MALICIOUS — e8ded83a6f1c3e63bb81a943fb216357cb8ea939cc4ee3c5af10a7935abd9d8f

MALICIOUS — e8ded83a6f1c3e63bb81a943fb216357cb8ea939cc4ee3c5af10a7935abd9d8f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Convagent family. 5 of 56 detection engines flagged it, exhibiting 4 ATT&CK techniques.

Identification

SHA-256: e8ded83a6f1c3e63bb81a943fb216357cb8ea939cc4ee3c5af10a7935abd9d8f
SHA-1: d5352b4d3479186fa11c6a555a90dfa0a2b5338c
MD5: 41e5e277308d78860aa54dc69fa4efe5
imphash: b672bf4528e2ef8904397d0b17905606
ssdeep: 49152:tU/5M1X4Wl/YvzYCQR9RQs+C40yZpJaD99Gm:tKq4oEa9RQs+Cn4/UKm
TLSH: T1895DD080BA27512CD4D158B22700FF4E95D664F67D50AA636318FD7AEF414A3A3A038F
Submitted as: e8ded83a6f1c3e63bb81a943fb216357cb8ea939cc4ee3c5af10a7935abd9d8f
File type: pe · Size: 2710960 bytes
Verdict: malicious (100/100) · Family: Convagent

Detections (5 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): Themida/VMProtect
ClamAV (daily): Win.Packed.Trojanx-9883093-0
Detect It Easy (packer/type): DIE:Microsoft Linker
Microsoft Defender: Trojan:Win32/Reconyc.DA!MTB
Kaspersky (KVRT): HEUR:Trojan.Win32.Convagent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 15 weighted signals:

ClamAV (daily) flagged Win.Packed.Trojanx-9883093-0 (rule Win.Packed.Trojanx-9883093-0) - engine signal, weight 0.90, confidence 0.95
1 behavioral detection(s) across 1 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.60, confidence 0.90
Microsoft Defender flagged Trojan:Win32/Reconyc.DA!MTB (rule Trojan:Win32/Reconyc.DA!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win32.Convagent.gen (rule HEUR:Trojan.Win32.Convagent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1497, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:Microsoft Linker (rule DIE:Microsoft Linker) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged Themida/VMProtect (rule Themida/VMProtect) - engine signal, weight 0.35, confidence 0.70
Embedded network infrastructure: https://d.symcb.com/rpa0, http://s.symcb.com/universal-root.crl0, https://d.symcb.com/rpa0@ - static signal, weight 0.35, confidence 0.60
Packing/obfuscation: Themida/VMProtect, high-entropy-sections: , ,.boot, Microsoft Linker - static signal, weight 0.25, confidence 0.55
Dropped 4 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

100405 behavior events · 3 ATT&CK techniques · 9 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\~DFB87C7607AA67A8B8.TMP - ebd3a41dcbff13e5845693247f99e7f5fcd5f096de8ec660d983945a01a8d544
C:\Windows\System32\explorer.exe - 1c3b30d8c70178c37b81965a88fa09c5846f3e40e3073495070583243fc5da25
C:\Users\analyst\AppData\Local\Temp\~DF3E2AE0A156DC9200.TMP - 0ab88fe0e64c5646a7328a095233e96038175b6086f5872af5d99032b3bd9e01
C:\Users\analyst\AppData\Local\Temp\~DF592FB6FA0A57741C.TMP - a941b5da057560690b11153765184e0f92983148611048f3fdada662054e0efd
C:\Users\analyst\AppData\Local\Temp\~DF797FB30B81E246A2.TMP - d2fbb25e3e8f60fe0dff144cee71f8b75764cbfb127242c23c3108cc3a87a241
C:\Windows\resources\spoolsv.exe - 3e47931f82568ef842c209f547e4ad0814016a4c991252c125b12b49eaff4c9e
C:\Windows\resources\svchost.exe - 1afd2aaa00fd401e98981b59068b90ccf2696342938cb25385f210c6b3fc835e
C:\Windows\resources\Themes\explorer.exe - cc60fc26e2af5a1408e4111b5d82c96226a8e38a96bed6e39224bfef1c85387a
2d120b34bc200a16a7567a265b15c5337d03028ad7c12e2ee1998554798a7322 - 2d120b34bc200a16a7567a265b15c5337d03028ad7c12e2ee1998554798a7322

Embedded URLs

https://d.symcb.com/rpa0
http://s.symcb.com/universal-root.crl0
https://d.symcb.com/rpa0@
http://ts-crl.ws.symantec.com/sha256-tss-ca.crl0
http://ts-aia.ws.symantec.com/sha256-tss-ca.cer0
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

d.symcb.com
s.symcb.com
ts-crl.ws.symantec.com
ts-aia.ws.symantec.com
pki-crl.symauth.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.184.175.15
4.144.132.223
52.123.252.225
40.84.85.40
4.230.171.124
172.215.188.232
20.165.94.54
74.178.76.128
40.79.150.122
4.150.223.98
172.66.2.5
52.110.12.48
52.110.12.53
40.84.97.4
57.155.101.212
172.178.240.163
72.145.35.98
52.148.114.188
52.110.12.55
52.110.12.1

More Convagent samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report