MALICIOUS — ffc48dea7fbd3a9fdb4cd6b5f4b3436f04c30fc7603d8bdfd7f27fe4c554ea75

MALICIOUS — ffc48dea7fbd3a9fdb4cd6b5f4b3436f04c30fc7603d8bdfd7f27fe4c554ea75 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Remcos family. 5 of 56 detection engines flagged it, exhibiting 7 ATT&CK techniques.

Identification

SHA-256: ffc48dea7fbd3a9fdb4cd6b5f4b3436f04c30fc7603d8bdfd7f27fe4c554ea75
SHA-1: 2cde9b61c3460d8947aa912b89a89a636653ac48
MD5: 7448a38f6b7f7af8495d4e1e017a803c
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 24576:AFAISgFOTFH4eDvClEdqA4kCv5Jr/4s0d:AsTFH4eDkEdqPdJz4x
TLSH: T17050BFCD14796759E2F17AB73094E3EDAD97AA8928F93EC105804C32315EB3F883541A
Submitted as: ffc48dea7fbd3a9fdb4cd6b5f4b3436f04c30fc7603d8bdfd7f27fe4c554ea75
File type: pe · Size: 803328 bytes
Verdict: malicious (100/100) · Family: Remcos

Detections (5 of 56 engines)

ClamAV (daily): Win.Dropper.Remcos-10026421-0
Microsoft Defender: Trojan:MSIL/AgentTesla.DLM!MTB
Emsisoft (Emergency Kit): Trojan.Agent
Trellix Stinger (McAfee): AgentTesla-FDFG!7448A38F6B7F
Kaspersky (KVRT): HEUR:Trojan-PSW.MSIL.Agensla.gen

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 13 weighted signals:

ClamAV (daily) flagged Win.Dropper.Remcos-10026421-0 (rule Win.Dropper.Remcos-10026421-0) - engine signal, weight 0.90, confidence 0.95
4 behavioral detection(s) across 4 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.69, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/AgentTesla.DLM!MTB (rule Trojan:MSIL/AgentTesla.DLM!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Trojan.Agent (rule Trojan.Agent) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged AgentTesla-FDFG!7448A38F6B7F (rule AgentTesla-FDFG!7448A38F6B7F) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan-PSW.MSIL.Agensla.gen (rule HEUR:Trojan-PSW.MSIL.Agensla.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 20 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1497, T1497.001, T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Extracted AgentTesla config (0 C2) - engine signal, weight 0.45, confidence 0.60
Embedded network infrastructure: http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView - static signal, weight 0.35, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

36382 behavior events · 3 ATT&CK techniques · 34 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_20nefhjm.qjp.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
C:\Windows\System32\Drivers\etc\hosts - 9b13a3ea948a1071a81787aac1930b89e30df22ce13f8ff751f31b5d83e79ffb
C:\Users\analyst\AppData\Local\Temp\tmpD8A8.tmp - e416d24e1bb852cffbd8863d71ad73110cfb3f271409d8804cf03a077c51cd70
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - 3920c723011f4bd712d78948932cd2c6ebd5882bf8df0447dcaf2d3ddbb3ec7b
e906dbba028976e28144ef3d4adcc819ad11aa40291d4a9ea022a14f0315a641 - e906dbba028976e28144ef3d4adcc819ad11aa40291d4a9ea022a14f0315a641
d20d0fe254ad9ce5876952fc25116bbda7b2657881833061dda0a6cbe16de653 - d20d0fe254ad9ce5876952fc25116bbda7b2657881833061dda0a6cbe16de653
004d7af4cd590b3038218dce13899c2bba1c67b4b07dbc82cba9f6f662077fbe - 004d7af4cd590b3038218dce13899c2bba1c67b4b07dbc82cba9f6f662077fbe
d3376c48bd05e45421da3ef59ceb6497c8212b3619f9650f0f707fbc31e60af0 - d3376c48bd05e45421da3ef59ceb6497c8212b3619f9650f0f707fbc31e60af0
844a17c64bf689d4933565d5b4608c7cd6ac5d8670346e695bc608f438d56e85 - 844a17c64bf689d4933565d5b4608c7cd6ac5d8670346e695bc608f438d56e85
947583c7edc04a9c57f2ef99ef6955698f3ea8e223b2ee36a2cea36fdb6ca504 - 947583c7edc04a9c57f2ef99ef6955698f3ea8e223b2ee36a2cea36fdb6ca504
e7a34a64f24ae577e76f22b27f7b31d78da0b9798a227e0ef0ea0bc8ff4fec84 - e7a34a64f24ae577e76f22b27f7b31d78da0b9798a227e0ef0ea0bc8ff4fec84
86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f - 86fe170cc6dd3a576807c1192a06ead68bf210f9ccd14f1a81d4f44c2dbcc25f
b7f0e49999283275efe0b2ee23912c5d41f3d3e27b86cc9d655cac40415f38ef - b7f0e49999283275efe0b2ee23912c5d41f3d3e27b86cc9d655cac40415f38ef
dfd00159cd9f2c9278494ad48f5dbc73982adf973f35de9938bd988c557f8551 - dfd00159cd9f2c9278494ad48f5dbc73982adf973f35de9938bd988c557f8551
28b1b6245edf54d433bde4a7948b4ee97d2b6c51b4384438e78ab2dd26196aef - 28b1b6245edf54d433bde4a7948b4ee97d2b6c51b4384438e78ab2dd26196aef

Embedded URLs

http://www.codeproject.com/Articles/16009/A-Much-Easier-to-Use-ListView
http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/
http://c.pki.goog/r/gsr1.crl
http://c.pki.goog/r/r4.crl

Embedded domains

www.codeproject.com
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

57.155.101.212
104.46.162.231
52.230.60.54
57.155.104.224
4.230.171.124
20.165.94.54
52.168.117.174
74.179.77.204
4.150.223.104
52.123.252.212
104.18.33.89
162.159.142.9
172.178.240.161
52.182.143.212
52.168.117.171
72.153.5.97
52.148.114.188
52.110.12.54
52.110.12.22

More Remcos samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report