MALICIOUS — 02ef810f6a6206bcff97d718146ff72838aba173e4905a839b89ae20f656dde0

MALICIOUS — 02ef810f6a6206bcff97d718146ff72838aba173e4905a839b89ae20f656dde0 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Convagent family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 02ef810f6a6206bcff97d718146ff72838aba173e4905a839b89ae20f656dde0
SHA-1: 387bc42126d3fa7bf962facc468bbb5eb8ae75ff
MD5: c52ffbcb474ca585bff1f1bf0066333d
imphash: b672bf4528e2ef8904397d0b17905606
ssdeep: 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99Gg:tKq4oEa9RQs+Cn4/UKg
TLSH: T1575DD0E22ED66815C189D8CF89942F1FB71452A32B4529C80F16CBA34372E73C1BB6D5
Submitted as: 02ef810f6a6206bcff97d718146ff72838aba173e4905a839b89ae20f656dde0
File type: pe · Size: 2710914 bytes
Verdict: malicious (100/100) · Family: Convagent

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Packed.Trojanx-9883093-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Reconyc.DA!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Packed.Trojanx-9883093-0 (rule Win.Packed.Trojanx-9883093-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Memory forensics: 2 finding(s), e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.50, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 20 external host(s) at runtime (23 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622, T1497, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,.boot, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

62698 behavior events · 3 ATT&CK techniques · 11 dropped files.

Dropped files

C:\Windows\System32\explorer.exe - 1c3b30d8c70178c37b81965a88fa09c5846f3e40e3073495070583243fc5da25
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db - d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
C:\Windows\resources\svchost.exe - b02e124f58110e6cdd1c1f2e83ee88ca30f4b1fbaea46041badbe8a96eac9bc8
C:\Users\analyst\AppData\Local\Temp\~DF490D522A2B6F80AB.TMP - a941b5da057560690b11153765184e0f92983148611048f3fdada662054e0efd
C:\Users\analyst\AppData\Local\Temp\~DF9E5CB39CAD9D1149.TMP - 1b8add6a3367102d711ead87f78a72d779702616df731dc4411675e602afdc6f
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db - a87402eefbc4625ced6e89433215eabe5a39f33e29ad868da483d2e1860a9a93
C:\Users\analyst\AppData\Local\Temp\~DFFF0835A2E9E16786.TMP - 5410b312e719058fbb0d14f98d16b72aab81f99dc81b3eeb06e6e47b4bbec283
C:\Windows\resources\spoolsv.exe - e8704442f557aea536c28a99cb80d11f0e01ded78fa01591500a3646a29a240b
C:\Windows\resources\Themes\explorer.exe - 78ef7ea1922310f45bffb6eb57b5a7c06f29e653ce78bc4e94a5ce86b3e903c3
C:\Users\analyst\AppData\Local\Temp\~DFE7FF9DEA5944333E.TMP - bda44d7f85bb22267fe163d4d75eaa64961d350a9176c9e0726cc7a2fb5bbc7a
a0dea2e4e658393ae8cfbf70bcc5acbfff7e2c1e7c80837e66b2bb17d2186f79 - a0dea2e4e658393ae8cfbf70bcc5acbfff7e2c1e7c80837e66b2bb17d2186f79

Embedded URLs

https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787863860&P2=404&P3=2&P4=SPg6W2ywM6BC1%2f1fJ5tdxD7cGCLg%2bnd1I3PeqAZrfWHTjYRzbEuaL8qgwrr05ZNBkVxBQdLjDhgutEVJHsNUCg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787863896&P2=404&P3=2&P4=NcAhxG5%2f7nH4UVPkoib1BCN9TYB3W9M3WWkV73PpAYf7MPTHQ5r2E0ZjAjDr4IcKVtpWWfZRToAClHhFEhkVnw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
pki-crl.symauth.com

Embedded IP addresses

4.150.223.108
57.155.101.212
4.230.171.124
20.247.184.197
135.233.95.144
20.184.175.20
74.178.76.54
203.26.79.13
52.168.112.67
20.231.239.246
52.123.128.14
52.123.129.14
135.233.95.80
135.234.160.245
52.110.12.56
52.110.12.38
52.148.114.188
72.154.7.111
92.223.78.30
52.110.12.18

More Convagent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report