MALICIOUS — 2deec638a65a592c8f0fc345511afe6ee355a5889c33348b0913c383066bfc2f

MALICIOUS — 2deec638a65a592c8f0fc345511afe6ee355a5889c33348b0913c383066bfc2f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the NabucurObfs family. 4 of 25 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2deec638a65a592c8f0fc345511afe6ee355a5889c33348b0913c383066bfc2f
SHA-1: 71744314f2e5808e6d12b3130cdeb01af241a516
MD5: acc4ddc5c3dcf5079e9afa1c85a0e681
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 12288:cvCKFGGDX4mdWZGRIjLmUADGdVjZ3QwPqYo48lfKGOCkjhfeXHGZBZ:tn2X4mdWjjLmzGdVj9ro7l721
TLSH: T1795A32754F7A03E2024E15F55C2D92E92AF33A47B0E24990F3D1B16B308CAD6ED63958
Submitted as: 2deec638a65a592c8f0fc345511afe6ee355a5889c33348b0913c383066bfc2f
File type: pe · Size: 2038272 bytes
Verdict: malicious (99/100) · Family: NabucurObfs

Detections (4 of 25 engines)

Microsoft Defender: Trojan:Win32/NabucurObfs
Emsisoft (Emergency Kit): Win32.Virlock.Gen.5
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 9 weighted signals:

Memory forensics: 7 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 8156) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/NabucurObfs (rule Trojan:Win32/NabucurObfs) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.5 (rule Win32.Virlock.Gen.5) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 36 external host(s) at runtime (19 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

24994 behavior events · 2 ATT&CK techniques · 18 dropped files.

Dropped files

/opt/CAPEv2/storage/analyses/8912/files/05224d5abaf3632b1ba909ba7c4c8caa60d816b73f59771a04441673c44ea493 - 05224d5abaf3632b1ba909ba7c4c8caa60d816b73f59771a04441673c44ea493
/opt/CAPEv2/storage/analyses/8912/files/0c1241cc6c4c24bb903ac1a192772fcc55a4ac69304099229a7527ad577941b1 - 0c1241cc6c4c24bb903ac1a192772fcc55a4ac69304099229a7527ad577941b1
/opt/CAPEv2/storage/analyses/8912/files/39e3ca30661ea6aad1c6312c3e6834b906541aaad702df183a52dae977bbf8ef - 39e3ca30661ea6aad1c6312c3e6834b906541aaad702df183a52dae977bbf8ef
/opt/CAPEv2/storage/analyses/8912/files/e2642a34318ff1ecf141a778ed18c3ed1e29cf39cf830b5e78f9ac3087c3c21d - e2642a34318ff1ecf141a778ed18c3ed1e29cf39cf830b5e78f9ac3087c3c21d
/opt/CAPEv2/storage/analyses/8912/files/4058069f061fa8a2731dc01c6f4b1cbb8b75030c67fdbd63f90c82205ab13e78 - 4058069f061fa8a2731dc01c6f4b1cbb8b75030c67fdbd63f90c82205ab13e78
/opt/CAPEv2/storage/analyses/8912/files/5e4ab35c52566301e57767209d48da2c6adf7d4cd23f6aa092f5ecaa68f4173d - 5e4ab35c52566301e57767209d48da2c6adf7d4cd23f6aa092f5ecaa68f4173d
/opt/CAPEv2/storage/analyses/8912/files/fb2c599d04e10fe847d1a8b0acd0137a87190dd34b1ea7c48bddeaaaf6006b5a - fb2c599d04e10fe847d1a8b0acd0137a87190dd34b1ea7c48bddeaaaf6006b5a
/opt/CAPEv2/storage/analyses/8912/files/dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d - dffedb4bd7421e0d8b56380f0641136f61f2316d9943e4cdfe0962643abe355d
/opt/CAPEv2/storage/analyses/8912/files/bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620 - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
/opt/CAPEv2/storage/analyses/8912/files/d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698 - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
/opt/CAPEv2/storage/analyses/8912/files/ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51 - ed7913a5b4914f6343f312915bd957b6c72c09c3061985d38d2d8b6c4241af51
/opt/CAPEv2/storage/analyses/8912/files/c0175802e878ed8402a8a81536ceea0896f46c4671a6260f2d2765e216caae6a - c0175802e878ed8402a8a81536ceea0896f46c4671a6260f2d2765e216caae6a
/opt/CAPEv2/storage/analyses/8912/files/5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
/opt/CAPEv2/storage/analyses/8912/files/7908819048a57225d9a20e9cf940863ee5576523b6b3b7fae051e90e2bb7c15a - 7908819048a57225d9a20e9cf940863ee5576523b6b3b7fae051e90e2bb7c15a
/opt/CAPEv2/storage/analyses/8912/files/0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca - 0f35ace5268db33940ed18e946a9c65be4e31ec0ae31faa6e60122859c5cb5ca

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://203.26.79.13/filestreamingservice//files/736bdc20-582e-46c5-ba31-d31d3d97258e/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/736bdc20-582e-46c5-ba31-d31d3d97258e?P1=1786368187&P2=404&P3=2&P4=P%2b%2fWRrfPfeyiP0i0D8S0aAgo59VZ42BJJwUmL5EN1xBNhHplMwXbBWldsbXoHLAaUtB1SRHoBvioE2WH%2bWX5pA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://google.com/
http://203.26.79.13/filestreamingservice//files/c48ae315-f580-4b6c-801e-58a0f885749d/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c48ae315-f580-4b6c-801e-58a0f885749d?P1=1786368240&P2=404&P3=2&P4=VzkouMEDAniDVgMJWIYBQsZjkxzgEYUhByIFdcH6EYb2MKyr0AAc8QlNRSBrD0ucopJfgXmVfpUnizbSWDiexw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

57.155.104.224
20.42.65.84
52.123.252.229
4.230.171.124
4.144.132.114
135.233.95.144
135.232.92.97
20.184.175.22
20.42.73.31
203.26.79.13
52.123.252.248
135.233.95.80
52.123.252.247
172.178.240.161
200.87.164.69
52.123.252.216
200.119.204.12
190.186.45.170
20.42.179.192
72.153.5.133
52.148.114.188
20.184.175.2
172.217.25.174
52.110.12.51
52.110.12.50

More NabucurObfs samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report