MALICIOUS — net.cpl

MALICIOUS — net.cpl is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (99/100), attributed to the OmJfa4pdRVd family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 6e0b9c9a37ad48be03343ed3a2c487b6c2046ae0406f8fb0ebf70084f3154db8
SHA-1: c44ed629afcb7237e6b8f932eee2a007f552b507
MD5: b8eb841cdff38ea6b5210d11cabd76ab
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 6144:Nh9wv1Ut3nh9wv1UJo9q7zYxkuQE5jcp5CSoYW1:Nh9wtah9wtN9qXY2+5jcP96
TLSH: T19243236BF652D49DC0F7B9587DAC831E64091F0842369F003B053BE6A01977BA8E0BD8
Submitted as: net.cpl
File type: pe · Size: 232960 bytes
Verdict: malicious (99/100) · Family: OmJfa4pdRVd

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.omJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 99/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Dropped a malicious payload (Somhoveran): lcss.exe - dynamic signal, weight 0.62, confidence 0.90
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

316 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\lcss.exe - 61472130be2a35970a8b205833b5855f3b94bbc003dab755a0c1574d03714595
C:\Windows\System32\crypto.dll - b255024bc52af348a6f5b811bf901a5111ea6cf5329624c4993849c4d06fd044
C:\Windows\System32\net.cpl - 4209cace74853f72cb7daa5f9f6c8a86d779cd2ec6cfaaf04d5ee5f2b0d87b12
C:\Windows\System32\wlogon.dll - afe5033335b125c0f1dae66bd5ea740b1ad13d2f4df232b332c6575a7d408af2

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787654300&P2=404&P3=2&P4=kV6Z4J%2f0%2bktVrPf7cOfL5zKbU%2fsBZtJgV%2fSLsWu66N%2fL%2fobMlRcYXImHpRBmmSOhgzpw6n4Q6I3LigzpyaWkdg%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

92.223.78.30
20.89.1.11
172.215.188.225
4.230.171.124
4.144.132.114
74.179.77.204
135.232.92.97
13.89.179.12
52.110.12.33
52.110.12.42
52.123.128.14
20.76.201.171
52.123.129.14
13.69.109.130
52.123.252.226
203.26.79.13
135.233.45.223
52.123.252.216
20.165.94.46
48.192.143.121
72.153.5.129
52.148.114.188
52.110.12.22
52.110.12.49

More OmJfa4pdRVd samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report