MALICIOUS — 0fc9ccdc08a25c91a1f0dfaf776a8a273f893232b06511fafcaabfad16bafad7

MALICIOUS — 0fc9ccdc08a25c91a1f0dfaf776a8a273f893232b06511fafcaabfad16bafad7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 0fc9ccdc08a25c91a1f0dfaf776a8a273f893232b06511fafcaabfad16bafad7
SHA-1: 1e406dd93a78141dcc61958f9aa806af464c50a7
MD5: 314379fa80f9eacddca43373617a5ddc
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 24576:3FgeyBGOaDKqJEB7i04HIe3kxSAC4R8GjWh:3FO8D7xHI0kxP1yh
TLSH: T1F2589A6009802AE8967C8802E7B54E83CA648C8341599FE257FD33F5F6D19EE707D61E
Submitted as: 0fc9ccdc08a25c91a1f0dfaf776a8a273f893232b06511fafcaabfad16bafad7
File type: pe · Size: 1768448 bytes
Verdict: malicious (100/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 10 weighted signals:

Dropped a malicious payload (NabucurObfs): 25910bf09105986c24f23b31f55adddc76b542716353b2cbb4ac1bb0fed1bbd1 - dynamic signal, weight 0.80, confidence 0.90
Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7812) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 36 external host(s) at runtime (11 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

29482 behavior events · 2 ATT&CK techniques · 19 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8761/files/25910bf09105986c24f23b31f55adddc76b542716353b2cbb4ac1bb0fed1bbd1 - 25910bf09105986c24f23b31f55adddc76b542716353b2cbb4ac1bb0fed1bbd1
/opt/CAPEv2/storage/analyses/8761/files/cf4e2d89b6b3df2a793e3b8f2a0074b1506b76930546ac3a090eca6926ee6274 - cf4e2d89b6b3df2a793e3b8f2a0074b1506b76930546ac3a090eca6926ee6274
/opt/CAPEv2/storage/analyses/8761/files/c8e28b1372dff1aa37c08979489a17a87b3f0c641529ac8e80c1c27b135dc13b - c8e28b1372dff1aa37c08979489a17a87b3f0c641529ac8e80c1c27b135dc13b
/opt/CAPEv2/storage/analyses/8761/files/bad6e02a1c0daaef345c406e3b81ae678edac96c232764d2a5cb3456f14067d6 - bad6e02a1c0daaef345c406e3b81ae678edac96c232764d2a5cb3456f14067d6
/opt/CAPEv2/storage/analyses/8761/files/1d30e88ef2ef059c0f8fcb2d39924d4e1c94836e7b46e869f89fdccd99fc6ce8 - 1d30e88ef2ef059c0f8fcb2d39924d4e1c94836e7b46e869f89fdccd99fc6ce8
/opt/CAPEv2/storage/analyses/8761/files/61cc707f100bf3a6effca45630704fc1c745e066ceaaf9a3c1a21d4b26e78e8f - 61cc707f100bf3a6effca45630704fc1c745e066ceaaf9a3c1a21d4b26e78e8f
/opt/CAPEv2/storage/analyses/8761/files/c9e89aac0035050fa491cc012b9b3d52c7cffc92a95bd1e5afe9db8c1661e5c4 - c9e89aac0035050fa491cc012b9b3d52c7cffc92a95bd1e5afe9db8c1661e5c4
/opt/CAPEv2/storage/analyses/8761/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8761/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8761/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/8761/files/ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51 - ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
/opt/CAPEv2/storage/analyses/8761/files/47376a68c3fe85ad1f60cf4feeb1d372d51863c40cb0e013376afee4d9e0d40b - 47376a68c3fe85ad1f60cf4feeb1d372d51863c40cb0e013376afee4d9e0d40b
/opt/CAPEv2/storage/analyses/8761/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/8761/files/621f2b542a3f723c5b75b69a8a6f95cf9672b7dfcd563a31a28041dd68a9442e - 621f2b542a3f723c5b75b69a8a6f95cf9672b7dfcd563a31a28041dd68a9442e
/opt/CAPEv2/storage/analyses/8761/files/0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca - 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://google.com/
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786359391&P2=404&P3=2&P4=njGLP7wl6PWc%2bageVjhbYM3Vne37y0JI%2b0YbOLcJ9p7jQDIClBrjFuWr7JPkLZLMUP8ID%2b%2fTTDeEbnXS5KUBWQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

142.251.222.238
52.110.12.2
51.116.246.105
57.155.104.224
4.230.171.124
4.144.132.223
20.165.94.63
135.233.95.135
4.150.223.104
51.104.15.252
135.234.160.244
200.87.164.69
135.233.45.223
200.119.204.12
203.26.79.13
190.186.45.170
4.150.223.114
52.168.117.174
135.233.95.80
72.154.7.113
52.148.114.188
142.250.195.238
52.110.12.31
52.110.12.50

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report