MALICIOUS — 986ff46ba9d7f1cf9f01ef153b4cee53957c91e47c9a8ed1bcf9c87db4dc0a7e

MALICIOUS — 986ff46ba9d7f1cf9f01ef153b4cee53957c91e47c9a8ed1bcf9c87db4dc0a7e is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Remcos family. 7 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: 986ff46ba9d7f1cf9f01ef153b4cee53957c91e47c9a8ed1bcf9c87db4dc0a7e
SHA-1: fa2b4918c99177e8a45e9cf283ec1b50c1021dab
MD5: 0cfceb4e889d1c23d827547eb93e5b35
imphash: ac0eeb9445380b88a6022d3d601931ba
ssdeep: 12288:Th11Yrvt9Epl2GElIDG4arbKu4AIvM3G0/e1w4OEjt/n:Th1SpM2tWMGHRvM20WJVjt/
TLSH: T14D50AFAE12A6B683C33FC739454AAF1D4433E85516BE1C89057F443ED2ED8AF6610368
Submitted as: 986ff46ba9d7f1cf9f01ef153b4cee53957c91e47c9a8ed1bcf9c87db4dc0a7e
File type: pe · Size: 764416 bytes
Verdict: malicious (100/100) · Family: Remcos

Detections (7 of 56 engines)

capa (capabilities): capability:collection/keylog
ClamAV (daily): Win.Dropper.Remcos-9909717-0
YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
Microsoft Defender: Trojan:Win32/Remcos.PDD!MTB
Emsisoft (Emergency Kit): Trojan.Injector
Trellix Stinger (McAfee): Fareit-FDBI!0CFCEB4E889D
Kaspersky (KVRT): HEUR:Backdoor.Win32.Remcos.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 16 weighted signals:

ClamAV (daily) flagged Win.Dropper.Remcos-9909717-0 (rule Win.Dropper.Remcos-9909717-0) - engine signal, weight 0.90, confidence 0.95
Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_3690a4e2e9 (pid 8412) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Remcos.PDD!MTB (rule Trojan:Win32/Remcos.PDD!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Injector (rule Trojan.Injector) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Fareit-FDBI!0CFCEB4E889D (rule Fareit-FDBI!0CFCEB4E889D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.Win32.Remcos.gen (rule HEUR:Backdoor.Win32.Remcos.gen) - engine signal, weight 0.55, confidence 0.85
YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.60, confidence 0.70
1 IDS alert(s): ThreatLens Discord CDN payload/exfil - network signal, weight 0.50, confidence 0.80
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
Contacted 3 external host(s) and 19 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:collection/keylog (rule capability:collection/keylog) - engine signal, weight 0.35, confidence 0.70
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

11643 behavior events · 2 ATT&CK techniques · 7 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 - d7d708a27d59b2ea05f35ae58a192805e76c3e5e246f988cfbd3a044fc245393
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 0894a8e8db780f657bfe8c9adb6467aa7580b4df1c33a094dc10546bdfc91365
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D744C9621913B92E124E007C87A1EE30 - f848581f28001d46aea0f6e5cc19903268f53efa4bdec6023826495f33ff2b3a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D744C9621913B92E124E007C87A1EE30 - 7a825cb219acbaab88a20469aa1956bb91f8865129638362f1de753882eef7e9
a97fbe63746ac22ff0ba3c439ef71164f70d0760afe456ba19d3e965938b591d - a97fbe63746ac22ff0ba3c439ef71164f70d0760afe456ba19d3e965938b591d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/vpMVCCR8pGU.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

po.uk
cdn.discordapp.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.16
52.123.252.246
57.155.104.224
4.230.171.124
74.179.77.164
20.165.94.63
20.184.175.6
20.184.175.7
52.230.60.54
104.18.33.89
52.110.12.42
52.110.12.14
72.153.5.97
52.148.114.188
162.159.133.233
52.110.12.32
52.110.12.8

File paths

X:\:`:d:
X:\:`:d:h:l:p:t:x:
X:\:`:d:h:l:
R:\:d:p:
G:\:
X:\:`:d:h:
T:\:d:l:t:

More Remcos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report