MALICIOUS — KeePass.exe

MALICIOUS — KeePass.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (95/100), attributed to the Container family. 3 of 55 detection engines flagged it, exhibiting 5 ATT&CK techniques.

Identification

• SHA-256: 04d29636c393f0c1fc99ff739295494be3adefded93271e44591e8e300225a5a
• SHA-1: 3ab3f51c3b3fc108cd699f6fdc5d096660242236
• MD5: 10bb342f422e71c6e4feb1a7183c0ce4
• imphash: f34d5f2d4577ed6d9ceec516c1f5a744
• ssdeep: 49152:KyI2mQa0ESfRqbsi+oRzyNKNyL4fAGoOlq1xttujlS6RsO+:wQlqbsoNA/ujlS6uf
• TLSH: T13B5FAEDD4D8C3B05E9F6C6A21445E7EE0E117C916DB0BCCC4B81A4F2718927B983626E
• Submitted as: KeePass.exe
• File type: pe · Size: 3265880 bytes
• Verdict: malicious (95/100) · Family: Container

Detections (3 of 55 engines)

• YARA: MalwareAnalyser built-in: Suspicious_PowerShell_Download_Exec
• capa (capabilities): capability:execution/powershell
• YARA: delivr.to detections: DLV_ISO_IMG_Container_Lure

MITRE ATT&CK

• T1059.001
• T1547.001
• T1486
• T1057
• T1056.001

YARA

• Suspicious_PowerShell_Download_Exec

Why this verdict

The malicious score of 95/100 is the fusion of 10 weighted signals:

• Encoded/hidden PowerShell download-and-exec (rule Suspicious_PowerShell_Download_Exec) - yara signal, weight 0.70, confidence 0.90
• YARA: delivr.to detections flagged DLV_ISO_IMG_Container_Lure (rule DLV_ISO_IMG_Container_Lure) - engine signal, weight 0.55, confidence 0.70
• execute via PowerShell (rule execute via PowerShell) - capa signal, weight 0.40, confidence 0.80
• capture keystrokes (rule capture keystrokes) - capa signal, weight 0.40, confidence 0.80
• YARA: MalwareAnalyser built-in flagged Suspicious_PowerShell_Download_Exec (rule Suspicious_PowerShell_Download_Exec) - engine signal, weight 0.35, confidence 0.70
• capa (capabilities) flagged capability:execution/powershell (rule capability:execution/powershell) - engine signal, weight 0.35, confidence 0.70
• persist via registry run key (rule persist via registry run key) - capa signal, weight 0.35, confidence 0.60
• Embedded network infrastructure: https://keepass.info/help/base/autotype.html#req, http://repository.certum.pl/ccsca2021.cer0, https://www.certum.pl/CPS0 - static signal, weight 0.35, confidence 0.60
• enumerate processes (rule enumerate processes) - capa signal, weight 0.20, confidence 0.60
• encrypt data (rule encrypt data) - capa signal, weight 0.15, confidence 0.60

Dynamic analysis

No runtime behaviour was captured for this sample, so the analysis above is static only. That is a limit of this run rather than evidence the sample does nothing.

Embedded URLs

• https://keepass.info/help/base/autotype.html#req
• http://schemas.microsoft.com/SMI/2024/WindowsSettings
• http://ccsca2021.crl.certum.pl/ccsca2021.crl0s
• http://repository.certum.pl/ccsca2021.cer0
• https://www.certum.pl/CPS0
• http://crl.certum.pl/ctnca2.crl0l
• http://repository.certum.pl/ctnca2.cer09
• http://www.certum.pl/CPS0
• https://keepass.info/
• http://subca.repository.certum.pl/ctsca2021.cer0
• http://subca.crl.certum.pl/ctsca2021.crl0
• http://crl.certum.pl/ctnca.crl0k
• http://repository.certum.pl/ctnca.cer09
• https://msdn.microsoft.com/en-us/library/8kb3ddd4.aspx
• https://www.dominik-reichl.de/

Embedded domains

• keepass.info
• schemas.microsoft.com
• ccsca2021.crl.certum.pl
• repository.certum.pl
• www.certum.pl
• crl.certum.pl
• subca.repository.certum.pl
• subca.crl.certum.pl
• msdn.microsoft.com
• www.dominik-reichl.de

Registry keys

• HKEY_CLASSES_ROOT\microsoft-edge
• HKEY_CURRENT_USER\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
• HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Clients\StartMenuInternet\IEXPLORE.EXE\shell\open\command
• HKEY_CLASSES_ROOT\IE.AssocFile.HTM\shell\open\command
• HKEY_CLASSES_ROOT\Applications\iexplore.exe\shell\open\command
• HKEY_LOCAL_MACHINE\SOFTWARE\Mozilla\Mozilla
• HKEY_CURRENT_USER\SOFTWARE\Clients\StartMenuInternet\OperaStable\shell\open\command
• HKEY_CURRENT_USER\SOFTWARE\Clients\StartMenuInternet\Opera\shell\open\command
• HKEY_LOCAL_MACHINE\SOFTWARE\Clients\StartMenuInternet\Microsoft
• HKEY_CLASSES_ROOT\htmlfile\shell\print\command
• HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run
• HKEY_CURRENT_USER\AppEvents\Schemes\Apps\.Default\WindowsUAC\.Current

File paths

• D:\Dev_A\KeePass_2x\KeePass\obj\Release\KeePass.pdb

More Container samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report