MALICIOUS — fa2047fc1dcfc1330471e856ca62f083bc78f8a1a6795d0365a9c41ccfeeca6f

MALICIOUS — fa2047fc1dcfc1330471e856ca62f083bc78f8a1a6795d0365a9c41ccfeeca6f is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the Crypted family. 5 of 56 detection engines flagged it, exhibiting 2 ATT&CK techniques.

Identification

SHA-256: fa2047fc1dcfc1330471e856ca62f083bc78f8a1a6795d0365a9c41ccfeeca6f
SHA-1: afe8eefb71f4443e2f030d6c4fe1eb9a7c5fdd49
MD5: e0490900696d0ea1377af9244caf1c25
imphash: 62ec3dce1eba1b68f6a4511bb09f8c2c
ssdeep: 3072:4+GXSAM1NGHIW8dzUG1KUZ9u+wbkTxmuKja6tJH6HIW8dzUG1KUZ9:KSAYGHIkMTuTk1SX6HIkMT
TLSH: T15143081396D41563CEB0AEE70B14FC9E71B20024EDFC856361A27773F202A97A1D5E68
Submitted as: fa2047fc1dcfc1330471e856ca62f083bc78f8a1a6795d0365a9c41ccfeeca6f
File type: pe · Size: 225280 bytes
Verdict: malicious (99/100) · Family: Crypted

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Backdoor:Win32/Berbew.AA!MTB
Emsisoft (Emergency Kit): GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035
Trellix Stinger (McAfee): Trojan-FUGH!E0490900696D
Kaspersky (KVRT): Trojan-Proxy.Win32.Qukart.vih

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
Microsoft Defender flagged Backdoor:Win32/Berbew.AA!MTB (rule Backdoor:Win32/Berbew.AA!MTB) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035 (rule GenPack:Generic.Dacic.1.Backdoor.Hangup.A.004BF035) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged Trojan-FUGH!E0490900696D (rule Trojan-FUGH!E0490900696D) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Trojan-Proxy.Win32.Qukart.vih (rule Trojan-Proxy.Win32.Qukart.vih) - engine signal, weight 0.55, confidence 0.85
Contacted 17 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Dropped 110 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

3550 behavior events · 1 ATT&CK techniques · 110 dropped files.

Dropped files

C:\Windows\System32\Engghbbb.exe - aa730a69d9aa931a28e09d703cd13ff532b70dfe642fe3280246f44747a39cf6
C:\Windows\System32\Jefobi32.exe - 224c88ef56cfbbf7875bfb69f130effc2ef73b6c3f48490b978a678915d26578
C:\Windows\System32\Dnmnhmga.exe - 0a030fcefc4139c8433ad25b0c7f8a9252bc9e98db26cffcd13941d9b90e082f
C:\Windows\System32\Pahlhc32.dll - e257a2f5e1f54d991b142a4f6362a8c93eda843de56247790e00c2d052baf22c
C:\Windows\System32\Gldmdl32.exe - 1b401787243eccc9496e8c06b58c3f0d08d275720f8811b3b2c0bbccf3ff1dda
C:\Windows\System32\Nihbfh32.dll - b6e0323c85c6bb3da20a51ae992beabae01a7b8cc70c92e8ea3c8cd1a5588581
C:\Windows\System32\Cegbkk32.exe - 6a376f56139ff55120ed751c7edbeb479c5146f1590e947ed32d88589c8009bf
C:\Windows\System32\Pmkbcdai.exe - 3c293aafe3d3f96ebb2f52a82ba6f5e1317329e2259f28c021c9de91af79f706
C:\Windows\System32\Fdebfgjd.dll - 7f8a95a2ddecc3bd01c4370e310ca04247cc42fd37653c479d6045f6357566a2
C:\Windows\System32\Jlilco32.dll - d09cb7a66bb9576c5083ca8854e057a31231ba7071f8af88fa734d9ada0000d5
C:\Windows\System32\Hggocahn.dll - 563f3af972ff8c142522a4fb2e62d098aa2c42d5068216d72d3d7a8e7c194341
C:\Windows\System32\Aooboapn.exe - 51d9906f7f393a74a73be0002774394a40d2baefa36d37d10686e1f6b8988de2
C:\Windows\System32\Nhmbcl32.exe - 72da1fcc7eab5e9ae91feb5571189cd3fead1a6e2d0c70dd49b1f699a00a87da
C:\Windows\System32\Mmmnim32.dll - c34b82361562255a1f0f7c3826813467ef947e4534449a690451892722686671
C:\Windows\System32\Lhkjko32.dll - 5903c216037c1011e61d27415dcb55d905cf778967eb3259b24fd2cf0be6b048

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl
http://yr.c.lencr.org/

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.65.93
85.210.196.11
52.123.252.248
52.253.84.76
4.230.171.124
135.233.95.144
74.178.240.51
4.150.223.109
172.215.188.232
20.184.175.13
52.110.12.1
52.110.12.45
72.145.35.108
52.148.114.188
135.233.45.221

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report