MALICIOUS — 0d08fa0351b61841e8e776434578d3815e3b0ce2815450a4a81f2791d75d0255
MALICIOUS — 0d08fa0351b61841e8e776434578d3815e3b0ce2815450a4a81f2791d75d0255 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Crypted family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
0d08fa0351b61841e8e776434578d3815e3b0ce2815450a4a81f2791d75d0255 - SHA-1:
fd98f4c2ece6a1e4e3321b6af635655266322587 - MD5:
10e0a8186fba1f423d0392b62b96babc - imphash:
62ec3dce1eba1b68f6a4511bb09f8c2c - ssdeep:
768:oEIpohEZpuW/kOioMuJYKMmaP1s106X9aq9UUD6pRDop12p/1H5JXdnh:oEVh2u6TioMui5S06X9zUUD6plo12LR - TLSH:
T1B3344BA6AE191D87CFE0B20A4F29BCBFC3B155EF697505A04407F99910D239FB3041A8 - Submitted as: 0d08fa0351b61841e8e776434578d3815e3b0ce2815450a4a81f2791d75d0255
- File type: pe · Size: 56320 bytes
- Verdict: malicious (92/100) · Family: Crypted
Detections (5 of 55 engines)
- ClamAV (daily): Win.Trojan.Crypted-29
- Microsoft Defender: flagged
- Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035
- Trellix Stinger (McAfee): Trojan-FUGH!10E0A8186FBA
- Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vih
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Crypted-29 (rule
Win.Trojan.Crypted-29) - engine signal, weight 0.90, confidence 0.95 - Contacted 26 external host(s) at runtime (24 HTTP) - network signal, weight 0.40, confidence 0.80
- Dropped 96 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
3057 behavior events · 1 ATT&CK techniques · 96 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- settings-win.data.microsoft.com
Dropped files
- C:\Windows\System32\Cnbdgell.dll -
b27c7182e3b8c6ceaccdf49ab5fd167910a9fba40926050b35b01cec9748738d - C:\Windows\System32\Pojnkb32.dll -
bb8f26743b7a6a3ddfb1269e5af0fa829e50a6884d0cd7de449c9aef2bec97c4 - C:\Windows\System32\Idipgfpm.dll -
10c056f875319153750fa0ea21e1bf113b9e09a19a5d5aea572bc2c5d8daa319 - C:\Windows\System32\Hfjehcoi.exe -
c781362caea8764c080c574b8c9ee5b04e6afb835ea38eeb9c511b877e835e2b - C:\Windows\System32\Enhmckmd.exe -
4e96dcf70a575ec0b948bcb1aebaf842c17391a634c4a921117d803a61a28d23 - C:\Windows\System32\Fhhfpllc.exe -
db415fead1e4493f0539fe9bb11c9584c6306bdb08c333ccc7156ab017275311 - C:\Windows\System32\Ljfjij32.dll -
35874267dd8fc3cebeb2e3cadfb80f283b5d1184b5e71ed98ad8c12c31de532e - C:\Windows\System32\Ieacoo32.exe -
5f5a21bb19068ed39b46695f970fa81debecae1605212cd6600d83886cd8a559 - C:\Windows\System32\Pnjlkf32.exe -
3fb533be09e0c4caa6e6c8f04656dc4b3c915161bfedd4c4aca2c6ff0a275d3f - C:\Windows\System32\Johlab32.dll -
dc3f10b160158d264fdc084ea2dc86c075190bd6942edbe0e374db566886c053 - C:\Windows\System32\Aknlheni.dll -
85d67e20e7482a6958bb32687654de9694a23f1b0f85140822d53392bb3f6e29 - C:\Windows\System32\Jgfanmgd.dll -
1cb2836fe774b29229a23a49b238d1235c5f0d5e74a71630b559ef9b2aa52248 - C:\Windows\System32\Jhmmfm32.dll -
81be108aeb51956d201e645739d36c11f0ce419021deda3b417843c093684830 - C:\Windows\System32\Kmabcj32.dll -
13eca34bf429ebb2becb040a048fd784dd73e3ae897054d79ff12c9e515e6bd1 - C:\Windows\System32\Jpeokc32.dll -
7ecf72e0a0fe9066e35b0e631c4b2bc1bd21b1ed2051c3eed3cba6b3396a84c4
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787863273&P2=404&P3=2&P4=BW%2fTRoTd4G62E8lEuPhma67Kt9r0GrvF6TncsV%2bBQFq28xdVsMtC6ylfDqpOg1nHxyWa5bRie8Yrr8WKLVIPwQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787863362&P2=404&P3=2&P4=DwEV%2fDwPzTiUwh%2b1KiXX%2bILfzMYq0t08TieSUeVh8heJC86MmXeLTpfbonzK1aKRAgj4Lw6Lv7pSd3vOhkGIew%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 20.42.73.26
- 172.215.188.232
- 4.230.171.124
- 20.247.184.197
- 40.84.85.40
- 74.178.240.61
- 74.179.77.164
- 52.168.117.169
- 135.233.95.144
- 52.123.128.14
- 20.112.250.133
- 52.123.129.14
- 40.99.133.226
- 4.150.223.108
- 135.234.160.245
- 52.123.252.246
- 203.26.79.13
- 52.148.114.188
- 135.233.95.80
- 72.153.5.137
- 52.178.17.2
- 20.50.201.201
- 92.223.78.30
- 135.233.45.223
- 52.110.12.24
More Crypted samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report