MALICIOUS — 6f12737726a472c954e802a646ea7d0d197f7d04b24c35fe643da9bab07f461e

MALICIOUS — 6f12737726a472c954e802a646ea7d0d197f7d04b24c35fe643da9bab07f461e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Convagent family. 5 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: 6f12737726a472c954e802a646ea7d0d197f7d04b24c35fe643da9bab07f461e
• SHA-1: 8b7e4f67747bce5aa384001e9cfb43578f6cd0b4
• MD5: 1d87b3b3c49a2a12cb1044543e12b043
• imphash: b672bf4528e2ef8904397d0b17905606
• ssdeep: 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99Gq:tKq4oEa9RQs+Cn4/UKq
• TLSH: T10D5DD0463A8F489ED8A492327C707D1E39E107A7DBBC8ADA93DD4D502984B03D917B70
• Submitted as: 6f12737726a472c954e802a646ea7d0d197f7d04b24c35fe643da9bab07f461e
• File type: pe · Size: 2710881 bytes
• Verdict: malicious (100/100) · Family: Convagent

Detections (5 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
• ClamAV (daily): Win.Packed.Trojanx-9883093-0
• Detect It Easy (packer/type): DIE:Microsoft Linker
• Microsoft Defender: Trojan:Win32/Reconyc.DA!MTB
• Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

• T1547.001
• T1112
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

• ClamAV (daily) flagged Win.Packed.Trojanx-9883093-0 (rule Win.Packed.Trojanx-9883093-0) - engine signal, weight 0.90, confidence 0.95
• 1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
• Microsoft Defender flagged Trojan:Win32/Reconyc.DA!MTB (rule Trojan:Win32/Reconyc.DA!MTB) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Anti-analysis: T1082, T1497 - dynamic signal, weight 0.40, confidence 0.75
• Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
• MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
• Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
• Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,.boot, Microsoft Linker - static signal, weight 0.25, confidence 0.55
• Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

53648 behavior events · 2 ATT&CK techniques · 9 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• c.pki.goog
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org
• ctldl.windowsupdate.com
• update.googleapis.com
• login.live.com
• desktop-hsgcbep
• v20.events.data.microsoft.com
• config.edge.skype.com
• windows.msn.com
• www.msn.com
• officeclient.microsoft.com
• odc.officeapps.live.com
• settings-win.data.microsoft.com
• assets.msn.com

Dropped files

• C:\Windows\System32\explorer.exe - 1c3b30d8c70178c37b81965a88fa09c5846f3e40e3073495070583243fc5da25
• C:\Users\analyst\AppData\Local\Temp\~DF3D01421003DD713A.TMP - cd28cc38c0fac6f260f64c816f5b613cd5f86158c2cede608f64dc3a44f33b57
• C:\Windows\resources\svchost.exe - c2b7df5275bec205423c33d8361c84c85f7a13a88775a96ecc9e888d1c29dd2a
• C:\Windows\resources\spoolsv.exe - a08ee24b80379df18cb54eee06444f4e15964c0ae22a3d717fc5ccc2002474dd
• C:\Users\analyst\AppData\Local\Temp\~DF1964C4DBF5CD7A79.TMP - a941b5da057560690b11153765184e0f92983148611048f3fdada662054e0efd
• C:\Windows\resources\Themes\explorer.exe - 919da89dc468f3a496846519067e06bf174fafe85bbe1534a2734f84b3241d98
• C:\Users\analyst\AppData\Local\Temp\~DFDBEC4D77FDB3578E.TMP - 7dc617ebb293aeb496348a477b871617a3a8bdb68675398b6eea83c092d5ab85
• C:\Users\analyst\AppData\Local\Temp\~DF5ED7CAD68AFC9642.TMP - e5de5689e0b7d6d0c0b1398763a8eea0498044236bed634e4ba64eef7986d448
• db331b264016450c67e85ad6d2c56d7bd22d1457bd7a958e371687634eada700 - db331b264016450c67e85ad6d2c56d7bd22d1457bd7a958e371687634eada700

Embedded URLs

• https://d.symcb.com/rpa0
• http://s.symcb.com/universal-root.crl0
• https://d.symcb.com/rpa0@
• http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
• http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://c.pki.goog/r/r1.crl
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
• http://yr.c.lencr.org/

Embedded domains

• d.symcb.com
• s.symcb.com
• ts-crl.ws.symantec.com
• ts-aia.ws.symantec.com
• pki-crl.symauth.com
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 4.150.223.106
• 4.230.171.124
• 4.247.188.224
• 57.155.101.212
• 4.144.132.223
• 135.233.95.135
• 135.233.95.144
• 20.184.175.10
• 172.215.188.225
• 52.110.12.20
• 52.110.12.48
• 20.184.175.7
• 51.105.71.137
• 92.223.78.30
• 125.56.205.123
• 125.56.205.65
• 72.154.7.102
• 52.148.114.188
• 52.110.12.33
• 52.110.12.22

More Convagent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report