MALICIOUS — 321469e48e5e7fe6b36149db3062896b3e07190d29d86c7059e0c932ada2bfa1

MALICIOUS — 321469e48e5e7fe6b36149db3062896b3e07190d29d86c7059e0c932ada2bfa1 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Copak family. 4 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 321469e48e5e7fe6b36149db3062896b3e07190d29d86c7059e0c932ada2bfa1
SHA-1: 440bb9c62c7caf936d0e50cd82beb5af55470671
MD5: 347a7c615523915efbe0e3c7daa9eb38
imphash: 52d5086abc1dabd2119b92104f1111a0
ssdeep: 12288:VlQrusSTBzBRF8sTGGMzC8rI7Lz7q61cv:VeFSBRF86G9z/U7zWv
TLSH: T17E4B23721DB7EA99C731C8DEC571C6EF589FA33FDA86B01CB5A212496110073AC6C921
Submitted as: 321469e48e5e7fe6b36149db3062896b3e07190d29d86c7059e0c932ada2bfa1
File type: pe · Size: 513536 bytes
Verdict: malicious (100/100) · Family: Copak

Detections (4 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
Microsoft Defender: Trojan:Win32/Copak.KAV!MTB
Emsisoft (Emergency Kit): Gen:Variant.Razy.926485
Kaspersky (KVRT): HEUR:Trojan-Downloader.Win32.PackZ.vho

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. process hollowing in tsk_dfc659bccf (pid 6208) (rule windows.hollowprocesses.HollowProcesses) - memory signal, weight 0.70, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Copak.KAV!MTB (rule Trojan:Win32/Copak.KAV!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Razy.926485 (rule Gen:Variant.Razy.926485) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-Downloader.Win32.PackZ.vho (rule HEUR:Trojan-Downloader.Win32.PackZ.vho) - engine signal, weight 0.55, confidence 0.85
2 IDS alert(s): ThreatLens Pastebin exfil/stager lookup - network signal, weight 0.50, confidence 0.80
2 behavioral detection(s) across 2 rule(s): Scheduled Task / Job [medium] (rule tl-scheduled-task) - dynamic signal, weight 0.43, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 9 external host(s) and 26 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1622, T1497.001 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

12168 behavior events · 2 ATT&CK techniques · 27 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - e3f413e911cadf65ab095c16465bd6ec78961dc94f009d1330ec226b3444f7fd
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - 78668dda031297755bfcb3c897bfc92fae98f9bdff1d366ca4ead1675c082cd6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\103621DE9CD5414CC2538780B4B75751 - e186d9491e2996366e79660620649a3bbd959bc3e49b5fd14b0d5ee72da75dba
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9840D2EA9A291B957CCF8D40A94DDAA4 - 6328f31b36b96fb1b9643246e205f817ba45f3e06cee56adef383db99c043d7f
C:\Users\analyst\AppData\Local\Temp\SUQgi.xml - ba03d2bd60f1ab7e360939eccea571699aae6bbfcd72086104af857f33d8cb8c
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827 - 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B625C9EE8BD3E6849AFA2339291AE3C - 566b3ac5a5e8d3b7b4f2118df643096b33dcb7e9039e14e9b335eec3bcacc55d
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B625C9EE8BD3E6849AFA2339291AE3C - 5118fbae5f424bb7114a5531d6bc02f2538fe48303fb574aafaf7a17717c8140
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E3E4B05E877647EF3D7B912F256A94C - ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 - 9a2daabc99f4d014e07499efe908fea2ee11ad3a2f319ed63c7fe7836fc7faad

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://ye.i.lencr.org/
http://x2.i.lencr.org/
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://ye1.c.lencr.org/103.crl
http://q.gs/EVnYC
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/pyeoXlQPF4E.crl
http://c.pki.goog/we1/OpMCQT6sVwg.crl
http://c.pki.goog/we1/USODfqcOxVM.crl

Embedded domains

pastebin.com
cutit.org
ye.i.lencr.org
x2.i.lencr.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye1.c.lencr.org
q.gs
publisher.linkvertise.com
direct-link.net
linkvertise.com

Embedded IP addresses

13.89.179.12
4.230.171.124
57.154.63.210
52.230.59.222
135.232.92.97
74.178.240.61
4.207.44.64
20.184.175.20
52.123.252.239
172.66.171.73
52.110.12.30
52.110.12.26
104.18.0.75
172.67.217.63
172.234.27.71
104.21.84.133
104.18.1.75
104.18.21.213
52.148.114.188
85.210.196.11
72.154.7.103
52.110.12.22
52.110.12.10

More Copak samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report