MALICIOUS — crypto.dll

MALICIOUS — crypto.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the MmJfa4pdRVd family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 2a15f014791c6b546e5f79976face4fb78e7f1019bd75e1dbcbad198a64ed033
SHA-1: 9f4b492accd26cf4ddbaf72f4c2dea0b6592feee
MD5: 61b45d2346a67c98b590d2de1c3b7586
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 6144:Nh9wv1Uveh9wv1UT8qqN8umtyU4cV7n+y0/vY/5/P:Nh9wt4eh9wtDqq8uEhVDqYNP
TLSH: T19C42120279D6DCFEE9E7B0801C75EB2EB155EB6C1215A58026002F5E842E343B5ADEDC
Submitted as: crypto.dll
File type: pe · Size: 201728 bytes
Verdict: malicious (98/100) · Family: MmJfa4pdRVd

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.mmJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

315 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\lcss.exe - 9c0d1d7215f9bed8480a05e97a6b8bc1b346c82723ba4b7457b4d4416d28aa73
C:\Windows\System32\wlogon.dll - 3f733e2ea49b8de152a25bee5e793c996da418fb8f5b946067b0bab99f05f665
C:\Windows\System32\crypto.dll - c0a865232f68b53a1dcc3287409794f632284489454fa7272ad1ba2ec64490e0
C:\Windows\System32\net.cpl - 905a6084589f5d8fa5eff6ef6cb9d2d6bf8c5a17feb479f5410e81b9ca9245d3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787657783&P2=404&P3=2&P4=Oe47dEZ0gbn0Df%2bBSxCw3i0NlRaxD9cAHwqts4C7myIeuvq0NK0xIa1%2bRSny81lDPZTko3DnuVPDxm1AY856nA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

74.178.76.44
20.42.73.25
52.110.12.52
52.110.12.22
52.230.60.54
40.84.97.4
20.247.184.142
4.230.171.124
4.247.188.224
74.179.77.204
4.150.223.115
74.178.240.51
52.178.17.234
40.104.4.2
20.231.239.246
52.123.129.14
52.123.128.14
203.26.79.13
20.50.73.15
20.52.64.200
135.234.160.246
72.145.35.108
52.148.114.188
52.110.12.16
52.110.12.15

More MmJfa4pdRVd samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report