MALICIOUS — 4de632685fc4877a0ae9b8ef19bb9b749d0de6567b56c7e12aaeaea4ae51dbc5

MALICIOUS — 4de632685fc4877a0ae9b8ef19bb9b749d0de6567b56c7e12aaeaea4ae51dbc5 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Cridex family. 6 of 56 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 4de632685fc4877a0ae9b8ef19bb9b749d0de6567b56c7e12aaeaea4ae51dbc5
SHA-1: f8899704c548e761615109858078f122bc90b165
MD5: 760d2dd57a612773af8c286e5817350e
imphash: 223518c3d747bfabcfaf5eade50a3ad1
ssdeep: 12288:53ztU+hNwEyMrHXeB9ZG9xdzN/w288SLeO1LsSk:5DtRD3eHZmdZ/w28hH1LsSk
TLSH: T1185223A0A1EBCB01DFFC9AC1C96C299D11AFF02175F04DBA9387EB6580494B7518F990
Submitted as: 4de632685fc4877a0ae9b8ef19bb9b749d0de6567b56c7e12aaeaea4ae51dbc5
File type: pe · Size: 954368 bytes
Verdict: malicious (99/100) · Family: Cridex

Detections (6 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:.exp,.qdata
ClamAV (daily): Win.Dropper.Cridex-9919301-0
Microsoft Defender: Trojan:Win32/Ursnif.RW!MSR
Emsisoft (Emergency Kit): Gen:Variant.Ulise.90307
Trellix Stinger (McAfee): Drixed-FIW!760D2DD57A61
Kaspersky (KVRT): HEUR:Trojan.Win64.Injexa.pef

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 7 weighted signals:

ClamAV (daily) flagged Win.Dropper.Cridex-9919301-0 (rule Win.Dropper.Cridex-9919301-0) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Trojan:Win32/Ursnif.RW!MSR (rule Trojan:Win32/Ursnif.RW!MSR) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Ulise.90307 (rule Gen:Variant.Ulise.90307) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Drixed-FIW!760D2DD57A61 (rule Drixed-FIW!760D2DD57A61) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.Win64.Injexa.pef (rule HEUR:Trojan.Win64.Injexa.pef) - engine signal, weight 0.55, confidence 0.85
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:.exp,.qdata (rule high-entropy-sections:.exp,.qdata) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:.exp,.qdata - static signal, weight 0.25, confidence 0.55

Dynamic analysis (windows)

90113 behavior events · 2 ATT&CK techniques · 12 dropped files.

Dropped files

C:\Users\tladmin\AppData\Roaming\Microsoft\HcjKV\msra.exe - 9a942ba87d18adea66a2736ef59d7c03a4401a6b06b32cf3ad19a0fa56fb4698
C:\Users\analyst\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Bawueewphlsqwy.lnk - 03849fadc1e349433134e7ede6e972228ff7599a460067f16caef478026e19f8
C:\Users\tladmin\AppData\Roaming\Microsoft\HcjKV\NDFAPI.DLL - b667d8b3a0effda31f093ec1e06143acce4ef12037b15625607283bc1b9996bc
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000023.db - 64f98f444802b69a1e8cce014e240eea428c980f78076f24837972838347ca61
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000024.db - bd46052ae42f9e8976b2d5738127db4fc04a1b59bfe99c2acfd74de51355646f
C:\Users\analyst\AppData\Roaming\ofE2YTb\dccw.exe - ae4c49c6199006552a64c3fc3312acd9d0184297b80f2cce71c2576509840bc1
C:\Users\analyst\AppData\Local\Microsoft\Windows\Caches\cversions.3.db - 9813cd88b46107c4dc38d1a8786afe1f1ce06795774f2b72ce7647b444134b63
C:\Users\analyst\AppData\Local\Temp\xml_file (9).xml:StreamedFileState - cb5b57bdf44d7822bd72a985be3d6b535884dd4419d53b9efeb09a22a9694c43
f7d7fd9c546e2145057ce4ac46e92aa1c490ba458d44762a8bf7dff8c529dc5a - f7d7fd9c546e2145057ce4ac46e92aa1c490ba458d44762a8bf7dff8c529dc5a
1b76eddf51c8e1219616a2a9ac583c670e91a434cd291bcb9c4cec7c920f1bb4 - 1b76eddf51c8e1219616a2a9ac583c670e91a434cd291bcb9c4cec7c920f1bb4
3401f6785fc0e0dc4e2eaa532a559f49c5657022a929d17d82f38ea6e1ff1f12 - 3401f6785fc0e0dc4e2eaa532a559f49c5657022a929d17d82f38ea6e1ff1f12
97c4ea5d730c83b76e19e86653c17b687d97ef7d06bff43e155163e5e28d73a3 - 97c4ea5d730c83b76e19e86653c17b687d97ef7d06bff43e155163e5e28d73a3

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.28
4.230.171.124
48.211.4.16
135.232.92.97
40.84.85.40
20.165.94.63
4.150.223.96
104.208.16.94
20.247.184.197
104.18.33.89
172.66.2.5
52.110.12.4
52.110.12.46
52.148.114.188
92.223.78.30
72.145.35.111
52.110.12.37
52.110.12.10

More Cridex samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report