MALICIOUS — e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87

MALICIOUS — e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100). 5 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87
SHA-1: 709b52847483261b6288c4f0ea2d571c54a70275
MD5: 680e08dfb787740be8313220da9c7674
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 12288:cNRb+HKg5c7znycY02KHiW7HjPwZDb4uoswO/5a0CL2:iRb+VaPnycYydwSkwQaH2
TLSH: T1DD4EE0CC49D953C0C6EA4D2E16B496AF14C27C8279BBB64CCABA843274C56379C3742D
Submitted as: e1267ac21ecbf34f7601c33b7b60c840fc459e3de54a8db2568c227ee340cb87
File type: pe · Size: 645232 bytes
Verdict: malicious (100/100)

Detections (5 of 56 engines)

capa (capabilities): capability:execution/powershell
MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.text
Emsisoft (Emergency Kit): Trojan.Crypt
Trellix Stinger (McAfee): AgentTesla-FDFA!680E08DFB787
Kaspersky (KVRT): UDS:Trojan-PSW.MSIL.Reline.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 14 weighted signals:

4 behavioral detection(s) across 4 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.69, confidence 0.90
Emsisoft (Emergency Kit) flagged Trojan.Crypt (rule Trojan.Crypt) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDFA!680E08DFB787 (rule AgentTesla-FDFA!680E08DFB787) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged UDS:Trojan-PSW.MSIL.Reline.gen (rule UDS:Trojan-PSW.MSIL.Reline.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: ModuleAnalysisCache - dynamic signal, weight 0.40, confidence 0.90
execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
Contacted 2 external host(s) and 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497.001, T1497, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.text (rule high-entropy-sections:.text) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.text - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

74604 behavior events · 3 ATT&CK techniques · 24 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - 9429fb123c90f8d5130515bc7f73b0157a5bc3c6a7558f336c80cc2680b9dca2
C:\Users\analyst\AppData\Local\Temp\0630fc9d-5faa-4258-b454-59d149ea0c7d\AdvancedRun.exe - 29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_0dha0c0n.nha.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Users\analyst\AppData\Local\Temp\0630fc9d-5faa-4258-b454-59d149ea0c7d\test.bat - 27426aa52448e564b5b9dff2dbe62037992ada8336a8e36560cee7a94930c45e
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - 1422fc27e4e907cc5054eef1b1cd6725faf4ce08e1fc19ad881e97041ef02fbc
4baf9225f97baac99e4ed93fd84f0534759449663820f1fe73e1d14a9dfee875 - 4baf9225f97baac99e4ed93fd84f0534759449663820f1fe73e1d14a9dfee875
47641b6589a4f2cb86a8201e105e9fea9f7267cef9aa16ecde14bdc1ea640100 - 47641b6589a4f2cb86a8201e105e9fea9f7267cef9aa16ecde14bdc1ea640100
e0a8ead9d189dc89cbd0f2c91ae8ca00258ec39f3acd95da2b31a7c68d115166 - e0a8ead9d189dc89cbd0f2c91ae8ca00258ec39f3acd95da2b31a7c68d115166
fd79ab4f61f6bf33c4c169d7c477378c6d892952807681459d7546be220a9414 - fd79ab4f61f6bf33c4c169d7c477378c6d892952807681459d7546be220a9414
2ff0cb65db1e862541a73d77ce47a3e81e3f396c2e3c15f98fc5b9f2c20dde91 - 2ff0cb65db1e862541a73d77ce47a3e81e3f396c2e3c15f98fc5b9f2c20dde91
85e9668fc60bbd321c7df81369711c89ba445ada133363a0900302bf88804e1e - 85e9668fc60bbd321c7df81369711c89ba445ada133363a0900302bf88804e1e
5921706e1cb140ea9cd9c74c36cdc7cf27c00a9d7bdbb171ad99e02acdf58d86 - 5921706e1cb140ea9cd9c74c36cdc7cf27c00a9d7bdbb171ad99e02acdf58d86
b0602f74b9eda6761b2ba526693b3cdc57ae712426756066cabd7dff8fd0f965 - b0602f74b9eda6761b2ba526693b3cdc57ae712426756066cabd7dff8fd0f965
7260a9c388fdaf3a467082f0114b03b0e4224cb817925646fe8929d4353f8f46 - 7260a9c388fdaf3a467082f0114b03b0e4224cb817925646fe8929d4353f8f46
12e6749b6563873e0d8dd262815a1c1bdf691c56029c855212f3ccdcd03be302 - 12e6749b6563873e0d8dd262815a1c1bdf691c56029c855212f3ccdcd03be302

Embedded URLs

http://schemas.microsoft.com/winfx/2006/xaml
http://www.digicert.com/CPS0
http://crl3.digicert.com/sha2-assured-ts.crl02
http://crl4.digicert.com/sha2-assured-ts.crl0
https://www.digicert.com/CPS0
http://go.microsoft.com/fwlink/?LinkId=178034
http://go.microsoft.com/fwlink/?LinkId=178036
http://go.microsoft.com/fwlink/?LinkId=221672
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

schemas.microsoft.com
www.digicert.com
crl3.digicert.com
crl4.digicert.com
cacerts.digicert.com
go.microsoft.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.182.143.212
52.123.252.245
4.230.171.124
57.155.104.224
85.210.193.152
20.247.185.124
20.165.94.54
74.179.77.204
51.116.246.104
104.18.33.89
20.247.184.197
172.215.188.232
172.64.149.23
92.223.78.30
52.148.114.188
185.183.32.200
135.234.160.247
135.234.160.245
72.145.35.104
52.110.12.11
52.110.12.50

File paths

E:\A\_work\2199\s\obj\x64\Release\Microsoft.Web.Delegation\Microsoft.Web.Delegation.pdb

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report