MALICIOUS — 0e9ae7a4778e1acf7b7b6aac7fb82d94d6fcc23002e56db896cc9e7433c407d1

MALICIOUS — 0e9ae7a4778e1acf7b7b6aac7fb82d94d6fcc23002e56db896cc9e7433c407d1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100). 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 0e9ae7a4778e1acf7b7b6aac7fb82d94d6fcc23002e56db896cc9e7433c407d1
• SHA-1: 09b162a7c91256ce36dbff94163bc142d5b48e63
• MD5: 7aa31e5ef3bd40a6faabbf5ea5c98cbd
• imphash: 6ed4f5f04d62b18d96b26d6db7c18840
• ssdeep: 3072:1/Ln2x76pI2SP2Vlc3SWW7+4xWHwx+te0I0GpQ:1/Lnu+BQ2Vlc3E76HrI0sQ
• TLSH: T1B33E01471827CA89DADD7C7F2220890C64A5EE97414A32CE5AE44D9AF13CC271873B99
• Submitted as: 0e9ae7a4778e1acf7b7b6aac7fb82d94d6fcc23002e56db896cc9e7433c407d1
• File type: pe · Size: 136192 bytes
• Verdict: malicious (98/100)

Detections (4 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• Microsoft Defender: Trojan:Win32/Copak.KKA!MTB
• Emsisoft (Emergency Kit): Gen:Trojan.Heur.imW@!hBy@@e
• Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.pef

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 98/100 is the fusion of 10 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Copak.KKA!MTB (rule Trojan:Win32/Copak.KKA!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Trojan.Heur.imW@!hBy@@e (rule Gen:Trojan.Heur.imW@!hBy@@e) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Copak.pef (rule HEUR:Trojan.Win32.Copak.pef) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 6 external host(s) and 29 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

9033 behavior events · 2 ATT&CK techniques · 26 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• cutit.org
• ye.i.lencr.org
• x2.i.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• ye1.c.lencr.org
• q.gs
• publisher.linkvertise.com
• c.pki.goog
• direct-link.net
• linkvertise.com
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep

Dropped files

• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B625C9EE8BD3E6849AFA2339291AE3C - 9ef23ff70083531073aa5d8fae8127f4616001386b8abfa1bd9b50249f8e676c
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D588C464E3D4F9F1F5D043A1B7C9A7E - c7593e669301fdbbeba4c404aeeee19235253f7759c2aa982f8250ad52d974da
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - 16ceeca007c21751bcbd53885c00af01ae9d0dcecbe9d368d3e472ee56ac1a04
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9840D2EA9A291B957CCF8D40A94DDAA4 - c025f5a5d58632630c2438ce22e0135fddef6222d97e0b4f790f598da79b508b
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827 - 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 - 98db3d65a334db75a65c90d94076bd3fcb89967bf8911eba1dbf06e24f02854f
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8AC0ED8906442A67C7B113D790F1875D - 14b7c0b3ce955e043fe42c3937389b6c005816527387dbda2cc01c227e128653
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827 - 00276be2fd8cc6d74a700d5ca9006e68992397cb8dd9e700967b49fb18a7010b
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - 7ab5f14361f735779ffd766c1d60a07eb9b140d281728568d51abefa571aba1d
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7D588C464E3D4F9F1F5D043A1B7C9A7E - fbd3770fb9753d4c6e9f2b17eedca2cea5ea5c118763339447b488788614b140
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B625C9EE8BD3E6849AFA2339291AE3C - 1342ae3084f1dd8faf5bbf97fd7edf47588bef436c83e021ce5e1a37f5d382c2

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://ye.i.lencr.org/
• http://x2.i.lencr.org/
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://ye1.c.lencr.org/103.crl
• http://q.gs/EVnYC
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl
• http://c.pki.goog/we1/pyeoXlQPF4E.crl
• http://c.pki.goog/we1/OpMCQT6sVwg.crl
• http://c.pki.goog/we1/USODfqcOxVM.crl
• http://c.pki.goog/r/r1.crl
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• cutit.org
• ye.i.lencr.org
• x2.i.lencr.org
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• ye1.c.lencr.org
• q.gs
• publisher.linkvertise.com
• direct-link.net
• linkvertise.com
• yr.c.lencr.org

Embedded IP addresses

• 20.184.175.5
• 52.253.84.76
• 85.210.196.11
• 4.230.171.124
• 40.84.85.40
• 135.232.92.137
• 135.232.92.97
• 4.150.223.109
• 74.179.77.204
• 104.18.33.89
• 52.138.229.67
• 4.150.223.110
• 57.154.63.210
• 172.234.27.71
• 104.18.1.75
• 172.67.217.63
• 104.18.0.75
• 172.67.193.84
• 104.18.21.213
• 92.223.78.30
• 52.148.114.188
• 52.110.12.48
• 72.154.7.98

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report