MALICIOUS — 569abcb32669ebd34f3d001d8db62a913a95092567cb50af7ac4ab3176f291cb

MALICIOUS — 569abcb32669ebd34f3d001d8db62a913a95092567cb50af7ac4ab3176f291cb is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Trojanx family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 569abcb32669ebd34f3d001d8db62a913a95092567cb50af7ac4ab3176f291cb
SHA-1: 6385483ac083dfd66b59d63a71f14b63f191fa61
MD5: 15cc189924b5ab77bd4f34778d9223a8
imphash: b672bf4528e2ef8904397d0b17905606
ssdeep: 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99GJ:tKq4oEa9RQs+Cn4/UKJ
TLSH: T1465DD031E277BC8CD19474C8A510F92EE17C2658511877AADD8EF7BB701C40B2678A2E
Submitted as: 569abcb32669ebd34f3d001d8db62a913a95092567cb50af7ac4ab3176f291cb
File type: pe · Size: 2710872 bytes
Verdict: malicious (99/100) · Family: Trojanx

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Packed.Trojanx-9883093-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Reconyc.DA!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Trojanx-9883093-0 (rule Win.Packed.Trojanx-9883093-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 30 external host(s) and 23 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1497.001, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,.boot, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

64587 behavior events · 3 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Windows\resources\svchost.exe - 9f861326d5e92cbf7f8e636903c9a2c0c775c425fc96e1e04d086d07d4ac79ac
C:\Windows\System32\explorer.exe - 1c3b30d8c70178c37b81965a88fa09c5846f3e40e3073495070583243fc5da25
C:\Windows\resources\spoolsv.exe - f7b13e475455d84cba668d8ee4df4511dd19401efe9a4344728150a1e9ca6f5f
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_256.db - 723ef109024a7d1b03e6335ee53d0140027b2224765fe5fed23d1b07906a03a6
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_48.db - d3c9d1ff7b54b653c6a1125cac49f52070338a2dd271817bba8853e99c0f33a9
C:\Users\analyst\AppData\Local\Temp\~DF8C8C8C3A726BA3EF.TMP - a941b5da057560690b11153765184e0f92983148611048f3fdada662054e0efd
C:\Users\analyst\AppData\Local\Microsoft\Windows\Explorer\thumbcache_idx.db - a87402eefbc4625ced6e89433215eabe5a39f33e29ad868da483d2e1860a9a93
C:\Windows\resources\Themes\explorer.exe - c2020a4604f639210702776a0af76cfa2aee35d34d7419254b1ea189b086b83b
C:\Users\analyst\AppData\Local\Temp\~DF1465192EEF4EF88F.TMP - d9a2ee15dbe55ee96afe03b63abb5ac3fdbb188f566900ef90a08fca6d4acd3a
C:\Users\analyst\AppData\Local\Temp\~DFB4FA6A8637EB4D04.TMP - 776ec6aea6cb62161a5c9b741f21e365567261933f282fd0589509a10e1786d3
C:\Users\analyst\AppData\Local\Temp\~DF063AEBF6E4E6EDB9.TMP - 029e85e321acd6415c11865ed98fc5c42b99a71aaa89c6e475af0827c00fb323
12bd7df1ae5a6429dbf0760c85b5898ea80f73aeb52e89fb79b8901ee35057c9 - 12bd7df1ae5a6429dbf0760c85b5898ea80f73aeb52e89fb79b8901ee35057c9

Embedded URLs

https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/9a8a705c-852d-4d18-b32a-ee1d872f4bd9?P1=1787947871&P2=404&P3=2&P4=PUU0MJnWSw%2fpdI5nTfU2CUDrHdRdr%2bXIdh8UYAM2U9%2f0grhfPPxp%2fkFK2qmXKk7mNxAdjIuWaUEXo32P2JdwqA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/51d86688-616b-47e3-abeb-3df16a1583c5/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/51d86688-616b-47e3-abeb-3df16a1583c5?P1=1787947950&P2=404&P3=2&P4=igbl4WOClB%2blR1kqgQmjs2PoqjTREk02NG2%2fzc57gZxciCUdstaIogEnefr9aM5wjxxU2wlyR2DS3OAp%2fJMUEQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
pki-crl.symauth.com

Embedded IP addresses

20.42.73.24
52.123.252.248
52.253.84.76
52.123.252.222
57.155.101.212
4.230.171.124
74.178.240.61
4.150.223.104
74.178.76.54
40.103.64.226
20.112.250.133
52.123.128.14
4.150.223.107
203.26.79.13
52.123.252.194
74.178.232.29
52.123.252.230
172.178.240.163
92.223.78.30
52.110.12.20
52.110.12.31
52.148.114.188
135.233.45.221
184.84.165.171
72.145.35.104

More Trojanx samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report