MALICIOUS — cd29c3d5e7e80df5b415770170c6680a8ed36a91a5d1b107db2754798a0ac8d6

MALICIOUS — cd29c3d5e7e80df5b415770170c6680a8ed36a91a5d1b107db2754798a0ac8d6 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (97/100), attributed to the Copak family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

• SHA-256: cd29c3d5e7e80df5b415770170c6680a8ed36a91a5d1b107db2754798a0ac8d6
• SHA-1: 7f9b172ee585da6d8ad42e4cb742fa5788a87dd4
• MD5: 65202611ef0b6167ca77ffac091288dc
• imphash: 6ed4f5f04d62b18d96b26d6db7c18840
• ssdeep: 3072:W7ZsLLWEA87Z2E2hV5Neh8/BlVsra0rfNppGWhqMxRjLMtk9Q:q6d7hyV54ml2fr3pGc7yKQ
• TLSH: T14E3E0131445C3EECCB2E2E39A994C6FC1934D94D519AACA1617FC85A38BC1FF3085269
• Submitted as: cd29c3d5e7e80df5b415770170c6680a8ed36a91a5d1b107db2754798a0ac8d6
• File type: pe · Size: 136192 bytes
• Verdict: malicious (97/100) · Family: Copak

Detections (4 of 56 engines)

• MalwareAnalyser heuristics (entropy/packer): UPX
• Microsoft Defender: Trojan:Win32/Copak.KKA!MTB
• Emsisoft (Emergency Kit): Gen:Trojan.Heur.imW@!hBy@@e
• Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.pef

MITRE ATT&CK

• T1543.003
• T1112
• T1105

Why this verdict

The malicious score of 97/100 is the fusion of 10 weighted signals:

• Microsoft Defender flagged Trojan:Win32/Copak.KKA!MTB (rule Trojan:Win32/Copak.KKA!MTB) - engine signal, weight 0.55, confidence 0.85
• Emsisoft (Emergency Kit) flagged Gen:Trojan.Heur.imW@!hBy@@e (rule Gen:Trojan.Heur.imW@!hBy@@e) - engine signal, weight 0.55, confidence 0.85
• Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Copak.pef (rule HEUR:Trojan.Win32.Copak.pef) - engine signal, weight 0.55, confidence 0.85
• Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
• Contacted 10 external host(s) and 23 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
• MalwareAnalyser heuristics (entropy/packer) flagged UPX (rule UPX) - engine signal, weight 0.35, confidence 0.70
• Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
• Dropped 1 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
• Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
• Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

16977 behavior events · 2 ATT&CK techniques · 27 dropped files.

Runtime network

• www.msftconnecttest.com
• rb.symcd.com
• rb.symcb.com
• inference.location.live.net
• cutit.org
• ye.i.lencr.org
• x2.i.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• ye1.c.lencr.org
• q.gs
• publisher.linkvertise.com
• c.pki.goog
• direct-link.net
• linkvertise.com
• 252.0.0.224.in-addr.arpa.
• 3.0.0.0.1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.2.0.f.f.ip6.arpa.
• x1.c.lencr.org
• 54.133.221.23.in-addr.arpa.
• 106.238.33.23.in-addr.arpa.

Dropped files

• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 - 4963389943faa69c3d69e8775dcb0136808c5d49d87ec9fba19fce7f3c0684c0
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1B1495DD322A24490E2BF2FAABAE1C61 - 12fd0590708bb38d8039bc994178acee8a3d220f0cd194b0f1c2fc9ba622f927
• C:\Users\analyst\AppData\Local\Temp\tsk_a3075d8c72e6452f.exe - 359fbec7bd9f51cd72f0fd07d0edb2c07ba55aee4dd7eeb6ed776274b508c0e7
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7D588C464E3D4F9F1F5D043A1B7C9A7E - 37b7ea1f1559eaa3fa3cd7beae520adf9380a77faa522ae8982a890003ff1c68
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1B1495DD322A24490E2BF2FAABAE1C61 - beb1bbfb9b9a24cb4f4a32d8e81aeceb37c7a098a06ebbaa7f120b30a39aee0a
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B625C9EE8BD3E6849AFA2339291AE3C - a175a4ed971754cdd11aa9b2c0f3bf9069da983ecf23575edaf81671c7b5ef40
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827 - 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\103621DE9CD5414CC2538780B4B75751 - 3dd5ea8a14eb665ba6057d424f94e5e83757ffaab456578dbf038af04053b19e
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827 - 64da59f0997734a7ef8630aea0c1eeab9ddadfa3df2acda0e340972c0201b2c1
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
• C:\Users\analyst\AppData\Local\Microsoft\Windows\INetCache\IE\XRUA1FHR\AFK9IqzvctpL[1].htm - b323364172d200dda3fdaab6f2a4ae6f85829e10f250bd24816afdbdb27fc459
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E3E4B05E877647EF3D7B912F256A94C - ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
• C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 2a99410643dce25be8d08934c13c31a6533a91754104c322f73ec7de541071b2

Embedded URLs

• http://www.msftconnecttest.com/connecttest.txt
• http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
• http://rb.symcb.com/rb.crl
• http://ye.i.lencr.org/
• http://x2.i.lencr.org/
• http://x2.c.lencr.org/
• http://ye.c.lencr.org/
• http://ye1.c.lencr.org/103.crl
• http://q.gs/EVnYC
• http://c.pki.goog/r/gsr1.crl
• http://c.pki.goog/r/r4.crl
• http://c.pki.goog/we1/pyeoXlQPF4E.crl
• http://c.pki.goog/we1/OpMCQT6sVwg.crl
• http://c.pki.goog/we1/USODfqcOxVM.crl

Embedded domains

• aefd.nelreports.net
• cutit.org
• ye.i.lencr.org
• x2.i.lencr.org
• x1.c.lencr.org
• x2.c.lencr.org
• ye.c.lencr.org
• ye1.c.lencr.org
• q.gs
• publisher.linkvertise.com
• direct-link.net
• linkvertise.com

Embedded IP addresses

• 51.105.71.136
• 20.247.184.142
• 52.123.252.242
• 4.230.171.124
• 104.208.16.94
• 20.42.73.27
• 20.42.179.192
• 184.84.165.136
• 184.84.165.171
• 72.145.35.97
• 52.148.114.188
• 104.18.0.75
• 172.67.217.63
• 52.110.12.50
• 52.110.12.32
• 104.21.84.133
• 104.18.21.213
• 172.234.27.37
• 172.239.193.161
• 172.67.193.84
• 104.21.61.249
• 104.18.1.75
• 52.168.117.170

More Copak samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report