MALICIOUS — 80524e38d83418165e3b94d048ce7aacce3f5ac2f51968c3aea368784704b1f2

MALICIOUS — 80524e38d83418165e3b94d048ce7aacce3f5ac2f51968c3aea368784704b1f2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Remcos family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 80524e38d83418165e3b94d048ce7aacce3f5ac2f51968c3aea368784704b1f2
SHA-1: 2e2077bdb2aa007a2fb18df91d5772dce8d7f0b2
MD5: 3479c4f501f3214ebc5772f7a00785d9
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 24576:EJptocESg+1wJWgTFH4etvCl9T4nXICcVZu:EJpQTFH4etYSM
TLSH: T15A50BECD28756759F2F63AB76094E2EEFEA7798D28B43FD015804C22625DB3B8035019
Submitted as: 80524e38d83418165e3b94d048ce7aacce3f5ac2f51968c3aea368784704b1f2
File type: pe · Size: 794112 bytes
Verdict: malicious (100/100) · Family: Remcos

Detections (5 of 56 engines)

ClamAV (daily): Win.Dropper.Remcos-10026421-0
Microsoft Defender: Trojan:MSIL/AgentTesla.DLM!MTB
Emsisoft (Emergency Kit): Trojan.Agent
Trellix Stinger (McAfee): AgentTesla-FDFG!3479C4F501F3
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95
2 behavioral detection(s) across 2 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.DLM!MTB (rule Trojan:MSIL/AgentTesla.DLM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDFG!3479C4F501F3 (rule AgentTesla-FDFG!3479C4F501F3) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Agensla.gen (rule HEUR:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

11367 behavior events · 3 ATT&CK techniques · 14 dropped files.

Dropped files

C:\Windows\System32\Drivers\etc\hosts - 9b13a3ea948a1071a81787aac1930b89e30df22ce13f8ff751f31b5d83e79ffb
bbcc9b1f4443dc26a4083015ad1cfec6188117fdcec1b67f4c720b58c57e9d60 - bbcc9b1f4443dc26a4083015ad1cfec6188117fdcec1b67f4c720b58c57e9d60
c6bdcb26141972673ab3ff5295296649a90dcadf383553879c0305fa068b5805 - c6bdcb26141972673ab3ff5295296649a90dcadf383553879c0305fa068b5805
a1f4ca9625c372797568ab156b4640109a46831a9ae36ae25d7cc7f961e4322f - a1f4ca9625c372797568ab156b4640109a46831a9ae36ae25d7cc7f961e4322f
83925e40d3be9b77d2c4cd39050427b0d96f856552da57d45f25f7a90acf634f - 83925e40d3be9b77d2c4cd39050427b0d96f856552da57d45f25f7a90acf634f
b353790a8c7babbba12bf761e89b1e12fcc84c4344cdaafcdbee67696cb757ce - b353790a8c7babbba12bf761e89b1e12fcc84c4344cdaafcdbee67696cb757ce
dfc86f2065eb062721ceef96f0c6e16a326b55d5ba76f29f3814ee2398653a3c - dfc86f2065eb062721ceef96f0c6e16a326b55d5ba76f29f3814ee2398653a3c
c6323694416bbec2ed0440ed601cbcfe8a6fa71204672c93b337de6f02dd8501 - c6323694416bbec2ed0440ed601cbcfe8a6fa71204672c93b337de6f02dd8501
53cbe076c0ca73109fd59585a7da542d727a4792b18345c00f293fc01707ea04 - 53cbe076c0ca73109fd59585a7da542d727a4792b18345c00f293fc01707ea04
105c4aa94779201994b8032b10d35b74e2fff476da40d4c853df4c2320f5a504 - 105c4aa94779201994b8032b10d35b74e2fff476da40d4c853df4c2320f5a504
5ece3a746eae3ea0ae78aaf4b4725a8a436a884ec9913b45a8bf0a6316ddd25b - 5ece3a746eae3ea0ae78aaf4b4725a8a436a884ec9913b45a8bf0a6316ddd25b
128b95820d212338b4c74b117c5a48b03ac47815758bec135abaad386eb89e4b - 128b95820d212338b4c74b117c5a48b03ac47815758bec135abaad386eb89e4b
3a0fee31b8eeab15355c64f464deb861a375f8737692a8451c734f7ebeece2a7 - 3a0fee31b8eeab15355c64f464deb861a375f8737692a8451c734f7ebeece2a7
27c96f2d4775db2b077bb5e0579615103b5e16622d4d21f607f3d0d1b35a49c9 - 27c96f2d4775db2b077bb5e0579615103b5e16622d4d21f607f3d0d1b35a49c9

Embedded URLs

http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

www.codeproject.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.28
4.144.132.223
4.230.171.124
85.210.193.152
135.234.160.247
57.155.101.212
72.145.35.102
52.148.114.188
52.110.12.1

More Remcos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report