MALICIOUS — wlogon.dll

MALICIOUS — wlogon.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the LmJfa4pdRVd family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 51ee7b866962dd4a17bf257c211e966f74ae3564422c8ca3f9be089f367f229a
SHA-1: 9fd16c93760246513551b997c409bd3dacdacbf3
MD5: 0cadb59261f0829c190770703a34cbd8
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1Us3mwESPsTolTmbZTpPmfD:Nh9wv1Ut3nh9wv1UIm/qTcTdi
TLSH: T1F041120FB262C5B8D0D2BE1A5D1C825CF841C75C5E379C800903ABEFA19DA6B74D4A9C
Submitted as: wlogon.dll
File type: pe · Size: 189440 bytes
Verdict: malicious (98/100) · Family: LmJfa4pdRVd

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.lmJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

316 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\lcss.exe - 695b0a51c1ff07cb42bd3c30bcfcd497d312efd1489780757f9bcdce6de63d94
C:\Windows\System32\net.cpl - 4083beb76beef55d7e3e9a684608d4a605c917d6341bd97e9f58ac736bc46381
C:\Windows\System32\wlogon.dll - ec815c319d5a8b84bbe549a67e4fbe5d6758cbb423c9c15977e57bd27a051a4f
C:\Windows\System32\crypto.dll - 8f1828f5ac26468e28d55e008ceb29bff136de6748ae7b5b6b3b8c3399504b0d

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787648116&P2=404&P3=2&P4=KRoI%2bJwXqf1KN%2by7YjlsFIYfwJ3rCXpObo5B5SZoHYlMJgu8QOODh8Arnk14iTuOk50cIX%2bQrb84lPIfF990Iw%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

92.223.78.30
52.123.252.234
57.155.101.212
52.168.117.175
4.230.171.124
20.247.185.124
74.178.240.61
135.233.95.135
52.168.112.66
20.236.44.162
52.123.128.14
40.103.64.226
52.178.17.233
135.234.160.244
135.232.92.34
172.178.240.162
203.26.79.13
172.66.2.5
4.207.44.69
74.178.76.44
52.148.114.188
4.207.44.72
52.110.12.56
52.110.12.52
72.153.5.63

More LmJfa4pdRVd samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report