MALICIOUS — cec6a073c94028596a227f21e1aa2adb1e5b2b08dfb04a098825aba56e472bab
MALICIOUS — cec6a073c94028596a227f21e1aa2adb1e5b2b08dfb04a098825aba56e472bab is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (92/100), attributed to the Crypted family. 5 of 55 detection engines flagged it, exhibiting 2 ATT&CK techniques.
Identification
- SHA-256:
cec6a073c94028596a227f21e1aa2adb1e5b2b08dfb04a098825aba56e472bab - SHA-1:
a31c163d2186e8964259c685361e0df283cc93ee - MD5:
08cfd7e0bb2af2c9a8584106e064cc6b - imphash:
c2a87fabf96470db507b2e6b43bd92eb - ssdeep:
1536:TZDfyZ6idhxkYYj6FenOegP4fJFRFCi643cR4HL4SujjxqO6dmKP2yx8L/I6:MZTdhxkHOenDggDSi643cRmujsxl6 - TLSH:
T12F3C0507CE01B6C2DDEC96099294BFCDA1A711B13778417F795261AC8C1ACB7A8EC1D8 - Submitted as: cec6a073c94028596a227f21e1aa2adb1e5b2b08dfb04a098825aba56e472bab
- File type: pe · Size: 114688 bytes
- Verdict: malicious (92/100) · Family: Crypted
Detections (5 of 55 engines)
- ClamAV (daily): Win.Trojan.Crypted-29
- Microsoft Defender: Backdoor:Win32/Berbew!pz
- Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.8D3133A2
- Trellix Stinger (McAfee): Trojan-FUGH!08CFD7E0BB2A
- Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vjh
MITRE ATT&CK
Why this verdict
The malicious score of 92/100 is the fusion of 4 weighted signals:
- ClamAV (daily) flagged Win.Trojan.Crypted-29 (rule
Win.Trojan.Crypted-29) - engine signal, weight 0.90, confidence 0.95 - Contacted 30 external host(s) at runtime (22 HTTP) - network signal, weight 0.40, confidence 0.80
- Dropped 98 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
3070 behavior events · 1 ATT&CK techniques · 98 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- windows.msn.com
- oneocsp.microsoft.com
- officeclient.microsoft.com
- www.msn.com
Dropped files
- C:\Windows\System32\Enakdk32.dll -
e101f5f2f8f4c790919c50d86cc1b2431df3d75b15f4cc3d740fc2d734198da7 - C:\Windows\System32\Adkbkfan.dll -
2a9ba08db42ac85a2e22f1816da4c977938475376323dbf96afec2ae79529f21 - C:\Windows\System32\Ddblihbd.exe -
b3d8375a0136c4d7f81b8ed345af032c7af6eb5d04daeace7ecc643c5763fa25 - C:\Windows\System32\Obohel32.exe -
47366687b59ce5f50dcfba229915d49be6c33ca358a5ec109795f28b0bf04c48 - C:\Windows\System32\Qmpedm32.exe -
01206d38bee90a3ba941975d87824c3e0870f271aa83c3e8d2ee9d73c9ef843c - C:\Windows\System32\Hbhobk32.exe -
a16897d84bea90eb8803be5f2bc8c042a21844a140dfdaf9eaaedc78d1526e35 - C:\Windows\System32\Ndjihheb.exe -
8d6c0cb9d50dd2b36d85cba07265ee5ae414301284425deffae0590815e051d6 - C:\Windows\System32\Bleklgqn.exe -
71352608023c565951317ff4cebde2cdfef8bbb53a7089bb8d12ba5d7a7f46d3 - C:\Windows\System32\Nnemob32.dll -
c34ffa8826fdb1dd61beb62e8f3bfc8d65863e42fecb36f9d3cf0f6764cbc9fe - C:\Windows\System32\Gacbbcch.exe -
dca5d542d03d8c83127a6f67620b05cd15c402dc1e930fe6dfbe3474ccceed03 - C:\Windows\System32\Hnkegc32.exe -
c65de481a0be31a08d058b9f60e50704e1db4e93bf73172a5fda225648fac1a2 - C:\Windows\System32\Njjqkkck.exe -
99f5cebacb7435adc150959637e4e695efcbb68502d883c133c4c5e070857f43 - C:\Windows\System32\Pbgehi32.dll -
bac55beca9c1273d975bb2d33d9629c670de1c88b16b66773c593b99fae16c61 - C:\Windows\System32\Eiaeaj32.exe -
8274700671ab9f2315c615d18154cf3f6e3011ca660c805b90bc3cb896d72474 - C:\Windows\System32\Bkgiokpd.exe -
e7722a7b171df725d4715d998d4faae1781fe2b932f9ca8017b77e3fa31578a7
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787796656&P2=404&P3=2&P4=KjUsB4NBKqh9mEzC7rXBNdNqGjEMyJY5om92EqBJYOPrXXXrqaPz5O6CJIrMnO4gGavF2LnaZEqjdhHPytvBSw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787796729&P2=404&P3=2&P4=FVjp31jxqQQwgu6MTLDSzpi%2fj7DK%2bwg3A%2bgpyyn9mbIEGw7taOdcDukTEI5199MQyg5GFO%2bWz9ne1ZaZSx%2br4w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 13.89.179.15
- 20.247.184.197
- 40.84.85.40
- 4.230.171.124
- 74.179.77.204
- 74.179.77.164
- 4.150.223.108
- 20.236.44.162
- 40.99.133.242
- 52.123.128.14
- 40.99.133.210
- 20.42.73.30
- 203.26.79.13
- 74.178.76.44
- 52.123.252.231
- 52.123.252.195
- 135.234.160.244
- 52.110.12.4
- 4.150.223.103
- 20.42.65.93
- 52.110.12.37
- 52.148.114.188
- 52.123.252.236
- 92.223.78.30
- 72.154.7.102
More Crypted samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report