MALICIOUS — wlogon.dll

MALICIOUS — wlogon.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the ImJfa4pdRVd family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 29510765fdc7a72439828a2398f946f5d9dca0ef9e75a4665a9f64c37505ba2a
SHA-1: f2fc42276dd114050d129cf1ad66d0e464025f04
MD5: 85f98ef8cd99c051ecb73db24cdb9539
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 3072:IyrN/sVywaEj1Us10nfbyrN/sVywaEj1UsVYrHe8F/Qf:Nh9wv1Uveh9wv1UXr+L
TLSH: T1EA3E020BA981D07CD6C3B9641CC4E77DF8A69E7C24349D8439422F9BA02C76774A4ADC
Submitted as: wlogon.dll
File type: pe · Size: 146432 bytes
Verdict: malicious (98/100) · Family: ImJfa4pdRVd

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.imJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 24 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

316 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\crypto.dll - be95fe4a067c8eda805298eeeefac07937e1bed161b55dcafaa4ea3ba0c6e5bb
C:\Windows\System32\net.cpl - fea17f4b5ba5061e0ad4e1de8e03d81da677a2b75d3d358ef5ec921ce97ff677
C:\Windows\System32\lcss.exe - 76db19fdbcf52cd4091f210282a5a77fae0f8195078ff762fcc62b3d676dea4b
C:\Windows\System32\wlogon.dll - f1e8a23a378838e79d19bdf09c824dbde3618166f72cc3388ba3b108eab6ea28

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787661637&P2=404&P3=2&P4=JWC3JgZ9tlM%2fjcG5izsuAJ%2fAUhxxFVGj9GIh1aLcTGSpj6isV4y8vLgYJNs1S0Xc8qAk1czEjkajpAZ9U3Uouw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

52.110.12.33
52.110.12.14
51.132.193.105
20.247.184.142
48.211.4.16
4.230.171.124
52.123.252.238
74.179.77.204
20.42.65.94
135.233.95.135
74.178.76.128
20.42.65.91
20.112.250.133
52.123.129.14
52.123.128.14
203.26.79.13
4.247.188.224
52.123.252.192
74.179.71.159
172.178.240.163
52.110.12.28
52.148.114.188
52.110.12.4
72.153.5.134

More ImJfa4pdRVd samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report