MALICIOUS — lcss.exe
MALICIOUS — lcss.exe is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Somhoveran family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.
Identification
- SHA-256:
7f31d48d20ff15b7cf87f6f7d42e83748e161475be36a7ddb3d7c393795cdb27 - SHA-1:
5cdfbe7c02b9e00d2c341be219996fd462613cb3 - MD5:
af2ac86fa7c6112e7dc6927457e1e2f6 - imphash:
e60d0e6577962a1096407913ed128742 - ssdeep:
3072:IyrN/sVywaEj1UsPyrN/sVywaEj1UsEOBYJH70J7GBFPvuc2Q9Y3q446I69vWPZV:Nh9wv1U7h9wv1Ut3d7t7XPY65Q+ZgNW - TLSH:
T10A42120B760691F4E1E6FF60BD70C92CF8915A290A36DDC05A066B9B500EF4B56F89CC - Submitted as: lcss.exe
- File type: pe · Size: 203776 bytes
- Verdict: malicious (98/100) · Family: Somhoveran
Detections (6 of 55 engines)
- MalwareAnalyser heuristics (entropy/packer): UPX
- ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
- Detect It Easy (packer/type): DIE:Turbo Linker
- Microsoft Defender: Trojan:Win32/Vindor!pz
- Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.mmJfa4pdRVd
- Kaspersky (KVRT): Worm.Win32.Wenper.b
MITRE ATT&CK
Why this verdict
The malicious score of 98/100 is the fusion of 8 weighted signals:
- ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule
Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95 - Observed at runtime: Windows Service (T1543.003) (rule
Windows Service) - dynamic signal, weight 0.40, confidence 0.90 - 1 behavioral detection(s): Windows Service Installation [medium] (rule
tl-service-install) - dynamic signal, weight 0.40, confidence 0.90 - Contacted 22 external host(s) at runtime (18 HTTP) - network signal, weight 0.40, confidence 0.80
- Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule
DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70 - Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
- Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
- Observed at runtime: Modify Registry (T1112) (rule
Modify Registry) - dynamic signal, weight 0.12, confidence 0.90
Dynamic analysis (windows)
316 behavior events · 2 ATT&CK techniques · 4 dropped files.
Runtime network
- www.msftconnecttest.com
- rb.symcd.com
- rb.symcb.com
- inference.location.live.net
- to-do.office.com
- staging.to-do.officeppe.com
- teams.cloud.microsoft
- outlook.office.com
- outlook.office365.com
- outlook.cloud.microsoft
- ctldl.windowsupdate.com
- login.live.com
- ocsp.digicert.com
- desktop-hsgcbep
- v20.events.data.microsoft.com
- config.edge.skype.com
- settings-win.data.microsoft.com
- windows.msn.com
- oneocsp.microsoft.com
- www.msn.com
Dropped files
- C:\Windows\System32\crypto.dll -
4ab9140d834842d1e932efe3ae4571b2f962ea1aa7610067cfd08f06fe1628bc - C:\Windows\System32\lcss.exe -
07c507d11da1d78d6330c36f6d6db549c9f360b79dca1a54e4685d818c8b0b1a - C:\Windows\System32\wlogon.dll -
b5efac2d73be7292f41421a9cf085ffa58f2dbe75c035e4dda9b1d297b7bad44 - C:\Windows\System32\net.cpl -
44f10ac12d9f9cc24471a48170e67e8b6a59efb30189461cda2fc18bcc1d31d5
Embedded URLs
- http://www.msftconnecttest.com/connecttest.txt
- http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
- http://rb.symcb.com/rb.crl
- http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787654338&P2=404&P3=2&P4=ScanP50lXnZARZ6jM0HYFe%2bKOisSNKsQGoxISvPzEt8T9j7UktI3WZIb4qvs0dGyphRKKaKtLqGpLJszYcodeQ%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice//files/c74a5353-3e6a-42b7-94d6-9b96c560c89a/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
- http://203.26.79.13/filestreamingservice/files/c74a5353-3e6a-42b7-94d6-9b96c560c89a?P1=1787654358&P2=404&P3=2&P4=R0jGSXYLahSuRA2JJDf3tmxMCDwcbYA6C5kXPxWE6u4pWbQvJySrF8RbYFQu6HKY%2fjrIhij6U%2f0ugQ31H%2fnL9A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com
Embedded IP addresses
- 74.178.76.44
- 40.79.197.34
- 52.123.252.222
- 4.230.171.124
- 172.215.188.225
- 4.144.132.114
- 74.179.77.204
- 4.150.223.105
- 74.178.76.54
- 52.123.252.204
- 52.123.129.14
- 20.112.250.133
- 40.104.4.2
- 20.42.65.93
- 20.165.94.46
- 52.123.252.240
- 203.26.79.13
- 172.178.240.161
- 52.148.114.188
- 72.153.5.129
- 52.110.12.25
- 52.110.12.4
More Somhoveran samples · Latest analyzed threats · ATT&CK coverage
Analyzed on MalwareAnalyzer by Cyble · Open interactive report