MALICIOUS — wlogon.dll

MALICIOUS — wlogon.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the Somhoveran family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: 8ebbba6049db483d27e9bdc8ce182681ac540f7e2d4d33ed5eede15c9402fcee
SHA-1: a0184ac04f3baf7a2bb6a43aaf437c4e799dc73c
MD5: eb644bc19f62d3286a0b4e70680552fb
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 3072:IyrN/sVywaEj1UsEOBYJwyrN/sVywaEj1UsQlAsRus:Nh9wv1Ut3nh9wv1UZAs4s
TLSH: T19D3C02076641D4E9D5D3FE646C58C19CF8919F680A356E8058023FDB604EF2B9AE4ECC
Submitted as: wlogon.dll
File type: pe · Size: 120832 bytes
Verdict: malicious (98/100) · Family: Somhoveran

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.hmJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 25 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

316 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\wlogon.dll - 17eb0f5dd7c0ca134684f6cdbb96fbdd09c01cd5c1e6100699c541ee1aee73ae
C:\Windows\System32\lcss.exe - 7dbd7255d41ae5778b94b758a239b07cdd264208713b5cb1a91e3d93dcb4b133
C:\Windows\System32\net.cpl - ff559b3272a87dc1eb9adee16df556856c59ee0cd8ee362e9de7d695de8c96f4
C:\Windows\System32\crypto.dll - 616cc78390982637ec54dccc6e8ea52b312cda8c25593229eeb46a00c601efa5

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787662232&P2=404&P3=2&P4=B89H9mvsNKb1cgJ0caFGmq1oAtDNUBXo875%2f1GTidc9GhulLp%2bnd%2b3TBw4STqZFIad%2fqqaSNuQhOI9hLQK2wog%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

203.26.79.13
74.179.71.159
52.123.252.238
4.150.223.104
92.223.78.30
4.230.171.124
172.215.188.225
52.230.59.222
135.232.92.137
135.233.95.135
52.168.112.67
4.150.223.114
20.231.239.246
40.104.4.2
40.99.133.242
52.123.129.14
52.123.128.14
172.66.2.5
52.123.252.216
135.233.45.223
172.215.188.232
72.153.5.133
52.148.114.188
52.110.12.55
52.110.12.53

More Somhoveran samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report