MALICIOUS — ff1734feb2b71440de88a41328a150db1630b12ecaa5188660415e5dbd709fab

MALICIOUS — ff1734feb2b71440de88a41328a150db1630b12ecaa5188660415e5dbd709fab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (87/100), attributed to the 1E7692E0 family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: ff1734feb2b71440de88a41328a150db1630b12ecaa5188660415e5dbd709fab
SHA-1: d713cb8942e015b2eef18c0295149d7b3b1bf068
MD5: 5e4cb53058ce16e7be527e33a81e7555
imphash: 4358264ad4bfd669dcc242586abde130
ssdeep: 1536:GcR8u801YlkWWwwEKif0GFWNEQMe6SlO:V80akWYuf/O7Me6SlO
TLSH: T191364B2F7A1F1743EF36C32608017B6E0122B8BA24B6808D176B943DB3E7C93569556D
Submitted as: ff1734feb2b71440de88a41328a150db1630b12ecaa5188660415e5dbd709fab
File type: pe · Size: 69632 bytes
Verdict: malicious (87/100) · Family: 1E7692E0

Detections (5 of 55 engines)

YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Stratosphere IPS: STRATO_Malicious_UserAgent
Microsoft Defender: Backdoor:Win32/Misdat.A!dha
Emsisoft (Emergency Kit): Generic.Malware.SFYdg.1E7692E0
Kaspersky (KVRT): UDS:Trojan.Win32.Generic

MITRE ATT&CK

Why this verdict

The malicious score of 87/100 is the fusion of 8 weighted signals:

Memory forensics: 3 finding(s), e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.55, confidence 0.85
Contacted 23 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
YARA: Stratosphere IPS flagged STRATO_Malicious_UserAgent (rule STRATO_Malicious_UserAgent) - engine signal, weight 0.35, confidence 0.70
persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
communicate over HTTP (rule communicate over HTTP) - capa signal, weight 0.30, confidence 0.60
enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

13593 behavior events · 1 ATT&CK techniques · 2 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\63875.tmp - ac0ada555100af77a99688246ead3043a2ca54f1577961510cc838217a4cab0e
C:\Users\analyst\AppData\Local\63796.tmp - 8e30b0337b08d411f459563c41baac733082608f5095e6798b418261d8bb580e

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787790035&P2=404&P3=2&P4=G04iUG5KBp%2f697dtLDAFpDbRux0ekJBB4QwbIx2v1tMCAj3Yxb2%2f9VRZrbU6f6Gkr%2fIl76JJ7CispLYBhQ8dOQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787790103&P2=404&P3=2&P4=jFndF2TMgmcVRiy%2f4Ffyrb8xmNb10FeEWNph%2bRwj7cZFCvavmczAAi86BwqOoGRC1HiUzutu3pbwjPXDcfOVJQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

pic.elecarrow.com

Embedded IP addresses

20.52.64.200
52.123.252.245
52.253.84.76
4.247.188.233
4.230.171.124
74.178.232.29
135.232.92.137
20.184.175.13
135.233.95.135
20.165.94.63
203.26.79.13
20.76.201.171
52.123.129.14
52.123.128.14
40.99.134.18
40.99.133.242
20.184.175.21
135.233.45.222
52.148.114.188
72.145.35.107
92.223.78.30
52.110.12.22
52.110.12.18

More 1E7692E0 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report