MALICIOUS — 96101ae23d8cc71017bfca663ce9a446a0e9a3a0be1f5da07e7ac911f059ec56

MALICIOUS — 96101ae23d8cc71017bfca663ce9a446a0e9a3a0be1f5da07e7ac911f059ec56 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: 96101ae23d8cc71017bfca663ce9a446a0e9a3a0be1f5da07e7ac911f059ec56
SHA-1: c3b121816048df910d66200aa1d0f06aa63b9dd7
MD5: 57fefc9b6372dd2fee6a2999538e3ba8
imphash: c2a87fabf96470db507b2e6b43bd92eb
ssdeep: 768:TI4NHjbODl+B9nyJ0iowKKBiuSCDEHUjaXGelTUHKggl2oeAiNG/VSL//1H5DXd:Tfjbul+B9nyJZod3uSCTWgCtSFL
TLSH: T1F434391D989D66D6ED68D706A224B87DF36900422A736C2914069FD80C026E7AE17CFE
Submitted as: 96101ae23d8cc71017bfca663ce9a446a0e9a3a0be1f5da07e7ac911f059ec56
File type: pe · Size: 57344 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-28
Microsoft Defender: Backdoor:Win32/Berbew!pz
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2
Trellix Stinger (McAfee): Trojan-FUGH!57FEFC9B6372
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-28 (rule Win.Trojan.Crypted-28) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew!pz (rule Backdoor:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUGH!57FEFC9B6372 (rule Trojan-FUGH!57FEFC9B6372) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vjh (rule Trojan-Proxy.Win32.Qukart.vjh) - engine signal, weight 0.55, confidence 0.85
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 62 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

2013 behavior events · 1 ATT&CK techniques · 62 dropped files.

Dropped files

C:\Windows\System32\Aincdcmq.exe - 89fc6c5f2c0fa217f9cd63ac909723577c1c249e947faef24726e8e18dcd4d63
C:\Windows\System32\Gfgkknmn.dll - 08573ebe8318bad0a56c44204e43d6d0da0e11fd17800e3389b054d6ce7b7b52
C:\Windows\System32\Emeqcaop.dll - d94f5c31c7a64bb4585a1c0f11f2c1b389d4acc1f878344e88a8fe6fbd41028f
C:\Windows\System32\Cdkfii32.exe - a7a38804f11a4388fe84e43e54da11b3a3432004b68f66aea21ef04d07f481b0
C:\Windows\System32\Lgedfp32.dll - cead02b36138fa57d3cde68cbe880e743cc75e0d940f477b1b7fa72becc038f6
C:\Windows\System32\Hgikhp32.exe - f8d00b21249dd3081b2a37f55b9d4fb5071b11ad124585ddf7256dc3d15c0f70
C:\Windows\System32\Cfbadi32.dll - 393a4404cf432e6e569f397164778e8f6cc3252c9d91905f0fc08a1d6e4dd79d
C:\Windows\System32\Kkkohhbo.dll - 0943bc8fb303c890a1fddad02ef34f456fd8054c85507d6e921d6bf5399950da
C:\Windows\System32\Mkhffmga.dll - 5d6088c210e248d22a0e401ce8908fb22e26ed7afe65cf542027074edae7d96a
C:\Windows\System32\Enidna32.exe - a38fcfb5095615d2187eb4e2a4c8ded5049c4f2bc0e3444ce7a7a04e41b14cd4
C:\Windows\System32\Apbdnd32.dll - 624c41ac2740ec86648f7e72ae82e047c619067418f6e8f8c1d41ed5489169f8
C:\Windows\System32\Noenkgdn.exe - fe7bbd82299e1d447ed14f6afebb2ed88d62ae4488df3d94e3c5a04e29f24ac6
C:\Windows\System32\Bknhed32.exe - 223b176c17be0c696f32ff6bca712aa90b77e267b8a211ab0da704d88f242b0d
C:\Windows\System32\Khhenmjq.exe - 7abb1c115cf5f3e6edd11eb8906e32d64af5e6984fbff680c9357304a72dbffc
C:\Windows\System32\Oflepc32.dll - 86a8faa8c6ba8458f6b15c0eb02365f9b5429574976e3d33a8226b3b05e4242b

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

184.84.165.168
4.207.44.68
52.123.252.224
4.230.171.124
40.84.85.40
52.230.60.54
135.232.92.97
74.178.240.61
20.184.175.17
4.207.44.77
74.179.77.204
172.66.2.5
135.233.45.221
52.148.114.188
52.110.12.55
52.110.12.18

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report