFB57625B
Submitted as: fd2479e51259747153a3ce46264e0f3f3fac1d6eadcc0efb915ba5f35ccc5b18.exe
File type: pe · Size: 12807224 bytes
Verdict: malicious (97/100) · Family: Sabsik

Detections (6 of 52 engines)

YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
capa (capabilities): capability:execution/powershell
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Trellix/McAfee ATR: ATR_LockBit_Ransomware
Microsoft Defender: Trojan:Win32/Sabsik.EN.A!ml
Kaspersky (KVRT): not-a-virus:HEUR:RemoteAdmin.Win32.ConnectWise.gen

MITRE ATT&CK

YARA

Suspicious_PowerShell_Download_Exec

Why this verdict

The malicious score of 97/100 is the fusion of 10 weighted signals:

Encoded/hidden PowerShell download-and-exec (rule Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Sabsik.EN.A!ml (rule Trojan:Win32/Sabsik.EN.A!ml) - engine signal, weight 0.55, confidence 0.85
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 60 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Trellix/McAfee ATR flagged ATR_LockBit_Ransomware (rule ATR_LockBit_Ransomware) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://feedback.screenconnect.com/Feedback.axd, https://check.screenconnect.com/InstallerOriginInfo.axd, 1.101.3.4 - static signal, weight 0.35, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

883 behavior events · 1 ATT&CK techniques · 8 dropped files.

Dropped files

19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc - 19ac323ca6eae2f8145cdc2bac865b32cd5a48ad6ff199d4ca7da214b056e1dc
e2dbaea60c2d41852c6f7592e20395f5f74410b7e2cf4699a59bbbc74d21ff9c - e2dbaea60c2d41852c6f7592e20395f5f74410b7e2cf4699a59bbbc74d21ff9c
d329c9bf28af0937d6732222a8e933fde9e626e8d781c768a180320139902b8a - d329c9bf28af0937d6732222a8e933fde9e626e8d781c768a180320139902b8a
7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7 - 7c27380976a5befc5a947e129eb464123f46d06cf0eb7f984ced921f36e1d0e7
7b12bd5aca85b5f4c8d9d1c58737d86220b00ba9f1c3cc881d9caeeeb4ddbd25 - 7b12bd5aca85b5f4c8d9d1c58737d86220b00ba9f1c3cc881d9caeeeb4ddbd25
ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454 - ae3005e1ca932eccde09c479fde2ecf8ea2feeb908dec4f0c830eab671276454
15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390 - 15fec18d3a8990cdb540897ede61227353165668048c001164fcd22233cc8390
27f9b97b61e29d343e65399c24667ce31dc37436f926c45508ef9c4977e1593c - 27f9b97b61e29d343e65399c24667ce31dc37436f926c45508ef9c4977e1593c

Embedded URLs

http://www.digicert.com/CPS0
https://feedback.screenconnect.com/Feedback.axd
https://check.screenconnect.com/InstallerOriginInfo.axd
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=msedge.f.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786713920&P2=404&P3=2&P4=E2OS1eyK9w016C1zc2S3lrP3shIJVHo4GSFWPpWJMRVla8NrcEyFLDX%2fTa3Qey4yKuhOMyyAK5Ploh9sywOYiA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

cacerts.digicert.com
crl3.digicert.com
www.digicert.com
crl4.digicert.com
1l.ch
instance-zkxrmm-relay.screenconnect.com
feedback.screenconnect.com
check.screenconnect.com

Embedded IP addresses

1.101.3.4
20.236.44.162
149.154.167.99
52.182.141.63
52.123.252.222
20.42.179.192
172.215.188.232
52.230.59.222
52.110.12.33
4.230.171.124
135.232.92.137
52.168.117.171
20.76.201.171
135.233.45.223
52.110.12.10
57.155.104.224
20.231.239.246
4.150.223.97
135.234.160.245
74.178.240.51
149.154.164.25
149.154.165.137
57.155.101.212
203.26.79.13
172.66.2.5

File paths

C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\Release\DotNetRunner.pdb
C:\builds\cc\cwcontrol\Product\Core\obj\Release\net20\ScreenConnect.Core.pdb
X:\:b:f:l:p:
X:\:`:d:h:l:p:t:x:
T:\:d:l:t:
T:\:d:
C:\builds\cc\cwcontrol\Product\Windows\obj\Release\net20\ScreenConnect.Windows.pdb
C:\builds\cc\cwcontrol\Product\WindowsInstaller\obj\Release\net20\ScreenConnect.WindowsInstaller.pdb
C:\builds\cc\cwcontrol\Product\ClientInstallerRunner\obj\Release\ScreenConnect.ClientInstallerRunner.pdb
C:\Users\jmorgan\Source\cwcontrol\Custom\DotNetRunner\DotNetResolver\obj\Debug\DotNetResolver.pdb
V:\L1
E:\delivery\Dev\wix37_public\build\ship\x86\SfxCA.pdb
X:\:`:d:h:x:
C:\build\work\eca3d12b\wix3\build\ship\x86\wixca.pdb
X:\:
Q:\:a:f:

More Sabsik samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report