MALICIOUS — 770ce29036a44d72ff33ae394de5d19fe8399a900e1fa45150231df954cc55e5

MALICIOUS — 770ce29036a44d72ff33ae394de5d19fe8399a900e1fa45150231df954cc55e5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the MSILHeracles family. 5 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

• SHA-256: 770ce29036a44d72ff33ae394de5d19fe8399a900e1fa45150231df954cc55e5
• SHA-1: b056ea171ea0b596bd898320e612bfdf7e9d9141
• MD5: 9993bdc491dfcf483417d0dfbffbb6cd
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 6144:UTfXCgEZ09WhZmyMsGcRskHQ4ar8SgaPG+VYf0pKXmWmhUocqPqQFshInixMjo:grEZMWG4H6ggG+40eYiocdhhI+Mjo
• TLSH: T16A4CAA64BA027A4EC3622C0E38D567AFC4C4EB19656A6B4D31F0BAC9C2CD53F9801D57
• Submitted as: 770ce29036a44d72ff33ae394de5d19fe8399a900e1fa45150231df954cc55e5
• File type: pe · Size: 516608 bytes
• Verdict: malicious (100/100) · Family: MSILHeracles

Detections (5 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
• ClamAV (daily): Win.Malware.Nymeria-7193906-0
• Microsoft Defender: Trojan:MSIL/AgentTesla.LJD!MTB
• Emsisoft (Emergency Kit): Gen:Variant.MSILHeracles.30583
• Kaspersky (KVRT): UDS:Trojan.MSIL.Taskun.gen

MITRE ATT&CK

• T1547.001
• T1543.003
• T1112
• T1562.001
• T1053.005
• T1518.001
• T1105

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Malware.Nymeria-7193906-0 (rule Win.Malware.Nymeria-7193906-0) - engine signal, weight 0.90, confidence 0.95
• 4 behavioral detection(s) across 4 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.69, confidence 0.90
• Microsoft Defender flagged Trojan:MSIL/AgentTesla.LJD!MTB (rule Trojan:MSIL/AgentTesla.LJD!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Variant.MSILHeracles.30583 (rule Gen:Variant.MSILHeracles.30583) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged UDS:Trojan.MSIL.Taskun.gen (rule UDS:Trojan.MSIL.Taskun.gen) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 19 external host(s) and 9 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• Extracted NanoCore config (0 C2) - engine signal, weight 0.45, confidence 0.60
• MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

27089 behavior events · 3 ATT&CK techniques · 32 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• azizurfattahtrading.ddns.net
• 76.0.240.10.in-addr.arpa.
• 1.0.240.10.in-addr.arpa.
• 251.0.0.224.in-addr.arpa.
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• 252.0.0.224.in-addr.arpa.
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• desktop-hsgcbep
• update.googleapis.com
• self.events.data.microsoft.com
• 2.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• 1.0.240.10.in-addr.arpa
• 251.0.0.224.in-addr.arpa
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa
• b.f.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa

Dropped files

• C:\Users\analyst\AppData\Roaming\EC70B9FA-FA73-495F-958E-8D72B138E12B\run.dat - 13ea8367f7e9ab4125c33e9899a92889589002c6c1ab36e304b376604f2eecc9
• C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_14i0glni.es0.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
• C:\Users\analyst\AppData\Local\Temp\tmp823B.tmp - 9473b1527d87bc200dc4d0e25f7a4143a3b8fb05c1eac51aea76e2334a87fae8
• C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - 69de0901566de819e0d028701a664aa7db9b9a274e97a0cd9356a5e37cff3916
• 8bb477a284f00d65669b7bf3e5f425233cc483f5e9229743052a2e258fbff10f - 8bb477a284f00d65669b7bf3e5f425233cc483f5e9229743052a2e258fbff10f
• 926edb0dcfde381266a87460cf76dac87973ee1fc3d608fa468a22ab2af8a811 - 926edb0dcfde381266a87460cf76dac87973ee1fc3d608fa468a22ab2af8a811
• b6d536915d8d59ef1e35a1d9b0df67ffac3b8add90e4b1be73840d9768a339d0 - b6d536915d8d59ef1e35a1d9b0df67ffac3b8add90e4b1be73840d9768a339d0
• 2c3e58dd1e36c1b6cc6194e22e2e734a892fa7cfa43cd87db57c094ebc0033d7 - 2c3e58dd1e36c1b6cc6194e22e2e734a892fa7cfa43cd87db57c094ebc0033d7
• ecfecb0c134700c8d93ef7e5dbc7509c93235ab4c88f74edb121233dbe66b628 - ecfecb0c134700c8d93ef7e5dbc7509c93235ab4c88f74edb121233dbe66b628
• fdece32a1ee80cca97a3d47de0bc616b99f89f6b090ca31165b65533ef3beda2 - fdece32a1ee80cca97a3d47de0bc616b99f89f6b090ca31165b65533ef3beda2
• a2f141dd2a771204f9a3f41b65aafefec4858e0bdf57246069ce4a78427e89f7 - a2f141dd2a771204f9a3f41b65aafefec4858e0bdf57246069ce4a78427e89f7
• c5291fef149a63133cbf143e3f89df7fab278dd8a93e012ea1db1149da9e16db - c5291fef149a63133cbf143e3f89df7fab278dd8a93e012ea1db1149da9e16db
• 821225a6c1dc0d66835754363ffb93ac8e1a304a47956a347d597f073df2a693 - 821225a6c1dc0d66835754363ffb93ac8e1a304a47956a347d597f073df2a693
• 61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403 - 61e9d5c0727665e9ef3f328141397be47c65ed11ab621c644b5bbf1d67138403
• a90f8e4b69a51b047275df796ae123febbfb812b5277bbb05a4ca23fd68abddf - a90f8e4b69a51b047275df796ae123febbfb812b5277bbb05a4ca23fd68abddf

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl

Embedded domains

• azizurfattahtrading.ddns.net
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• yr.c.lencr.org

Embedded IP addresses

• 172.215.188.232
• 20.184.175.6
• 172.172.255.218
• 72.145.35.103
• 57.155.101.212
• 74.178.76.44
• 74.178.232.29
• 79.134.225.73
• 203.26.79.13
• 4.150.223.115
• 52.148.114.188
• 72.154.7.109
• 72.145.35.97
• 13.89.179.12
• 20.184.175.18
• 4.150.223.98
• 20.184.175.2
• 20.184.175.11
• 20.247.185.124
• 52.123.252.224
• 52.110.12.31
• 4.230.171.124
• 135.233.45.221
• 57.154.63.210

More MSILHeracles samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report