MALICIOUS — fe388d14d0498a5a3250ec569e02a3ba4ca9dbaccbf6d9a3c4190187650fbff8

MALICIOUS — fe388d14d0498a5a3250ec569e02a3ba4ca9dbaccbf6d9a3c4190187650fbff8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the PWSZbot family. 7 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: fe388d14d0498a5a3250ec569e02a3ba4ca9dbaccbf6d9a3c4190187650fbff8
SHA-1: 322d308d09904fdb61e7e784e824ec51a16392d1
MD5: fa051f5bab66b625a5bcd00462d3d0d7
imphash: 812f4ca969807d6b225076a40b7e2874
ssdeep: 768:qS7nh4aQC9xIp/tdgI2MyzNORQtOflIwoHNV2XBFV72B4lA7ZsUI+FBcuX:qS7nK8KptdgI2MyzNORQtOflIwoHNV2Q
TLSH: T16D2FB3A81E371303E66E10EA9425890D55FE61F069CC6E4A4B038DEAD7D04973CE4DBB
Submitted as: fe388d14d0498a5a3250ec569e02a3ba4ca9dbaccbf6d9a3c4190187650fbff8
File type: pe · Size: 32928 bytes
Verdict: malicious (100/100) · Family: PWSZbot

Detections (7 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): MPRESS
ClamAV (daily): Win.Downloader.Upatre-5744087-0
Detect It Easy (packer/type): DIE:MPRESS
Microsoft Defender: Trojan:Win32/Downloader!pz
Emsisoft (Emergency Kit): Trojan.Downloader.JQBF
Trellix Stinger (McAfee): PWSZbot-FFA!FA051F5BAB66
Kaspersky (KVRT): Trojan.Win32.Bublik.beuk

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Downloader.Upatre-5744087-0 (rule Win.Downloader.Upatre-5744087-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. process hollowing in ffengh.exe (pid 1508) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Downloader!pz (rule Trojan:Win32/Downloader!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Downloader.JQBF (rule Trojan.Downloader.JQBF) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged PWSZbot-FFA!FA051F5BAB66 (rule PWSZbot-FFA!FA051F5BAB66) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan.Win32.Bublik.beuk (rule Trojan.Win32.Bublik.beuk) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:MPRESS (rule DIE:MPRESS) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged MPRESS (rule MPRESS) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: MPRESS - static signal, weight 0.25, confidence 0.55
Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

42285 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\ffengh.exe - 8963f278154d8ca962ab4cd6d789b59050a273ab57ee48e88b9349f485c7e83d
40b698ad703c9adf18bc03b0e7cc805bf7c0b8f3cde12b706257d7dcc5c68a19 - 40b698ad703c9adf18bc03b0e7cc805bf7c0b8f3cde12b706257d7dcc5c68a19
411c87116f5cbc12478321ec3f00672e823df03486ef21933bdb39bcee6354ec - 411c87116f5cbc12478321ec3f00672e823df03486ef21933bdb39bcee6354ec
9242b0a0d68ca48146c8b7dc939aa52481de22cb864fe384618445f00a7ee14b - 9242b0a0d68ca48146c8b7dc939aa52481de22cb864fe384618445f00a7ee14b
75980e9bc28d16bbee9609ca9b77e18252015bd539485f754e6fe24f7dcc3f9c - 75980e9bc28d16bbee9609ca9b77e18252015bd539485f754e6fe24f7dcc3f9c
0edc42009dfb27f0adfe54768c27a8806f4db8908a73aa1520ca14e37d91f9c8 - 0edc42009dfb27f0adfe54768c27a8806f4db8908a73aa1520ca14e37d91f9c8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

drippingstrawberry.com

Embedded IP addresses

52.230.59.222
4.150.223.100
52.123.252.242
4.230.171.124
172.64.154.167
135.233.45.222
52.110.12.20
52.110.12.10
52.148.114.188
72.145.35.99

File paths

C:\hqXlSFLw.exe
C:\vwg5uISa.exe
C:\01uBrAQr.exe
C:\Users\WI2yhmtI
C:\Users\Frank\Desktop\IWjMVbQS.exe
C:\Users\admin\Downloads\9ed34a84ee86428230287ea44f06ac88974098bc2eb650207c930ab2a433d6c7.exe
C:\Users\Frank\Desktop\OwzRKbJx.exe
C:\Users\admin\Downloads\3b74ad868b8341b2ae5b18592db450131e129fffff2a0fa5a9fe46ea9742f817.exe
C:\980d89b74318811ff6ac60b7e9c4a76ab96a187a88c98879c629bce153245c32
C:\8b74c4e3183ec49d6ccd0515d30704f1a48889f6f9092bf726e151b2bd2d3ec0
C:\Users\george\Desktop\ffengh.exe
C:\Users\admin\Downloads\ffengh.exe
C:\bIkvOJ0i.exe
C:\Users\Frank\Desktop\udGPwUcB.exe
C:\Users\admin\Downloads\bf4843579b2b8641c20f0950e99060b814478a4a04dd1ae1a5e1171432fe31ea.exe
C:\Users\admin\Downloads\ef801d527703efed1b452cf13b3747536d733839d70d1f0e0dc1418e9c575aa9.exe
C:\55c3000f124d75093c4706e7beb33b392a0bf33740c0c9d2a09d2072bf12e8dc
C:\Users\r.vult\AppData\Local\Temp\909d149bd742f37bbbfc7f26be723a79.exe
C:\1b64ff0883999dfca94b944d86f33022d3660d2b18e706ace48ac8659e3a7903
C:\Users\Lisa\Desktop\HgxodDeI.exe
C:\2c23d7cd9498dd09d62c953966cc6d4dc055eabcee31eb1c20a4529dc3ef7a30

More PWSZbot samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report