MALICIOUS — 84a2afed6c23787ac1ae8f8bd30749a61a6cc16508cf8cc014f58b1e4d8d1384

MALICIOUS — 84a2afed6c23787ac1ae8f8bd30749a61a6cc16508cf8cc014f58b1e4d8d1384 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Convagent family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 84a2afed6c23787ac1ae8f8bd30749a61a6cc16508cf8cc014f58b1e4d8d1384
SHA-1: cbd2b25822a2fa20fb5c371f12cafc066d3801ed
MD5: 087bf3a6839c394882a4a4a9a47c1541
imphash: b672bf4528e2ef8904397d0b17905606
ssdeep: 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99GW:tKq4oEa9RQs+Cn4/UKW
TLSH: T1145DD07FF4C4BBB4E7D4614129C7FADE8180E7A9C4752EF8AB207568A608D9354024EC
Submitted as: 84a2afed6c23787ac1ae8f8bd30749a61a6cc16508cf8cc014f58b1e4d8d1384
File type: pe · Size: 2710949 bytes
Verdict: malicious (100/100) · Family: Convagent

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Packed.Trojanx-9883093-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Reconyc.DA!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Packed.Trojanx-9883093-0 (rule Win.Packed.Trojanx-9883093-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Reconyc.DA!MTB (rule Trojan:Win32/Reconyc.DA!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 2 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,.boot, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

98111 behavior events · 3 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~DF837AFD349CE47382.TMP - a118d3967f23c7a3632c2b2bca206cfd6553828b17c72349102bbc8d6a5b82bd
C:\Windows\System32\explorer.exe - 1c3b30d8c70178c37b81965a88fa09c5846f3e40e3073495070583243fc5da25
C:\Windows\resources\svchost.exe - dea480b64b4f83ed4350e4e0087424f053a0766f31c9c2b7a4da417221e53d53
C:\Users\analyst\AppData\Local\Temp\~DF1F68AE285CB39326.TMP - a941b5da057560690b11153765184e0f92983148611048f3fdada662054e0efd
C:\Users\analyst\AppData\Local\Temp\~DFC8832BB404713863.TMP - 4fb109665eb5a968f050c731ab15ccb35bc74a0b14b07a8c62592248c73fbda6
C:\Users\analyst\AppData\Local\Temp\~DFEB7847572B1BC496.TMP - cab595b415be3df114ad7c0795b5f5b0e0705bc98f4fd72a3da701eab470b871
C:\Windows\resources\spoolsv.exe - daac79b06aaed62e8b64c7679fbd9be5c24eb3a0e704f659bb65cf7ddc8c9f42
C:\Windows\resources\Themes\explorer.exe - 09ef8f78acd6f7ffd861e06221c17eece37821d13499de443221afa97e2fa621
5c3a9daf66403da3b588391537d46a9a0c410999a328019dcb98f85db7de6638 - 5c3a9daf66403da3b588391537d46a9a0c410999a328019dcb98f85db7de6638

Embedded URLs

https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
pki-crl.symauth.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

4.207.44.76
4.247.188.233
52.230.60.54
52.123.252.202
4.230.171.124
172.215.188.232
20.184.175.21
74.178.240.51
135.232.92.137
104.18.33.89
20.184.175.0
52.110.12.1
52.110.12.42
135.234.160.246
125.56.205.25
125.56.205.123
52.148.114.188
72.153.5.138
52.110.12.50
52.110.12.22

More Convagent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report