MALICIOUS — 980ec9a2a588af5fb49c65bcc958a98e3ee3b25c81f433acc7eacdbc4864d511

MALICIOUS — 980ec9a2a588af5fb49c65bcc958a98e3ee3b25c81f433acc7eacdbc4864d511 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 6 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 980ec9a2a588af5fb49c65bcc958a98e3ee3b25c81f433acc7eacdbc4864d511
SHA-1: 89ebe74c2ce159c76c97f557ce21e9bcea4d5c9b
MD5: ec817f99a92276bf195cf902a4d0cc2d
imphash: d41d8cd98f00b204e9800998ecf8427e
ssdeep: 6144:096jjlHpSA3M/3Sk09tMky4q1tWY/saSPx0+D:9uA8/qMkyn/vSPx9D
TLSH: T1B0422AE9B4063E9DD86E833FB1CE272E335641867125427CDE809321EAB2D5747D6A0C
Submitted as: 980ec9a2a588af5fb49c65bcc958a98e3ee3b25c81f433acc7eacdbc4864d511
File type: pe · Size: 206848 bytes
Verdict: malicious (100/100)

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
ClamAV (daily): BC.Win.Virus.Ransom-9157.A
Microsoft Defender: Virus:Win32/Nabucur.A
Emsisoft (Emergency Kit): Win32.Virlock.Gen.4
Trellix Stinger (McAfee): W32/VirRansom
Kaspersky (KVRT): Virus.Win32.PolyRansom.a

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged BC.Win.Virus.Ransom-9157.A (rule BC.Win.Virus.Ransom-9157.A) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Virus:Win32/Nabucur.A (rule Virus:Win32/Nabucur.A) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Win32.Virlock.Gen.4 (rule Win32.Virlock.Gen.4) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/VirRansom (rule W32/VirRansom) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Virus.Win32.PolyRansom.a (rule Virus.Win32.PolyRansom.a) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 4 external host(s) and 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Dropped 12 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

12989 behavior events · 3 ATT&CK techniques · 29 dropped files.

Dropped files

bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5 - bd115a575e86e61cea9136c5a2c47e090ba484dc2dee8b51a34111bb094266d5
C:\ProgramData\xiocAsMc\yKgEskQE.exe - 8d99100d585a6409e5200940c372dad301b992b9260ade373c715d9456b4afe2
C:\Users\analyst\AppData\Local\Temp\tsk_4ddd5443654f461c - db223d088b0b41ea77614ec7fbfcde1132f68b2e1c3e40c7c1871a541df625ac
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\superbar.png.exe - c689fb151a0afaef060f7204405479f1114d630d631706ef7787a9621c61f361
C:\ProgramData\xiocAsMc\yKgEskQE.inf - 23d451a70c3df01a8cb22a0c73fa1e0b25dbaaba367582b6dff7e126c23a117e
C:\Users\analyst\AppData\Local\Temp\ewoc.ico - bcb253ea3735a0cf0a8c6ee06c14c884937c64ddeacedb17240e40d403577620
C:\Users\analyst\AppData\Local\Temp\GAMEsYEw.bat - 1fd5f5a768d30b9b6651dc6e35f6702a918fa8c2d2bbdc7826e975156cf1c401
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\background.png - d3e8d47e8c1622ec10adef672ca7a8992748c4f0a4e75f877462e7e661069698
C:\Users\analyst\rSwIoccE\vcIYEIkQ.exe - 5a0b32b9dd3b020f4f8c4c1439c326217913d0d48b33d4cc36981eac4524b25c
C:\ProgramData\Microsoft\Device Stage\Device\{113527a4-45d4-4b6f-b567-97838f1b04b0}\overlay.png - 5c5b0de42d55486ed61dd3a6e96ab09f467bb38ae39fced97adc51ba07426c0e
C:\ProgramData\xiocAsMc\yKgEskQE.inf - b8a699336369c0f1b8dfa396cdac4b6b9257ea2d45c90cb436d52b2c31ca2bf8
C:\Users\analyst\AppData\Local\Temp\BOEkIYII.bat - 6c3f7d1d35ae3a950e9fca7430f735aff76ade685e29b654d1a1771cf0d7ee5b
C:\Users\analyst\AppData\Local\Temp\XskQEssI.bat - 2ed66b1934ccfbcccff259709d27a6325bc2addc714fd05561993f705d961b58
C:\Users\analyst\rSwIoccE\vcIYEIkQ - 0bee21c6a67e2c7563daf2d36b67a75ff2e665f3bf3ccf9c226a1a529f4daf42
C:\Users\analyst\AppData\Local\Temp\file.vbs - 59d889a2bf392f4b117340832b4c73425a7fb1de6c2f83a1aaa779d477c7c6cc

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://google.com/

Embedded IP addresses

57.155.101.212
20.42.65.88
57.155.104.224
4.230.171.124
74.178.76.54
4.144.132.114
135.233.95.144
20.50.201.205
74.178.240.61
200.87.164.69
92.223.78.30
200.119.204.12
52.110.12.8
190.186.45.170
52.148.114.188
40.79.163.155
4.150.223.100
72.154.7.113
52.110.12.30
52.110.12.22

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report