MALICIOUS — 78f68d9af85f6c619df762131fecc00022777758cf77c42955ddeaebc76a00e7

MALICIOUS — 78f68d9af85f6c619df762131fecc00022777758cf77c42955ddeaebc76a00e7 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Trojanx family. 5 of 55 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 78f68d9af85f6c619df762131fecc00022777758cf77c42955ddeaebc76a00e7
SHA-1: 7467fa9926377fcfb0683ec9fd1287db2ace4ee8
MD5: b32bf457bedda9ec4c5968f303a306de
imphash: b672bf4528e2ef8904397d0b17905606
ssdeep: 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99GQ:tKq4oEa9RQs+Cn4/UKQ
TLSH: T1A25DE1DA14E0115EF07EB716DAF8E39D8E0A3B1F40852DC18E8C645C9AC98573F6606B
Submitted as: 78f68d9af85f6c619df762131fecc00022777758cf77c42955ddeaebc76a00e7
File type: pe · Size: 2711083 bytes
Verdict: malicious (99/100) · Family: Trojanx

Detections (5 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Packed.Trojanx-9883093-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Reconyc.DA!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

ClamAV (daily) flagged Win.Packed.Trojanx-9883093-0 (rule Win.Packed.Trojanx-9883093-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 23 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,.boot, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

95849 behavior events · 3 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~DF43973E2F28895A37.TMP - 8f74538dab6fed02cbfa26644326768eb0655d8540e791d7dc6973e925012f15
C:\Windows\System32\explorer.exe - 1c3b30d8c70178c37b81965a88fa09c5846f3e40e3073495070583243fc5da25
C:\Users\analyst\AppData\Local\Temp\~DFF84F46193B0CA40D.TMP - 7809514e8e8a1a3c96c30fa152cb5bf36faf14732f5d506a8801b1ac7cae8f8a
C:\Users\analyst\AppData\Local\Temp\~DF265B467A3534B2C5.TMP - a941b5da057560690b11153765184e0f92983148611048f3fdada662054e0efd
C:\Windows\resources\spoolsv.exe - d65567fe746823b78c7fc54058de41d61c73ae4f2576acea10c237d6d4e1dd17
C:\Users\analyst\AppData\Local\Temp\~DF31E3BCBAF86AF53D.TMP - 361582bdf8d0766af931cfd2bc639f2c5606bb0ca6e89639be0245d0f9b9db73
C:\Windows\resources\svchost.exe - 7cbb1e0344f6eb0464895351fa0c192e67e307d859fa183e27b212d235f82754
C:\Windows\resources\Themes\explorer.exe - 312e6d47630e81a42072396551446a0674af9a65cc338d6b6b8292283c54a6e8
0866f427725d1fd42eb1483c422b8426dec348b7fa32fb10b4598980598f5bd5 - 0866f427725d1fd42eb1483c422b8426dec348b7fa32fb10b4598980598f5bd5

Embedded URLs

https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787853357&P2=404&P3=2&P4=HCUh1Ph2He9XNU8cQo%2b9R8wuh3v2lxxpmVjPBXl3w1RdukJqCl%2bw6AyZpz1ai9SZOYlXfj3GnfRbqPIkq4OtXw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787853485&P2=404&P3=2&P4=EgbmBKpFoQv5oEABbCtkRBtbcK5umqKDJdB4ts1e1pWedhUvNqrfAvT0UzgovcKi3PocQJ%2f6huEIDqy0Ep7yOQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded domains

d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
pki-crl.symauth.com

Embedded IP addresses

51.132.193.105
20.42.179.204
4.230.171.124
4.144.132.114
74.178.240.61
4.150.223.96
135.232.92.97
20.236.44.162
52.123.128.14
20.184.175.12
203.26.79.13
135.234.160.245
52.110.12.51
52.110.12.40
52.148.114.188
172.178.240.163
74.179.71.159
72.145.35.110
20.184.175.4
4.207.44.65
92.223.78.30
52.110.12.10
52.110.12.49

More Trojanx samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report