MALICIOUS — crypto.dll

MALICIOUS — crypto.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Somhoveran family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 22ba380cd6a002dade8bfe8b2772bade716e05a40b4d89970a031d363b0b97c3
SHA-1: e9fe3a60b4f11e3624b83fa97f4ce19adea7a933
MD5: 170cc19010ae3e1e05344acfa52d61a1
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UslRKdTo9D:Nh9wv1Ut3nh9wv1UZdTot
TLSH: T15C3D02077852D4BDD6E3FE656D64925EE8515F680D218EC029022FEE900CB2FA5E4ECC
Submitted as: crypto.dll
File type: pe · Size: 132096 bytes
Verdict: malicious (98/100) · Family: Somhoveran

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.imJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 26 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

318 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\crypto.dll - 86781e77c514d4a0c15efb4e5736fdf93738937b861907a0519451c60cb5c36c
C:\Windows\System32\wlogon.dll - 097f73c2378c87c07fb762660f521c23850939e5b29ea5d4c95ea8ea6224285f
C:\Windows\System32\lcss.exe - e60f1c7aee58bdb7235f24062b1b9bfa30d0a09514387a0e80415575a47ad666
C:\Windows\System32\net.cpl - 85f03dbd085e91c1b452782803a341e34504be7c38a9fa5a84f00e95cd1d8b8f

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787649235&P2=404&P3=2&P4=gtW6HsD%2fi%2fiVd4eKZKrLyfvaoeaD4DGv7ApByYUmY0OYkPIyrVn22aYLvnWOKF1sNxLovx3a%2bEYWfPVdHlZfgg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.168.117.169
52.123.252.202
4.230.171.124
40.84.97.4
20.247.184.197
20.165.94.63
20.42.179.192
74.178.76.54
51.104.15.252
135.233.95.144
20.231.239.246
52.123.129.14
40.103.64.226
52.123.128.14
40.99.134.2
4.150.223.111
52.123.252.215
135.232.92.137
203.26.79.13
20.42.179.204
135.234.160.244
72.154.7.107
74.179.71.159
52.148.114.188
52.110.12.1

More Somhoveran samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report