MALICIOUS — 31e6aa25f85d6ab3458be6fd2976df79b85a34a3a32284ce6b5e743f1f593874

MALICIOUS — 31e6aa25f85d6ab3458be6fd2976df79b85a34a3a32284ce6b5e743f1f593874 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 31e6aa25f85d6ab3458be6fd2976df79b85a34a3a32284ce6b5e743f1f593874
SHA-1: d064ec4f74dafff38e579bf2843a6b6b42790030
MD5: 75ce7d6cfc46238b2a2b637841f4b292
imphash: 62ec3dce1eba1b68f6a4511bb09f8c2c
ssdeep: 768:Ejv3ohqSccWqIzudltgIKIIDUq4nWqQwS5QL3b/H4ueQe2p/1H5sXdnh:EjUqS6udfg0TWqRZ4upe2LE
TLSH: T1B1341852F60DABC2CDFAFB5984ACBDAEB79F12ACE4310126C1D9244191868C3EF4055C
Submitted as: 31e6aa25f85d6ab3458be6fd2976df79b85a34a3a32284ce6b5e743f1f593874
File type: pe · Size: 56320 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-28
Microsoft Defender: Backdoor:Win32/Berbew.AA!MTB
Emsisoft (Emergency Kit): Generic.Dacic.1.Backdoor.Hangup.A.A9F9521C
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vih

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-28 (rule Win.Trojan.Crypted-28) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew.AA!MTB (rule Backdoor:Win32/Berbew.AA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.1.Backdoor.Hangup.A.A9F9521C (rule Generic.Dacic.1.Backdoor.Hangup.A.A9F9521C) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vih (rule Trojan-Proxy.Win32.Qukart.vih) - engine signal, weight 0.55, confidence 0.85
Contacted 2 external host(s) and 16 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 90 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2982 behavior events · 1 ATT&CK techniques · 90 dropped files.

Dropped files

C:\Windows\System32\Lneeomji.exe - b1a06ee80bec201d3563fcfe71b1f6e3e5017935a247a11713ad64094bbb50a9
C:\Windows\System32\Bffdfd32.dll - 2276fce0dc27247844b1e900a76331d0e15755057a932cb83336583db1bf4a24
C:\Windows\System32\Kbcjfb32.dll - faaa514ca72bc2c100c526d3e33ffe33327a9c217bb4cd3c2b80ae6a483710cd
C:\Windows\System32\Lgdfnlha.dll - f9df185f3965b55d0c52c9f20f4f5655cb4343bbcb655d88e29a220f21159b39
C:\Windows\System32\Kpglbh32.exe - 100901c1bfcb9f4ef4f23a6d1419ca116eecd53715fd6400049fb9ea4bbfba9c
C:\Windows\System32\Ngaflm32.exe - 8cb9add16cf1dacde6d8ecdab35b83fd1e818d7c3eb6a7d4de42dc5cfdbbbf5a
C:\Windows\System32\Hfebfl32.exe - 9b42cff67f3982de953035231c1781bf9abd1243a306ee1ae52a840204665f5b
C:\Windows\System32\Qhqaakdo.exe - 2391989066ed61c4fa9348278b09829374d410e4dd27b0746a3a9ffa57816ee5
C:\Windows\System32\Kqkfqp32.dll - 28e438b9cddb21cd642997bfe47427a66b34a494495c50ffc9c02bb963fb5ef5
C:\Windows\System32\Kglifnkq.exe - d0511ac2e0f238b4841d5b9c1ebf2125eb53a2eef7255cbdcfa660175d1af947
C:\Windows\System32\Indcaafn.exe - 5ebe9d886a894a0db56d6e5c49f794d248151a09e39f503d65185362db893c8d
C:\Windows\System32\Miohge32.dll - 102e0b0ee09e0f7a96f0d398d5be321a72f2c0d32d12cae9ffaa7aa97a3f4d69
C:\Windows\System32\Phjkaljg.exe - e76cc4446e7aaa7e3470681b5b7c3b6b573e28f3a548cf35ee623f659e12d704
C:\Windows\System32\Jbglmelk.exe - b2f54fd5638b8f2a0a8224649d6aea928accdcf6a446b4efe9ac8cd590b88409
C:\Windows\System32\Hgcdch32.exe - 05f35d22ea5b7de0f379f643dc98d76c8093b4c88c30376343f8784ebee23de8

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/ea98f53a-04cb-4f17-b9d9-db88a4e098c7?P1=1785377842&P2=404&P3=2&P4=l1E6ID%2bdP67CJpKOjU%2fX%2fGF9WXhFVyGpnE3i5Cg1PBeyqvAXwFOIHh5%2fQdq0yf4r1ZEEidf68dZXH8WxKtak%2fA%3d%3d&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.89
4.230.171.124
74.178.240.51
57.155.101.212
20.165.94.63
40.79.141.155
4.155.95.248
4.150.223.110
4.209.250.170
4.207.44.73
13.89.179.15
34.104.35.123
203.26.79.13
4.150.223.107
20.50.201.203
135.234.160.244
52.148.114.188
92.223.78.30
52.110.12.30
52.110.12.33
72.145.35.107

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report