MALICIOUS — e5f174a2ed7ed8cf329ec05432d7c56771cc936b488c59c78f80af499249a593

MALICIOUS — e5f174a2ed7ed8cf329ec05432d7c56771cc936b488c59c78f80af499249a593 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (93/100), attributed to the Copak family. 4 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: e5f174a2ed7ed8cf329ec05432d7c56771cc936b488c59c78f80af499249a593
SHA-1: 9b397005b1d493d100dbcb3c30be51909e4312a4
MD5: 35e7de92eb30493fc16a2d7c6e532dd2
imphash: 6ed4f5f04d62b18d96b26d6db7c18840
ssdeep: 6144:3ByPR2CxVBZFoVwFz/+O6e/XQY448Kz0zDhFU1S46eMNxQ:M2CXBZuwkbe/Y48KAzk1S41
TLSH: T1424512E7D95CA12ECBD08A0174BCCA1CFD93477E985386202EF856C7358013BEA09E94
Submitted as: e5f174a2ed7ed8cf329ec05432d7c56771cc936b488c59c78f80af499249a593
File type: pe · Size: 272384 bytes
Verdict: malicious (93/100) · Family: Copak

Detections (4 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
Kaspersky (KVRT): HEUR:Trojan.Win32.Copak.pef
Microsoft Defender: Trojan:Win32/Copak.KKA!MTB
Emsisoft (Emergency Kit): Gen:Heur.Mint.Zard.24

MITRE ATT&CK

Why this verdict

The malicious score of 93/100 is the fusion of 7 weighted signals:

Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Copak.pef (rule HEUR:Trojan.Win32.Copak.pef) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: tsk_2bda7cc495834b7f.exe - dynamic signal, weight 0.40, confidence 0.90
Contacted 38 external host(s) at runtime (26 HTTP) - network signal, weight 0.40, confidence 0.80
Packing/obfuscation: UPX - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

1411 behavior events · 2 ATT&CK techniques · 18 dropped files.

Dropped files

C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8 - 997437e076c60f5e3eaa6f30235daaf3b8e250f6877ce89d404d160b28501de7
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\9840D2EA9A291B957CCF8D40A94DDAA4 - 4b59064b2d6c2e505b342b13b00d0a84c3451c683146d5b8f500b5e8fb4d6666
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B625C9EE8BD3E6849AFA2339291AE3C - 31f87603c4e2581cf85bc16807debc6969eb8835a1757b46008492e3b5f322ae
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BDE28772A83DB7274166C9CC07B6A827 - 0fc0901cca2bae9e9fdbb02d50d02f1094f7b36672086991b9e897626dc485f0
C:\Users\analyst\AppData\Local\Temp\tsk_2bda7cc495834b7f.exe - 886572ba4d7a699e9d86fe9740386ffb188dbe2bd967e8d1f52e373d0e925838
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BDE28772A83DB7274166C9CC07B6A827 - 97a252fdc6f3077efd37e8d3854ba11f73e1933627d35c9f98b26cb6da1f40a3
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4E3E4B05E877647EF3D7B912F256A94C - 7cf89363579ef1266538527c639b8b275201b979c9d52ac69a2d09fc24bf9819
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\22D536C4B4AD2CEF7AC6B7789FD235E3 - 8a6063a5252f4647a09688ee108129762d2779b52cf0a2697320bd675e32070a
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8 - d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4E3E4B05E877647EF3D7B912F256A94C - ee5f7abd6981bb0255632cd8f49283451b4b18844d12040b44ee00f07b8fe2c6
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\22D536C4B4AD2CEF7AC6B7789FD235E3 - 251ed08cc8f5873098ea5ee083034e7cd99ece955920e12a42e50306a94cb6eb
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\9840D2EA9A291B957CCF8D40A94DDAA4 - 8a2e728a8f0f06619256ce7a59b4e6e0cc875d64542fdeb6e89a85dd61e5f7c4
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B625C9EE8BD3E6849AFA2339291AE3C - 31ea98f64e2471a39c787483d8ae4784e807a19cec739287f46930d149716c6e
C:\Users\analyst\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12 - 3a2a44dced7d06b70f1b20668944a6f6f8e47613042ef4b9933f20c9d6d2acb4

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://ye.i.lencr.org/
http://x2.i.lencr.org/
http://ye1.c.lencr.org/103.crl
http://q.gs/EVnYC
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl
http://c.pki.goog/we1/pyeoXlQPF4E.crl
http://ye.c.lencr.org/

Embedded domains

cutit.org
ye.i.lencr.org
x2.i.lencr.org
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
ye1.c.lencr.org
q.gs
publisher.linkvertise.com
linkvertise.com

Embedded IP addresses

51.11.192.50
172.215.188.232
52.110.12.11
74.178.240.61
57.155.104.224
40.74.98.196
20.231.239.246
52.230.60.54
48.211.4.16
52.110.12.16
172.239.193.161
20.236.44.162
4.150.223.110
135.234.160.244
4.230.171.124
57.155.101.212
172.234.27.37
52.123.252.192
52.182.143.212
52.123.252.248
104.18.20.213
172.67.193.84
74.178.240.51
52.123.252.226
20.165.94.63

More Copak samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report