MALICIOUS — wlogon.dll

MALICIOUS — wlogon.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Somhoveran family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 7e17f1dfc806c7eb042b0af0207fa0729801df30b05a6c7e972e2b44d5b4cbf8
SHA-1: a82bc0fe3e7ec7a4d8cd3102905612cd9f41cb28
MD5: 567b633630e9c50acb578af1543610ab
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsHuEu6VpKIRSs9by3g:Nh9wv1Ut3nh9wv1U+u0VpKIR1
TLSH: T1B5401207B156E87AD1D7F5449864D10EB8058FAC483A5EC089036BEED01DB3B65E8ECD
Submitted as: wlogon.dll
File type: pe · Size: 174080 bytes
Verdict: malicious (98/100) · Family: Somhoveran

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.kmJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 27 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

313 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\crypto.dll - 888b66c31af45fd5ee45961322fefc44a1cea47e62c18ba1908223d5cdee139a
C:\Windows\System32\net.cpl - e06a0b000e4f2f6563bf92f5d7bfe7f391045099ea3fc50734bcfc336dd9feab
C:\Windows\System32\lcss.exe - 577b20a54289fbf2f928f046aa32c9a88d7f7ffa22511121026aa4103820fdec
C:\Windows\System32\wlogon.dll - c716717d67bf2236ab22d73323692fcded05936744d45c6887e7985023595e47

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787655301&P2=404&P3=2&P4=beul0Z2EgOLuyPF%2fY%2fnlBXpW8OVfIIkh6Qjhemgp%2fmQfCtkTQ9y10l8z2nBdvxn0Whbfs5lQPhHwUhWhaPCk6A%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

4.150.223.107
4.247.188.233
52.123.252.240
20.247.184.197
135.233.95.144
20.184.175.1
135.232.92.97
57.154.63.210
4.230.171.124
74.178.76.128
20.112.250.133
40.103.64.226
52.123.128.14
52.123.129.14
20.184.175.13
52.123.252.212
162.159.142.9
135.233.45.222
4.209.250.170
203.26.79.13
52.110.12.56
52.110.12.4
72.145.35.96
135.232.92.34
52.148.114.188

More Somhoveran samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report