MALICIOUS — wlogon.dll

MALICIOUS — wlogon.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Somhoveran family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 05235188dd9b2eb9ba03c6c848e39f33c7ba70306483c79133e5e785fce165d9
SHA-1: a4341be2a04e0c2318bfb350252b636cb11e4f77
MD5: ab019e59a4853522615aad71a284ead0
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 3072:IyrN/sVywaEj1Us10nfbyrN/sVywaEj1UsTNc7BVf8Jhwdg29ROUuzDY:Nh9wv1Uveh9wv1USNI38JhAgB8
TLSH: T1E040120AA5D2447AD5C3FDA41C50A37EF8D8192C12315AC175826BABF09D36728E8EDC
Submitted as: wlogon.dll
File type: pe · Size: 179200 bytes
Verdict: malicious (98/100) · Family: Somhoveran

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.kmJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

308 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\lcss.exe - 3a90fdab61832409756925a32e31995b4ba1da8f37b47ae955f92f1616a88e78
C:\Windows\System32\crypto.dll - b49e49a342185120e98f8a9e562d3d2d7cfc2c85ef1d880408af109902b00e24
C:\Windows\System32\wlogon.dll - 3146cb6fd8a17f1298768460d8c2ed7e8c8ab8dcc402824e54c47fd659c66d88
C:\Windows\System32\net.cpl - 82186325d3cf98c23b74550d2a6378b50fdb9eac54bdc4865a6b7dc3b1905581

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787651021&P2=404&P3=2&P4=Bn6vKIK7anlNpF5jUrk%2fiHFMywgbLqLxf%2bc8%2fTC9f6NTQAvJONDFbgsaIrlrUJPxDRqlfR2m0xHadaBIUEp3jA%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.247.188.233
20.42.65.84
52.123.252.232
4.230.171.124
4.247.188.224
52.230.59.222
74.178.240.61
4.150.223.103
135.232.92.97
20.165.94.63
52.123.128.14
20.236.44.162
40.99.133.226
52.123.252.234
52.110.12.15
52.110.12.3
203.26.79.13
135.233.45.223
172.66.2.5
20.165.94.46
52.110.12.1
52.110.12.37
72.145.35.107
52.148.114.188

More Somhoveran samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report