MALICIOUS — 8ff76df4db6a29e1ab5e6a92c1f7e5032798cf80321539aae8ac6aee69dbe0b2

MALICIOUS — 8ff76df4db6a29e1ab5e6a92c1f7e5032798cf80321539aae8ac6aee69dbe0b2 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 8ff76df4db6a29e1ab5e6a92c1f7e5032798cf80321539aae8ac6aee69dbe0b2
SHA-1: 38f914ee8f750950664e6541c6dbfb4db262b3d5
MD5: de2240785192a108be21f8a5f4a4c5a6
imphash: 95e6f8741083e0c7d9a63d45e2472360
ssdeep: 3072:OrtbYHcErBLo/m6j5n2OMhbsx+8hxAT493NLWXyGfaOFZJfaOABAHsx+8hxAT49:OZbYHc6BLo/m6j5nAhbVWkm3NWbgFaH
TLSH: T1E441F403D44D1FABF89CAA6B0A6954ED1652AFC3546037637149728EBF087CB1817E0E
Submitted as: 8ff76df4db6a29e1ab5e6a92c1f7e5032798cf80321539aae8ac6aee69dbe0b2
File type: pe · Size: 186368 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Berbew!pz
Emsisoft (Emergency Kit): GenPack:Backdoor.Hangup.B
Kaspersky (KVRT): Trojan-Spy.Win32.Qukart.af

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew!pz (rule Backdoor:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Backdoor.Hangup.B (rule GenPack:Backdoor.Hangup.B) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Spy.Win32.Qukart.af (rule Trojan-Spy.Win32.Qukart.af) - engine signal, weight 0.55, confidence 0.85
Contacted 18 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 104 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

3335 behavior events · 1 ATT&CK techniques · 104 dropped files.

Dropped files

C:\Windows\System32\Hneigdbk.dll - b16414f3ae576f9374f71c0a53671ec6dd90357cf2e22c2c0bfb2daabe357be2
C:\Windows\System32\Lgelailn.exe - c65abb290de823cdcb3a3650c5191958cdabfe1894f354a8d92859b82f6bdb69
C:\Windows\System32\Gmgfbd32.exe - b5dd8b0c958a7ff8ac58d4327480b39c8023ee64f0a3c6ab028defdb38edf8ed
C:\Windows\System32\Pfdgli32.exe - b41adc701662bb80679802d868f28e9de4f843058222fe6f58c950500bb919d5
C:\Windows\System32\Oiacgabe.exe - dd81a5fe4afb815f645a6abc87ea7a51bc826719a50ad075f056a397bfd1d80b
C:\Windows\System32\Ddqagigp.dll - be0a50778dfaccd485a1bfc48431bbc446ea149b1d19d953cbdfb6539d4cea73
C:\Windows\System32\Odfbam32.dll - 7949918b70c8ac639e6acfd77dc1fbfebc88ceab61bc8c42d1d13399652775c6
C:\Windows\System32\Abddqbjn.dll - a0a39cea41cbb054818c369a7fe01c152cb790b3c58161dd8e1cfdd4c94d299f
C:\Windows\System32\Jjgpkica.exe - 5442952b1840e011dbe406f6a57bd36b82e012f6b5595eb009c1d880b7fe9aef
C:\Windows\System32\Hegfdqeo.dll - 1107bb606e101c75b91cd6edab4d0c5f25e184319a437750e004c346ec2a3963
C:\Windows\System32\Aljlohag.dll - 5737fb99762e02fadd83a70cd7d70d02104b3b1bf841f19474ad2a49f6879105
C:\Windows\System32\Ihajflaf.dll - 15a7c4a4e028d9c07d7dc4709c8716d67b86d966f4bfb40641f14c5b05b4614d
C:\Windows\System32\Dneamiha.exe - 117c685f9430923c1d65a1a6d8d559d3edc8fca03753457a55600667054ab2ef
C:\Windows\System32\Hplennmm.dll - d64fcf0573cfc4de6087b5751279eb501872fa9cb43d19c5ab2fa744fe294126
C:\Windows\System32\Objojmla.exe - 373192f98042ac35f6e42a257f7cd4966afff7c73802c0024a8ee66e812299fd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.90
4.230.171.124
85.210.193.152
135.232.92.97
20.42.65.93
20.247.184.142
74.178.76.128
52.168.117.174
172.64.154.167
4.247.188.233
74.178.240.61
52.148.114.188
135.234.160.244
72.145.35.96
52.110.12.11
52.110.12.25

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report