MALICIOUS — 66dedc25ff584e9cd978098ee736a7c9766cc2aaf89fad4dd988e571332de6f3

MALICIOUS — 66dedc25ff584e9cd978098ee736a7c9766cc2aaf89fad4dd988e571332de6f3 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the FormBook family. 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 66dedc25ff584e9cd978098ee736a7c9766cc2aaf89fad4dd988e571332de6f3
SHA-1: 883839ec0056b5d40e747abe0e475effb809b9a6
MD5: a6ce27cf1965bbc8bc095630d74ebe8f
imphash: f34d5f2d4577ed6d9ceec516c1f5a744
ssdeep: 6144:i+tnLRNCTsV195YpJ0wblGdxoMQ/xo8gKX41kM1HZbt:i+tnbKs95Y04MQ/xoHKX41kKb
TLSH: T14942ADAB773E13D2D68B730A908744DCBF43F90750F46B26631988ACE115A277478EA4
Submitted as: 66dedc25ff584e9cd978098ee736a7c9766cc2aaf89fad4dd988e571332de6f3
File type: pe · Size: 207360 bytes
Verdict: malicious (99/100) · Family: FormBook

Detections (4 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): high-entropy-sections:)=2D[gq
Microsoft Defender: Trojan:MSIL/FormBook.CD!MTB
Emsisoft (Emergency Kit): Gen:Variant.Cerbu.120511
Kaspersky (KVRT): HEUR:Trojan.MSIL.Crypt.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

4 behavioral detection(s) across 4 rule(s): Credential Access: browser credential store read [high] (rule tl-browser-credential-access) - dynamic signal, weight 0.69, confidence 0.90
Microsoft Defender flagged Trojan:MSIL/FormBook.CD!MTB (rule Trojan:MSIL/FormBook.CD!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Variant.Cerbu.120511 (rule Gen:Variant.Cerbu.120511) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Trojan.MSIL.Crypt.gen (rule HEUR:Trojan.MSIL.Crypt.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
MalwareAnalyser heuristics (entropy/packer) flagged high-entropy-sections:)=2D[gq (rule high-entropy-sections:)=2D[gq) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: high-entropy-sections:)=2D[gq - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 3 finding(s) elsewhere in the guest, not attributed to this sample, e.g. process hidden from a listing (rule windows.psxview.PsXView) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

10356 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\tmp68CA.tmp - db847059438fc99787538cf38d4ca304486dd5ef971436f2bb66420cd234a49e
C:\Users\analyst\AppData\Local\Temp\tmp6909.tmp - edde18788bce33cccf3fe018ba511df02ad2d1b40140d98991d3f844c07c8662
C:\Users\analyst\AppData\Local\Temp\tmp666D.tmp - 6ca92dac93a93516d9f87871b08dbc88d651ad36c05964afc5941127a2397d69
f4ee6e9eca9aa9bccc48aad0be398fb56d966e42b53b24cf227166d0375e77ef - f4ee6e9eca9aa9bccc48aad0be398fb56d966e42b53b24cf227166d0375e77ef
55f53802273ccba2863fbac704259246bfc401a55deaa235a2860250c1320543 - 55f53802273ccba2863fbac704259246bfc401a55deaa235a2860250c1320543
64df908311b76f5fd65f15ce1628776a2e708c0640cd651a09ae896afb11fdc1 - 64df908311b76f5fd65f15ce1628776a2e708c0640cd651a09ae896afb11fdc1

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

glitterandsparkle.net
x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

52.168.117.174
172.215.188.225
20.247.184.142
74.179.77.204
135.233.95.135
4.150.223.107
4.230.171.124
52.123.252.233
172.66.2.5
72.154.7.96
52.148.114.188
52.110.12.16
52.110.12.46

More FormBook samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report