MALICIOUS — ed196b864836e86beeb5a664d06cfc7b81613a829507013fcb5bb05d0ddb75d8

MALICIOUS — ed196b864836e86beeb5a664d06cfc7b81613a829507013fcb5bb05d0ddb75d8 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100). 4 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: ed196b864836e86beeb5a664d06cfc7b81613a829507013fcb5bb05d0ddb75d8
SHA-1: 2e13919441a36c0c80d2883dee9bf33b14d3a727
MD5: c9ddc14c7fec56ab75ec3538b20ad713
imphash: 2c5f2513605e48f2d8ea5440a870cb9e
ssdeep: 1536:cG7ftfkS5g9YOms+gZcQipICdXkNDqLLZX9lItVGL++eIOlnToIf6wZBOM:c8FfHgTWmCRkGbKGLeNTBf6cF
TLSH: T1CD398C5643A22348E2EFF5F54E64AF5C4043B1B012B894ED668ACC2C52E2C77777A0D6
Submitted as: ed196b864836e86beeb5a664d06cfc7b81613a829507013fcb5bb05d0ddb75d8
File type: pe · Size: 92160 bytes
Verdict: malicious (99/100)

Detections (4 of 56 engines)

MalwareAnalyser heuristics (entropy/packer): PureBasic
Detect It Easy (packer/type): DIE:PureBasic
Microsoft Defender: Trojan:Win32/PSCrypt.B!MTB
Kaspersky (KVRT): HEUR:Backdoor.PowerShell.Agent.gen

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 11 weighted signals:

2 behavioral detection(s) across 2 rule(s): PowerShell Encoded / Download Cradle [high] (rule tl-powershell-encoded) - dynamic signal, weight 0.63, confidence 0.90
Microsoft Defender flagged Trojan:Win32/PSCrypt.B!MTB (rule Trojan:Win32/PSCrypt.B!MTB) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged HEUR:Backdoor.PowerShell.Agent.gen (rule HEUR:Backdoor.PowerShell.Agent.gen) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
Dropped a suspicious payload: ModuleAnalysisCache - dynamic signal, weight 0.40, confidence 0.90
Contacted 1 external host(s) and 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082, T1622 - dynamic signal, weight 0.40, confidence 0.75
Detect It Easy (packer/type) flagged DIE:PureBasic (rule DIE:PureBasic) - engine signal, weight 0.35, confidence 0.70
MalwareAnalyser heuristics (entropy/packer) flagged PureBasic (rule PureBasic) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: PureBasic - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

10021 behavior events · 2 ATT&CK techniques · 6 dropped files.

Dropped files

C:\Users\analyst\AppData\Local\Temp\A8A.tmp\A8B.tmp\A9C.bat - db95f1a3e060d5e5c6d31cd023b29589f4942bf417f7f5286e10e485a661eeb1
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCache - 13d22b1d1ed2476e851ffa19d998f3a43e657212b30fa061168d7c9240823eb1
C:\Users\analyst\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive - b2eacf3c2b7b8ab2d4fc26a1b53cf4c1aab5a5863c5d4feddc44c703b40b54e1
C:\Users\analyst\AppData\Local\Temp\__PSScriptPolicyTest_1gmozngg.cmt.psm1 - 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
8b9da5d70649e3dede6e9407f38b820f29a53419823bd23ed9d7a1fe333ddac0 - 8b9da5d70649e3dede6e9407f38b820f29a53419823bd23ed9d7a1fe333ddac0
be33900ce542ad66885955f313ee68a9bb07e9fb0a3f79a288447f8b72520ed7 - be33900ce542ad66885955f313ee68a9bb07e9fb0a3f79a288447f8b72520ed7

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

40.74.98.199
20.247.185.124
4.230.171.124
52.110.12.1
129.250.35.251
135.233.45.222
172.215.188.225
57.155.104.224
72.145.35.111
52.148.114.188
52.110.12.21
52.110.12.14

Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report