MALICIOUS — ae869bbdc338bf71616ffc06711b8059e9d4763a6fa50ccff17e75e7a1ed1610

MALICIOUS — ae869bbdc338bf71616ffc06711b8059e9d4763a6fa50ccff17e75e7a1ed1610 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Conteban family. 3 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: ae869bbdc338bf71616ffc06711b8059e9d4763a6fa50ccff17e75e7a1ed1610
SHA-1: 07624271c8c3ade37887524c382377345cd53a58
MD5: 56427e3c2637ad37ba4ca1c1a2178994
imphash: af7a5b7051cb5db319ffb67b1ea9333f
ssdeep: 98304:nZ+V/WUyxAWyS+6haEQ0kIzUh5bY5yuyOUfMtUL5oCuOcVxFpcy:nZ+gnxySBrQHrbLq6FRSiy
TLSH: T13562337E3985ECC6FDF43A9A0CD350CCF20AA451547F828DD81980E429D74BBF29A529
Submitted as: ae869bbdc338bf71616ffc06711b8059e9d4763a6fa50ccff17e75e7a1ed1610
File type: pe · Size: 4406292 bytes
Verdict: malicious (98/100) · Family: Conteban

Detections (3 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections: , , , , , ,.boot
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Conteban.A!ml

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 12 weighted signals:

Memory forensics: 1 finding(s) attributed to the sample across 1 technique(s), e.g. RWX/private injected region in tsk_8e5be016a6 (pid 8500) (rule windows.malfind.Malfind) - memory signal, weight 0.60, confidence 0.85
Microsoft Defender flagged Trojan:Win32/Conteban.A!ml (rule Trojan:Win32/Conteban.A!ml) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s) across 1 rule(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 6 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections: , , , , , ,.boot (rule high-entropy-sections: , , , , , ,.boot) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: high-entropy-sections: , , , , , ,.boot, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

35917 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

c6ae02a84444e93a5f27538c88522655d9e59db7be0e837196e818ce9770acd7 - c6ae02a84444e93a5f27538c88522655d9e59db7be0e837196e818ce9770acd7
4e3c6f29940e989e9e7634bb39609c27758d3f897e89efb6b14dd9bea39a75e9 - 4e3c6f29940e989e9e7634bb39609c27758d3f897e89efb6b14dd9bea39a75e9
a0516089b9e5b0bc4e838d27ace78b1462976deb04dd14fb1585e83b6144c0c5 - a0516089b9e5b0bc4e838d27ace78b1462976deb04dd14fb1585e83b6144c0c5

Embedded URLs

http://schemas.microsoft.com/SMI/2005/WindowsSettings
http://schemas.microsoft.com/SMI/2011/WindowsSettings
https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded domains

schemas.microsoft.com
t.mx
d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
pki-crl.symauth.com

Embedded IP addresses

4.150.223.100
4.230.171.124
40.84.97.4
52.230.59.222
74.178.240.51
135.232.92.137
40.79.141.154
57.155.101.212
72.153.5.137
52.148.114.188
52.110.12.4
52.110.12.45

File paths

W:\d@
u:\p
e:\+1n@a

More Conteban samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report