MALICIOUS — 9eafe2ece723089f8a7323e5b3e804c1a8922d8f12e18ab0e7c4d0c70b2e26f3

MALICIOUS — 9eafe2ece723089f8a7323e5b3e804c1a8922d8f12e18ab0e7c4d0c70b2e26f3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Eclz family. 5 of 53 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

• SHA-256: 9eafe2ece723089f8a7323e5b3e804c1a8922d8f12e18ab0e7c4d0c70b2e26f3
• SHA-1: 26ea36cd31fed2b11cc7fb200c690084c94ecfba
• MD5: 0bdfbd9066cbeb2847196c7415c7ba57
• imphash: e780223af31e5cc3f52e2ebb06482260
• ssdeep: 6144:dXC4vgmhbIxs3NBRYCBbHWM0TSaA5RCBwkH:dXCNi9B24b0pA5EBwkH
• TLSH: T13742F12221453A9DF4634692D47DCF1F203B64A0B5B24B8ACF56E51CF7E88A71B321C6
• Submitted as: 9eafe2ece723089f8a7323e5b3e804c1a8922d8f12e18ab0e7c4d0c70b2e26f3
• File type: pe · Size: 213541 bytes
• Verdict: malicious (100/100) · Family: Eclz

Detections (5 of 53 engines)

• ClamAV (daily): Win.Malware.Eclz-9953021-0
• YARA: JPCERT/CC: JPCERT_HUILoader_PlugX_SideLoad
• Microsoft Defender: Worm:Win32/Sfone!pz
• Emsisoft (Emergency Kit): Gen:Heur.Mint.Murphy.3
• Kaspersky (KVRT): Worm.Win32.Agent.cp

MITRE ATT&CK

• T1547.001
• T1057
• T1543.003
• T1112

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

• ClamAV (daily) flagged Win.Malware.Eclz-9953021-0 (rule Win.Malware.Eclz-9953021-0) - engine signal, weight 0.90, confidence 0.95
• Memory forensics: 4 finding(s), e.g. RWX/private injected region in taskhostw.exe (pid 7976) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
• Microsoft Defender flagged Worm:Win32/Sfone!pz (rule Worm:Win32/Sfone!pz) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Heur.Mint.Murphy.3 (rule Gen:Heur.Mint.Murphy.3) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• 1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
• YARA: JPCERT/CC flagged JPCERT_HUILoader_PlugX_SideLoad (rule JPCERT_HUILoader_PlugX_SideLoad) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

71312 behavior events · 2 ATT&CK techniques · 23 dropped files.

Runtime network

• www.msftconnecttest.com
• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.office.com
• outlook.office365.com
• outlook.cloud.microsoft
• www.bing.com
• desktop-hsgcbep
• config.edge.skype.com
• tas02.sls.update.microsoft.com
• to-do.microsoft.com
• dns.msftncsi.com
• settings-win.data.microsoft.com
• ctldl.windowsupdate.com
• staging.to-do.microsoft.com
• edge.microsoft.com
• teams.microsoft.com
• aps.prod.windows.com
• watson.events.data.microsoft.com
• ecs.office.com

Dropped files

• /opt/CAPEv2/storage/analyses/3877/files/c55865e1ae0b317d8e44136d6362c8fb96e969ada5817930384a7f3d3c874f88 - c55865e1ae0b317d8e44136d6362c8fb96e969ada5817930384a7f3d3c874f88
• /opt/CAPEv2/storage/analyses/3877/files/70c1adf37103cef32370f3c903ceac4eb19f71d6414b9d4f6d6f91b056daabdf - 70c1adf37103cef32370f3c903ceac4eb19f71d6414b9d4f6d6f91b056daabdf
• /opt/CAPEv2/storage/analyses/3877/files/c0a196dd4456576468fbbd1682a84562de37337c8125561d865e4ed9b1fcd748 - c0a196dd4456576468fbbd1682a84562de37337c8125561d865e4ed9b1fcd748
• /opt/CAPEv2/storage/analyses/3877/files/ee683aef824ecee7fc72bade487955f853d01f43172dc3d2d1b28957e25b02bf - ee683aef824ecee7fc72bade487955f853d01f43172dc3d2d1b28957e25b02bf
• /opt/CAPEv2/storage/analyses/3877/files/9c191fa95dcc0500919ef940f46ef52ec4fc001c099483a9b8350e36e53f1709 - 9c191fa95dcc0500919ef940f46ef52ec4fc001c099483a9b8350e36e53f1709
• /opt/CAPEv2/storage/analyses/3877/files/1ec73a6b4a934a1d46fc2514773ed4a7b53224dae21d45f62c4b2f8631bbb6ca - 1ec73a6b4a934a1d46fc2514773ed4a7b53224dae21d45f62c4b2f8631bbb6ca
• /opt/CAPEv2/storage/analyses/3877/files/359ca8b4a6ca529181ac1df508829762dec21d21e79369452ca3dcbaab9b4590 - 359ca8b4a6ca529181ac1df508829762dec21d21e79369452ca3dcbaab9b4590
• /opt/CAPEv2/storage/analyses/3877/files/2e969269ff369f487afe5af4a84c33262ccd23acbc1e117e64c7d514cae4b712 - 2e969269ff369f487afe5af4a84c33262ccd23acbc1e117e64c7d514cae4b712
• /opt/CAPEv2/storage/analyses/3877/files/43e13deb04b14b43810cb46fb3d404ac0420d09d4fa77279110d344fbea4590d - 43e13deb04b14b43810cb46fb3d404ac0420d09d4fa77279110d344fbea4590d
• /opt/CAPEv2/storage/analyses/3877/files/5a24d37c91e603426ee76fb56632a33bf89c3cc6ad6a05d101f4e0e55e3ea9a0 - 5a24d37c91e603426ee76fb56632a33bf89c3cc6ad6a05d101f4e0e55e3ea9a0
• /opt/CAPEv2/storage/analyses/3877/files/09b28bccf973b8ba8135bdd7d8b0c78d0a719a4a15fb16021c5b1075452045c7 - 09b28bccf973b8ba8135bdd7d8b0c78d0a719a4a15fb16021c5b1075452045c7
• /opt/CAPEv2/storage/analyses/3877/files/28167b2fe5b38342a92821f6974830608fad18692cb89a2963a0093d1aa70bb2 - 28167b2fe5b38342a92821f6974830608fad18692cb89a2963a0093d1aa70bb2
• /opt/CAPEv2/storage/analyses/3877/files/0e1b3a85db521875574fa4cafb456ad36c52de9b95d1d678739ec281a5e9eef6 - 0e1b3a85db521875574fa4cafb456ad36c52de9b95d1d678739ec281a5e9eef6
• /opt/CAPEv2/storage/analyses/3877/files/bae4f3c23d8e5c0018c3ff90009ca51a5a210cb550e11504e0f8bf07b4f976bb - bae4f3c23d8e5c0018c3ff90009ca51a5a210cb550e11504e0f8bf07b4f976bb
• /opt/CAPEv2/storage/analyses/3877/files/f9e19498ced6f908c0e608d75d1badae14dbbd8ae8d48b18ffb9d3d84d38806e - f9e19498ced6f908c0e608d75d1badae14dbbd8ae8d48b18ffb9d3d84d38806e

Embedded domains

• staging.to-do.officeppe.com
• teams.cloud.microsoft
• outlook.cloud.microsoft

File paths

• C:\password.txt
• C:\debug.txt

More Eclz samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report