MALICIOUS — a324ce2f374f485add3488a3c3bc5ac563ec65e5f54901f9971bcbba6b6d4a21

MALICIOUS — a324ce2f374f485add3488a3c3bc5ac563ec65e5f54901f9971bcbba6b6d4a21 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: a324ce2f374f485add3488a3c3bc5ac563ec65e5f54901f9971bcbba6b6d4a21
SHA-1: b898f06dc021431b8ba43be82bfc3c445b2bab9e
MD5: 14e5ba5befa3590a9f59091ec29742ec
imphash: c2a87fabf96470db507b2e6b43bd92eb
ssdeep: 6144:ZJJ/d38Nk/B/vn5/NBAMWfEC1c/vn5/NBA:ZJz38idnjCKn
TLSH: T19C43079591D32776FFBC9B1E616CFB9CCE96089B343252A1123264F5640A5A3F3600CE
Submitted as: a324ce2f374f485add3488a3c3bc5ac563ec65e5f54901f9971bcbba6b6d4a21
File type: pe · Size: 229376 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Berbew!pz
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2
Trellix Stinger (McAfee): Trojan-FUGH!14E5BA5BEFA3
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew!pz (rule Backdoor:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUGH!14E5BA5BEFA3 (rule Trojan-FUGH!14E5BA5BEFA3) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vjh (rule Trojan-Proxy.Win32.Qukart.vjh) - engine signal, weight 0.55, confidence 0.85
Contacted 5 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 18 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

613 behavior events · 1 ATT&CK techniques · 18 dropped files.

Dropped files

C:\Windows\System32\Lgjdaeem.dll - 0b00aca9cfb45f74fec27e26f1ae2c232864661b98bf66c00de9758786af25ed
C:\Windows\System32\Ghogjnfp.dll - 8475de5626e3a29ce7967cd5d92babe56b03ee8a124959ceb30a60c0e48e1f32
C:\Windows\System32\Phbibg32.dll - b8b78918bc7120b1eb6837f0be93706a64d13d1ffdb8523fb34e7b7bd9f28d36
C:\Windows\System32\Lajedl32.exe - 3bf8204a9532f05eae8fe7d4d051daeae26e098bba0fcfeb20ca9a6fcd5ed163
C:\Windows\System32\Ifdmeggb.dll - 6cc2a04fa7f524a70283d62f63038a31a1c89c7582985d6124aeda27eaf15e7f
C:\Windows\System32\Omhhgg32.dll - ddf1ca16c013fc3f4a0157188f10b86c7fc3ca884993ab675d010753bb6e7647
C:\Windows\System32\Qgdclfoc.dll - deb23fb9e336b7bf521cafa4a3eca6d3b550a7c4af6ec14b7dbd559cfee59108
C:\Windows\System32\Lbnkin32.exe - 97c6db50ec5d6229384867d436816f40452790c70d9e5da9bedea12fa96ac948
C:\Windows\System32\Fiinmkpf.dll - a5b0280de6eedfc8a8e3269d35dd565b70a722887c1bb7259435f7aa8e67d5b6
C:\Windows\System32\Jjbqfd32.exe - 1aa908f3753b491ca41481318f58eda06235984390fb1eab44037f368e664f1a
C:\Windows\System32\Bkbjkm32.dll - 1c74d927b91cb8124a008e6c3cfaee1e20155ddbfcc60551354077608e612521
C:\Windows\System32\Ikjnijnl.exe - 350e2662d51e4f90c3159053fd72590e3277c1d5ba1a60f809bd9497649e0c2d
C:\Windows\System32\Mkeoiodf.exe - 5734b4e87d70c6c343aeaa07009d7232f5d1962dcff97749635103ba4be052b0
C:\Windows\System32\Jaecbo32.exe - acf69945349db700371b33fbe70c78c4c863bf1629a25101c2bcb085ad73604a
C:\Windows\System32\Inbmkdee.exe - eb6b3b0fbfadf056d2e24d2dc55eed6769f1433baa954e99ec11f2ed970bcdd6

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

52.168.117.169
4.230.171.124
4.144.132.114
85.210.193.152
20.42.179.204
20.165.94.54
20.42.65.93
135.232.92.137
135.234.160.245
52.110.12.37
52.110.12.8

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report