MALICIOUS — 29ec9bbc5152019dcf9ae4d507e1d21563b47a86f8e5de5e770506ca28bd3367

MALICIOUS — 29ec9bbc5152019dcf9ae4d507e1d21563b47a86f8e5de5e770506ca28bd3367 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the C3A39B5E family. 8 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 29ec9bbc5152019dcf9ae4d507e1d21563b47a86f8e5de5e770506ca28bd3367
SHA-1: 728826954ca99339f046a1e2f9c9ded37a85e274
MD5: e33ce66e42ec7da3ab81153a75245647
imphash: 05ba12b38167e3b0ca1567f47feb195f
ssdeep: 12288:7wCXnLquXU99ICNj7xrcqPkePh+RvMaBlYJQCe2m9Or:MFn9pNjFMePh+RpBlU69Or
TLSH: T17759E06882F173C9DBF397205E245E0D20E26CDDF0BE5C9C46C3D15D66E292BE19221A
Submitted as: 29ec9bbc5152019dcf9ae4d507e1d21563b47a86f8e5de5e770506ca28bd3367
File type: pe · Size: 1897592 bytes
Verdict: malicious (100/100) · Family: C3A39B5E

Detections (8 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Microsoft Visual C/C++
ClamAV (daily): Win.Trojan.R-102
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
YARA: Yara-Rules community: YR_Packer_ASPack_MPRESS
Detect It Easy (packer/type): DIE:Microsoft Visual C/C++
Microsoft Defender: Trojan:Win32/Gupboot!pz
Emsisoft (Emergency Kit): Dropped:Generic.Urelas.C3A39B5E
Kaspersky (KVRT): Rootkit.Win32.Plite.pvf

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 17 weighted signals:

ClamAV (daily) flagged Win.Trojan.R-102 (rule Win.Trojan.R-102) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Gupboot!pz (rule Trojan:Win32/Gupboot!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Dropped:Generic.Urelas.C3A39B5E (rule Dropped:Generic.Urelas.C3A39B5E) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Rootkit.Win32.Plite.pvf (rule Rootkit.Win32.Plite.pvf) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Visual C/C++ (rule DIE:Microsoft Visual C/C++) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Microsoft Visual C/C++ (rule Microsoft Visual C/C++) - engine signal, weight 0.35, confidence 0.70
YARA: Yara-Rules community flagged YR_Packer_ASPack_MPRESS (rule YR_Packer_ASPack_MPRESS) - engine signal, weight 0.30, confidence 0.70
Embedded network infrastructure: 218.54.28.146, 27.125.205.36, 218.54.31.206 - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Microsoft Visual C/C++ - static signal, weight 0.25, confidence 0.55
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Extracted generic config (2 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

23983 behavior events · 2 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - 4b48f21a4b7a02bfbec19ef880a967a02334a3cdcef8ae83de2ef327ba8bc5dd
C:\Users\analyst\AppData\Local\Temp\~DFA3B.tmp - 1b806ad1e024739657bba08faab57e2988dfcfde4568dc9b2b32b08783c5b9f9
C:\Users\analyst\AppData\Local\Temp\nyurgou.exe - d2fb39aa69b399e5dbe64bb9cc3ffb394f0c87e7d4632e042e4aa0b4bb0bdad4
C:\Users\analyst\AppData\Local\Temp\gbp.ini - 4a57643d2c59d1235bc0926f845583f39345839e3e9428ad619eb4b6baf96ad2
C:\Users\analyst\AppData\Local\Temp\tybevou.exe - 00ef6470105cf4f1bf994b098714ad83a8a099a593ec5874e7ae68432ff48e26
C:\Users\analyst\AppData\Local\Temp\golfinfo.ini - f2fccbc91672e32d48aad396bb6bfc2e7c82930f43a6b20ce5ad7df491ca236b
092f0ed4f8d10da51e5b5ea5408c67cac11ba80b5598af02f4b2dc2078b4c356 - 092f0ed4f8d10da51e5b5ea5408c67cac11ba80b5598af02f4b2dc2078b4c356

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

218.54.28.146
27.125.205.36
218.54.31.206
20.89.1.13
52.123.252.219
20.247.184.142
4.230.171.124
85.210.193.152
172.64.154.167
74.178.76.54
74.179.77.204
4.150.223.106
74.178.76.128
92.223.78.30
52.110.12.48
52.110.12.21
135.233.45.223
125.56.205.113
125.56.205.123
57.154.63.210
20.184.175.17
20.42.65.89
72.154.7.106
52.148.114.188
52.110.12.42

File paths

c:\gdisk.exe
c:\windows\gdisk.exe
c:\windows\system32\gdisk.exe

More C3A39B5E samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report