MALICIOUS — 713b84ceec4d9d6b35c0851f73b773ad84689e2458b811a8be11449eebaef298.exe
MALICIOUS — 713b84ceec4d9d6b35c0851f73b773ad84689e2458b811a8be11449eebaef298.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the execute family. 5 of 53 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
713b84ceec4d9d6b35c0851f73b773ad84689e2458b811a8be11449eebaef298 - SHA-1:
81862b32dfac3db4cf61d0603daa2fa949bc88ca - MD5:
6cea19bf252870cbb5cd166121c181e7 - imphash:
3fb6a9dab44411de426dea40f784f564 - ssdeep:
98304:TCAhaB4eIYmKEzqEx7oZPyatA1khagVL7ZcMxaD9WyVLjtcxBWdVwjsMOv39L2K:TCbueILK4hza+1kh7VL7OhD9WyVLjts - TLSH:
T11A61DF7A062E3490E0FEA9A4BC4C2E8CD0E5B1799433AB548543DF0F5801557EEE74AE - Submitted as: 713b84ceec4d9d6b35c0851f73b773ad84689e2458b811a8be11449eebaef298.exe
- File type: pe · Size: 4045312 bytes
- Verdict: malicious (92/100) · Family: execute
Source: MalwareBazaar · first seen 2026-07-26T00:00:00.000Z · SHA-256 verified
Detections (5 of 53 engines)
- capa (capabilities): execute via PowerShell
- YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
- Microsoft Defender: Trojan:Win32/Malgent
- Emsisoft (Emergency Kit): Trojan.GenericKD.80945896
- Kaspersky (KVRT): VHO:Trojan.Win64.Aotnet.gen
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 9 weighted signals:
- Memory forensics: 6 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7252) (rule
windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.GenericKD.80945896 (rule
Trojan.GenericKD.80945896) - engine signal, weight 0.55, confidence 0.85 - execute via PowerShell (rule
execute via PowerShell) - capa signal, weight 0.40, confidence 0.80 - YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule
JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70 - Embedded network infrastructure: 4.2.1.0 - static signal, weight 0.35, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90 - Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
- Extracted generic config (1 C2) (generic/advisory) - engine signal, weight 0.15, confidence 0.30
Dynamic analysis (windows)
54 behavior events · 1 ATT&CK techniques · 1 dropped files.
Runtime network
- www.msftconnecttest.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- www.bing.com
- desktop-hsgcbep
- tas02.sls.update.microsoft.com
- config.edge.skype.com
- dns.msftncsi.com
- ctldl.windowsupdate.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- teams.microsoft.com
- aps.prod.windows.com
- ecs.office.com
Dropped files
- 370f2fc56fc0ee371573e846ef9a6aba183d136858b6170a63c9a87c7805693c -
370f2fc56fc0ee371573e846ef9a6aba183d136858b6170a63c9a87c7805693c
Embedded URLs
- https://aka.ms/nativeaot-compatibilit
Embedded domains
- aka.ms
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.cloud.microsoft
- www.msftconnecttest.com
- outlook.office.com
- outlook.office365.com
- www.bing.com
- tas02.sls.update.microsoft.com
- config.edge.skype.com
- dns.msftncsi.com
- ctldl.windowsupdate.com
- to-do.microsoft.com
- settings-win.data.microsoft.com
- staging.to-do.microsoft.com
- edge.microsoft.com
- watson.events.data.microsoft.com
- teams.microsoft.com
- aps.prod.windows.com
- ecs.office.com
- g.live.com
- www.msftncsi.com
- fs.microsoft.com
- self.events.data.microsoft.com
- msedge.api.cdp.microsoft.com
Embedded IP addresses
- 4.2.1.0
More execute samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report