MALICIOUS — c408a5f8fb1f3bf147ac9459dbe7a8c8a39ee94d7eb2e9821a0ea6744713ec72

MALICIOUS — c408a5f8fb1f3bf147ac9459dbe7a8c8a39ee94d7eb2e9821a0ea6744713ec72 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the FE7919C8 family. 4 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: c408a5f8fb1f3bf147ac9459dbe7a8c8a39ee94d7eb2e9821a0ea6744713ec72
SHA-1: 6ba4092dd6063929ac239bb0f8d6962d7a001be1
MD5: 1df031d5d56bf8066127d2d9e7e1e1b3
imphash: a64e048b98d051ae6e6b6334f77c95d3
ssdeep: 1536:QwlFIeZVL41HnC/s0ziIxY5IEQouq435Qn7szB:5rxZVbs0ziIxYnQouqJK
TLSH: T1D5347D9A6C68BFB5FE735294CB3AA95F9705A7F26474A11001DA0845203F00B7E3327D
Submitted as: c408a5f8fb1f3bf147ac9459dbe7a8c8a39ee94d7eb2e9821a0ea6744713ec72
File type: pe · Size: 52736 bytes
Verdict: malicious (99/100) · Family: FE7919C8

Detections (4 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Berbew!pz
Emsisoft (Emergency Kit): Generic.Dacic.1.Backdoor.Hangup.A.FE7919C8
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew!pz (rule Backdoor:Win32/Berbew!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Generic.Dacic.1.Backdoor.Hangup.A.FE7919C8 (rule Generic.Dacic.1.Backdoor.Hangup.A.FE7919C8) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vjh (rule Trojan-Proxy.Win32.Qukart.vjh) - engine signal, weight 0.55, confidence 0.85
Contacted 3 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 26 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Memory forensics: 2 finding(s) elsewhere in the guest, not attributed to this sample, e.g. SSDT hook (rule windows.ssdt.SSDT) - memory signal, weight 0.05, confidence 0.30

Dynamic analysis (windows)

885 behavior events · 1 ATT&CK techniques · 26 dropped files.

Dropped files

C:\Windows\System32\Ojailbcj.dll - 98ff60cb39c4e00697f80ee22097f0805588e3d75bdeafb89451142a43b973af
C:\Windows\System32\Ncqeei32.dll - 8e85d11b8de33a7ef6f08e72b787504fb610a9445f019fce7c9ab3cae42de2e2
C:\Windows\System32\Ijddefnn.exe - 38b9916df46c57dc8ebb14e9b2d182d0b64d01a298cb61522e76578ca9eed253
C:\Windows\System32\Djokon32.dll - 4840866931f002cc5d5cd4a046efeaad1f88e18c2d5324a8be2a352615a222f7
C:\Windows\System32\Ikfnqgcc.dll - 09c7a04693ba3f45ce09a13849798e72bfea6ab5cd1dcd74e14d3ee55de3c4ca
C:\Windows\System32\Dbkahdep.dll - e7882e5837e4c3066de69a1d79793d925f5f82bed6d395ea2868a52b6d2f72b7
C:\Windows\System32\Mdfnaeqo.exe - 4d4abf6e580f4b1bab76a75ba53c9cd941cd7202e90f50e2848eb62598c6e1d9
C:\Windows\System32\Daleplfh.exe - c2061f4bb3e3898140243123e00e98e8ea74b6b138feb71478dfe6c35706d21c
C:\Windows\System32\Pbmcjb32.dll - f4d9216806777e2c9bd6b4e624dd37ec0bb57799c831d84d480cee4104a0d7a6
C:\Windows\System32\Lhigle32.exe - 16bc8a61cb936843c70420b4d4a6c60d65bd1cf2e25964b426f2e017c8db58a7
C:\Windows\System32\Cgnbonmk.dll - 29fc14f34e55056603af2ab796b46cdccb64f3bb1c1e426153dc8448ede61a7f
C:\Windows\System32\Ncfakapi.exe - 348f0792d206090cd7e0a81d48033ad9fff51885e723dc6425a6bf405606ae56
C:\Windows\System32\Oobkkaah.exe - a419f3fb559c0d442190cf69cf4e822b71d274cd1e5cd44e5b3918207ce19a43
C:\Windows\System32\Glbamboq.dll - c591a3982839186ba5034b9f4123c330d02dc998e31f86c34c6b557396c9ae1e
C:\Windows\System32\Bkbjkm32.dll - 1c74d927b91cb8124a008e6c3cfaee1e20155ddbfcc60551354077608e612521

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl

Embedded IP addresses

20.184.175.5
20.247.184.197
4.230.171.124
104.18.33.89
135.233.45.222
4.207.44.67
52.110.12.4
52.110.12.14

More FE7919C8 samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report