MALICIOUS — net.cpl

MALICIOUS — net.cpl is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Somhoveran family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 0d8d14527bc93787ed6891e86edf8225d50bc11b5a2a452879ae108963576380
SHA-1: 3634f94df01edf28a414a9d22fc87051e67de30c
MD5: 7f0562f3f109d007fb177bf6d0596e2c
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 3072:IyrN/sVywaEj1Us10nfbyrN/sVywaEj1UssERGxz4Zu0rTf:Nh9wv1Uveh9wv1Ug6z4ZT/f
TLSH: T15C3E0107BED091BCD2C3BE98A890D62DF4905BAC15316D806D822BAF901DB53DCD4A9D
Submitted as: net.cpl
File type: pe · Size: 146944 bytes
Verdict: malicious (98/100) · Family: Somhoveran

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.imJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 32 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

316 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\crypto.dll - 6ba954b756d81a189146252f1c502f36471806580210e2bcec3de49e3012fd5a
C:\Windows\System32\lcss.exe - 3253c17103f1ca91b53575042f56f9fa168f94939b0f3c8f6282300effa356a6
C:\Windows\System32\net.cpl - 5a1e9504650a2aeca921f194dbee77b3b689c225f1c9f3be13262270d78dfb9f
C:\Windows\System32\wlogon.dll - 4c09cf472359a52c87ce8739500184eddb705160e5f41dd5e75dcb800e64eacd

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787649458&P2=404&P3=2&P4=bIlnjS%2bQoBRsiAc%2bYPH2n8aAQikw%2fVj3rvrWRsQbnhu7dWCF50Uch5Wpb5NTCR2MB36qWd9Ef9dDBHvwcgwkFg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

103.229.10.247
103.229.10.180
3.234.50.56
52.44.153.83
44.234.204.129
52.110.12.10
20.11.121.11
4.150.223.97
52.123.252.223
172.215.188.232
20.247.185.124
4.230.171.124
108.158.32.99
142.251.222.8
108.158.32.67
74.179.71.159
135.232.92.137
135.232.92.97
52.123.252.246
52.168.117.169
142.250.195.174
203.26.79.13
52.123.128.14
20.76.201.171
52.123.129.14

More Somhoveran samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report