MALICIOUS — 5cdf3bcf64a0867a780e82629e515f85e7255849029e3c61fd4dd2ebeef3e0ba
MALICIOUS — 5cdf3bcf64a0867a780e82629e515f85e7255849029e3c61fd4dd2ebeef3e0ba is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Crypted family. 4 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
5cdf3bcf64a0867a780e82629e515f85e7255849029e3c61fd4dd2ebeef3e0ba - SHA-1:
0bd44e63c76f88d7ff55f113d43906edf380884b - MD5:
82c1fb8e8545c4bb13c80fde3dc8d2ec - imphash:
a64e048b98d051ae6e6b6334f77c95d3 - ssdeep:
1536:VR1nGN19hjHZosAuoPVg39lzBqlDsxiWP0NehSkltPJL3tu7zrZrTw8AzB:zFGj9hiu339XqIxiW8NuJL3g7fZrTy - TLSH:
T1963B4927B304B7E2FD65785B1778AB9C35386050FEA0A53AE17494AA4DC450FEC1223D - Submitted as: 5cdf3bcf64a0867a780e82629e515f85e7255849029e3c61fd4dd2ebeef3e0ba
- File type: pe · Size: 105472 bytes
- Verdict: malicious (92/100) · Family: Crypted
Detections (4 of 55 engines)
- ClamAV (daily): Win.Trojan.Crypted-29
- Microsoft Defender: Backdoor:Win32/Berbew!pz
- Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.0305F788
- Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Crypted-29 (rule
Win.Trojan.Crypted-29) - engine signal, weight 0.90, confidence 0.95 - Contacted 29 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
- Dropped 96 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
3041 behavior events · 1 ATT&CK techniques · 96 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
- officeclient.microsoft.com
Dropped files
- C:\Windows\System32\Bndppm32.exe -
50c6bd3f89563b209c7e23b841c91ddc266e1b479eadd6915eabb9dbc125e0cb - C:\Windows\System32\Dnmdbckm.exe -
23853d8d093d726835b104b09f19529a7e0cbbc240b9b3d872c9451f532d0bea - C:\Windows\System32\Kgbfellc.exe -
f2747da5c17192f153ef3e5eff83a77ac7e21ee0319ffb90e9a7cc59c6ed36dc - C:\Windows\System32\Ebfncmpq.exe -
b9d366337c5722f634e1d4112ce6ec621f7723f6216f5f4850df05cdd89f3512 - C:\Windows\System32\Mglfoo32.dll -
278eabf28e09dd14968052398f52f8daa3f5c33d716d43295e7d1d2583d20539 - C:\Windows\System32\Opnocakk.exe -
5adf2bb5f9af524da6de351706021d8906be59e76aad9e859d38ca764e61bf50 - C:\Windows\System32\Jfkmpd32.exe -
6253402ff0546f71741360c2d7d6aec00f39b9000d1815888dd37dee8334c8a5 - C:\Windows\System32\Onibdh32.exe -
ad011bf86184fa0bf122cb2088311401d5cfea1acb319d36a5fa93c544570154 - C:\Windows\System32\Lhgcmjob.dll -
ff33d0b370519d86754fb48ab4a0c33174af40fb7ec002a5eaa9bf889953b9ad - C:\Windows\System32\Eanmlblj.dll -
ef2f984c7fcd8aba82e1b850447e3bc0e3bd7b52379103e300c0db2415c56f58 - C:\Windows\System32\Mmmkbhbc.dll -
36092af922e13a48203e9c8b76d26966140e0d5216364216459b99532fb8c7a0 - C:\Windows\System32\Plncoq32.exe -
7bca5a37f1436f009ff8f6f37ffa6065d48042a4319977c8dd250d241c4769ba - C:\Windows\System32\Lefpmjgm.dll -
05bde1cfdd0062bc0adfedcbbcfc50b9543577b956a777a684dd554a7dbb2e63 - C:\Windows\System32\Bnbicf32.exe -
fd0c2a892ebafc491cee455dc61d8883ba28b41c145bc1b507470fbe1a15a39c - C:\Windows\System32\Pqkgnj32.dll -
b3b1555a280bb2527fda3c08876c0918e04f8157eb23b5be8cea3937d803665c
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787805245&P2=404&P3=2&P4=fjQNNmtF1MxfaMrVyuPJ8Z%2bL6QQFyOLiqgCMDl7BOBCN3wNftwCUEeL%2bljctgM651%2fYA%2bU14gfc8LlxkmWHPmw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787805338&P2=404&P3=2&P4=KajL70KksE6iuuhmpMMSxF%2bIb3dZi0uRLTwKjnSqAYZqhXCBhtQYK4kFkcNEiLalj1VSQFc8rSltA9t8uogjjQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded domains
- l.tv
Embedded IP addresses
- 20.184.175.22
- 4.247.188.233
- 4.230.171.124
- 20.247.184.142
- 135.233.95.144
- 135.233.95.135
- 52.110.12.38
- 52.110.12.2
- 20.52.64.201
- 52.123.128.14
- 20.112.250.133
- 40.99.134.2
- 172.215.188.232
- 135.233.45.223
- 4.150.223.112
- 52.168.117.174
- 52.123.252.203
- 203.26.79.13
- 52.148.114.188
- 125.56.205.106
- 125.56.205.32
- 52.123.252.231
- 20.165.94.46
- 52.123.252.238
- 52.123.252.242
More Crypted samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report