MALICIOUS — 77a94e7dd51540cedae86603da82cbb878afe4481fd8ec2a7e14865d73b76402
MALICIOUS — 77a94e7dd51540cedae86603da82cbb878afe4481fd8ec2a7e14865d73b76402 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Remcos family. 5 of 56 detection engines flagged it, exhibiting 1 ATT&CK technique.
Identification
- SHA-256:
77a94e7dd51540cedae86603da82cbb878afe4481fd8ec2a7e14865d73b76402 - SHA-1:
dba8db9c2e383a639dd4f7aa0a8799dcec2eea50 - MD5:
3a47ec14f63a87ce1f3d8cd6c54bbcf4 - imphash:
f34d5f2d4577ed6d9ceec516c1f5a744 - ssdeep:
24576:IfhQ4VOMAudcyWS3MgqYhUlztjhrAr85h:KhOMAudES3Mg1Uj9AA5 - TLSH:
T1CE555C97DBDA9D1FECFC36291C22D0AE2AE76897243F14040B97643514173AB4F214AE - Submitted as: 77a94e7dd51540cedae86603da82cbb878afe4481fd8ec2a7e14865d73b76402
- File type: pe · Size: 1255424 bytes
- Verdict: malicious (100/100) · Family: Remcos
Detections (5 of 56 engines)
- ClamAV (daily): Win.Dropper.Remcos-10026421-0
- Microsoft Defender: Trojan:MSIL/Tnega.KA!MTB
- Emsisoft (Emergency Kit): Trojan.Agent
- Trellix Stinger (McAfee): AgentTesla-FDFG!3A47EC14F63A
- Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen
MITRE ATT&CK
Why this verdict
The malicious score of 100/100 is the fusion of 9 weighted signals:
- ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule
Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95 - Microsoft Defender flagged Trojan:MSIL/Tnega.KA!MTB (rule
Trojan:MSIL/Tnega.KA!MTB) - engine signal, weight 0.55, confidence 0.85 - Emsisoft (Emergency Kit) flagged Trojan.Agent (rule
Trojan.Agent) - engine signal, weight 0.55, confidence 0.85 - Trellix Stinger (McAfee) flagged AgentTesla-FDFG!3A47EC14F63A (rule
AgentTesla-FDFG!3A47EC14F63A) - engine signal, weight 0.55, confidence 0.85 - Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Agensla.gen (rule
HEUR:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85 - Contacted 2 external host(s) and 15 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
- Extracted Formbook config (0 C2) - engine signal, weight 0.45, confidence 0.60
- Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60
- 1 behavioral detection(s) across 1 rule(s): Discovery: enumerates installed security software [low] (rule
tl-security-software-discovery) - dynamic signal, weight 0.20, confidence 0.90
Dynamic analysis (windows)
6045 behavior events · 0 ATT&CK techniques · 12 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- c.pki.goog
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
- update.googleapis.com
- desktop-hsgcbep
- login.live.com
- v20.events.data.microsoft.com
- licensing.mp.microsoft.com
- config.edge.skype.com
- windows.msn.com
- www.msn.com
- settings-win.data.microsoft.com
- officeclient.microsoft.com
- odc.officeapps.live.com
- assets.msn.com
Dropped files
- 572892fc6cf810c316d476a6335b08dce637ead56fe92c94a7854d9c30eb4022 -
572892fc6cf810c316d476a6335b08dce637ead56fe92c94a7854d9c30eb4022 - 73b22feb3fe4cc7c7db74bf000503598de720b46b334c8bf395515f1b896d762 -
73b22feb3fe4cc7c7db74bf000503598de720b46b334c8bf395515f1b896d762 - aa3921bd21443f6246ac9e005350de49f54294ea5c715bf604ef8f501b58f380 -
aa3921bd21443f6246ac9e005350de49f54294ea5c715bf604ef8f501b58f380 - 460ebdc396371518e6f9ddce2914a159251a39d289debfd5d6691c4b4c1d9fd3 -
460ebdc396371518e6f9ddce2914a159251a39d289debfd5d6691c4b4c1d9fd3 - 86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f -
86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f - 863b3eac9ba48056111a044a3fe56a8791f74763de3e7b56de0c4bda40404d3a -
863b3eac9ba48056111a044a3fe56a8791f74763de3e7b56de0c4bda40404d3a - 17e1f037653fecf0acf77546741f9305a7be73222bed94baa27ec5a7d428a661 -
17e1f037653fecf0acf77546741f9305a7be73222bed94baa27ec5a7d428a661 - ca07de9212e7487460d42b4b867c63a0a4bb3bd643325e5b58e8d7f3508ebf3c -
ca07de9212e7487460d42b4b867c63a0a4bb3bd643325e5b58e8d7f3508ebf3c - 44648dcbceef394e78e183e7a291c426e49768a8c82f3de48fbad047e995e586 -
44648dcbceef394e78e183e7a291c426e49768a8c82f3de48fbad047e995e586 - db3e81fed06bc283bb3db8474069b046be8f541c5efa016d9108c4593c36bc2c -
db3e81fed06bc283bb3db8474069b046be8f541c5efa016d9108c4593c36bc2c - cd884fc09a6c81495f9f84d028d40e39c2cbee430409aad81c565d1abdc09f4f -
cd884fc09a6c81495f9f84d028d40e39c2cbee430409aad81c565d1abdc09f4f - 0cb5d98284a17b4e847ac829648fd91f425553acc995203ca83b7f029dc60de2 -
0cb5d98284a17b4e847ac829648fd91f425553acc995203ca83b7f029dc60de2
Embedded URLs
- http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://c.pki.goog/r/r1.crl
- http://x2.c.lencr.org/
- http://ye.c.lencr.org/
- http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
- http://yr.c.lencr.org/
Embedded domains
- i.uk
- www.codeproject.com
- x1.c.lencr.org
- x2.c.lencr.org
- ye.c.lencr.org
- yr.c.lencr.org
Embedded IP addresses
- 40.79.167.9
- 4.144.132.114
- 4.247.188.224
- 4.230.171.124
- 52.110.12.8
- 52.110.12.18
- 172.215.188.232
- 184.84.165.171
- 184.84.165.136
- 72.154.7.107
- 20.42.65.90
- 4.150.223.112
- 92.223.78.30
- 52.148.114.188
- 52.110.12.32
- 52.110.12.56
More Remcos samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report