MALICIOUS — 24f0fab64a6bf94e133ebc277737e7cbe509252bc0d2caf8236a35909caaaa24

MALICIOUS — 24f0fab64a6bf94e133ebc277737e7cbe509252bc0d2caf8236a35909caaaa24 is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (100/100), attributed to the Crypted family. 5 of 56 detection engines flagged it, exhibiting 6 ATT&CK techniques.

Identification

SHA-256: 24f0fab64a6bf94e133ebc277737e7cbe509252bc0d2caf8236a35909caaaa24
SHA-1: 8dd6467c125b2ed6496d0f96b28d810514e019ff
MD5: c2bc98584201868e7b4e6a7dae1ce24e
imphash: 9c0050334da711b5147027326c52827d
ssdeep: 768:C3WtXhh+zeIoRjwspcHPoMdsD77rDoigZQIGrE:AWhhhTMspcHPjm77vofZQI3
TLSH: T1DB2FD00759F86E8EDAFBF188630E610D4198A067C824C7B6A2699423E0D7677CD774CC
Submitted as: 24f0fab64a6bf94e133ebc277737e7cbe509252bc0d2caf8236a35909caaaa24
File type: pe · Size: 32768 bytes
Verdict: malicious (100/100) · Family: Crypted

Detections (5 of 56 engines)

ClamAV (daily): Win.Trojan.Crypted-30
Microsoft Defender: Worm:Win32/Mimail!pz
Emsisoft (Emergency Kit): Gen:Trojan.Backdoor2.cuW@aW@bqTb
Trellix Stinger (McAfee): W32/Mimail.q@MM
Kaspersky (KVRT): Email-Worm.Win32.Mimail.q

MITRE ATT&CK

Why this verdict

The malicious score of 100/100 is the fusion of 12 weighted signals:

ClamAV (daily) flagged Win.Trojan.Crypted-30 (rule Win.Trojan.Crypted-30) - engine signal, weight 0.90, confidence 0.95
4 behavioral detection(s) across 4 rule(s): Registry Run Key Persistence [high] (rule tl-run-key) - dynamic signal, weight 0.69, confidence 0.90
Microsoft Defender flagged Worm:Win32/Mimail!pz (rule Worm:Win32/Mimail!pz) - engine signal, weight 0.55, confidence 0.85
Emsisoft (Emergency Kit) flagged Gen:Trojan.Backdoor2.cuW@aW@bqTb (rule Gen:Trojan.Backdoor2.cuW@aW@bqTb) - engine signal, weight 0.55, confidence 0.85
Trellix Stinger (McAfee) flagged W32/Mimail.q@MM (rule W32/Mimail.q@MM) - engine signal, weight 0.55, confidence 0.85
Kaspersky (KVRT) flagged Email-Worm.Win32.Mimail.q (rule Email-Worm.Win32.Mimail.q) - engine signal, weight 0.55, confidence 0.85
Observed at runtime: Registry Run Key Persistence (T1547.001) (rule Registry Run Key Persistence) - dynamic signal, weight 0.40, confidence 0.90
Contacted 3 external host(s) and 13 HTTP request(s) at runtime - network signal, weight 0.40, confidence 0.80
Anti-analysis: T1082 - dynamic signal, weight 0.40, confidence 0.75
Extracted JavaDropper config (0 C2) - engine signal, weight 0.45, confidence 0.60
Dropped 2 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

35038 behavior events · 2 ATT&CK techniques · 3 dropped files.

Dropped files

C:\Windows\sys32.exe - 87333af27543df1cae19b6875ed5197c4e02c0c30eeaf63cf32111a77c13abf9
C:\Windows\outlook.exe - 96b9c4ead67d03eb2c69103a983274e013e3466e80d8f95bd7cf3aea8be05b28
C:\Windows\outlook.cfg - b8bb3f90f62f64fe9383af574e36a9be9b927bedbeebc71a454cabcd762cb6a9

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://c.pki.goog/r/r1.crl
http://x2.c.lencr.org/
http://ye.c.lencr.org/
http://c.pki.goog/wr2/9UVbN0w5E6Y.crl

Embedded domains

x1.c.lencr.org
x2.c.lencr.org
ye.c.lencr.org
yr.c.lencr.org

Embedded IP addresses

20.42.73.31
52.123.252.225
4.230.171.124
20.42.179.204
20.247.184.197
74.179.77.204
74.178.240.51
20.184.175.8
20.165.94.63
212.5.86.163
52.110.12.10
52.110.12.45
52.178.17.232
4.247.188.224
92.223.78.30
135.233.45.221
72.154.7.17
172.178.240.163
52.148.114.188
52.110.12.4
52.110.12.11

More Crypted samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report