MALICIOUS — 2e7177aa61a20a0993062743fb16fe0811b1050175c71ffed70fe7a7cb82dc8d
MALICIOUS — 2e7177aa61a20a0993062743fb16fe0811b1050175c71ffed70fe7a7cb82dc8d is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (89/100). 3 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
2e7177aa61a20a0993062743fb16fe0811b1050175c71ffed70fe7a7cb82dc8d - SHA-1:
c854d58999f4a15c2a8e809720fba966f353562f - MD5:
9b95f513a12b0e99ccd3474647212e58 - imphash:
169d8985903a24276ca68c0822a61601 - ssdeep:
24576:gwnaZ0C3t8OlrPs8v8QffEJJub+X7AXEd0TJ:gwaZ0ktV108vvu8b+rA0CT - TLSH:
T12050337241E6F248D8C784695E5DD63D053E428F24BE4702AB82B38B1B7DB63C605A7C - Submitted as: 2e7177aa61a20a0993062743fb16fe0811b1050175c71ffed70fe7a7cb82dc8d
- File type: pe · Size: 803328 bytes
- Verdict: malicious (89/100)
Detections (3 of 56 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- Microsoft Defender: Trojan:Win32/Injector.RAQ!MTB
- Kaspersky (KVRT): UDS:Trojan.Win32.Copak
MITRE ATT&CK
Why this verdict
The malicious score of 89/100 is the fusion of 6 weighted signals:
- Microsoft Defender flagged Trojan:Win32/Injector.RAQ!MTB (rule
Trojan:Win32/Injector.RAQ!MTB) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged UDS:Trojan.Win32.Copak (rule
UDS:Trojan.Win32.Copak) - engine signal, weight 0.55, confidence 0.85 - Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule
UPX) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1 - static signal, weight 0.25, confidence 0.55
- Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Dynamic analysis (windows)
330 behavior events · 0 ATT&CK techniques · 6 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- update.googleapis.com
- login.live.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- officeclient.microsoft.com
- www.msn.com
- odc.officeapps.live.com
- assets.msn.com
- www.bing.com
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- www.msftconnecttest.com/connecttest.txt
Dropped files
- C:\Users\analyst\AppData\Local\Temp\tsk_eaedc535e8f34b8c.exe -
353bc843b1fc8dede6e5634dcc2838126fc0a25e188c4c8113a9f90988d9980d - b6de4c3bc3c99113587f5236b35894daef9f5cea176423dbc8a4123a837f0b23 -
b6de4c3bc3c99113587f5236b35894daef9f5cea176423dbc8a4123a837f0b23 - e9d89b61d5ac1c46eab5980c403ff8f82828aa4379fcec4f4874d2d79e077971 -
e9d89b61d5ac1c46eab5980c403ff8f82828aa4379fcec4f4874d2d79e077971 - f3e5e887ddae4bb7da14319485038b9b90503717bb049c3f900b8e9315f977a6 -
f3e5e887ddae4bb7da14319485038b9b90503717bb049c3f900b8e9315f977a6 - 2252872955020d53a56a270bda711a79e43c026d5c5c4efc14b42d7bb7ff1156 -
2252872955020d53a56a270bda711a79e43c026d5c5c4efc14b42d7bb7ff1156 - aa9f63639286ce728eb7348f90ac17344fc88c79b729e265ff11c2d0e48a3dff -
aa9f63639286ce728eb7348f90ac17344fc88c79b729e265ff11c2d0e48a3dff
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
Embedded IP addresses
- 4.150.223.104
- 4.144.132.114
- 4.230.171.124
- 162.159.142.9
- 52.110.12.14
- 184.84.165.171
- 52.110.12.5
File paths
- q:\[y
- M:\V
Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report