MALICIOUS — wlogon.dll

MALICIOUS — wlogon.dll is a pe sample analyzed by MalwareAnalyzer by Cyble with a malicious verdict (98/100), attributed to the MmJfa4pdRVd family. 6 of 55 detection engines flagged it, exhibiting 3 ATT&CK techniques.

Identification

SHA-256: a981949a58f37fba3cf33ccf87b89c509f7af90b07184b294af1719418754130
SHA-1: f6f612cab254378b321052b7634b2e41cdc0c683
MD5: 05ed3b9634b26f6a2800d0dc4baa952b
imphash: e60d0e6577962a1096407913ed128742
ssdeep: 6144:Nh9wv1Uveh9wv1UWfI6KoHgUttEGPLMR0m2:Nh9wt4eh9wtdfIyxVPIR0F
TLSH: T150421203AD9190ADD2DB2DB05C8CE16EB5892F1C193127483481BFDBA12D7676498ACE
Submitted as: wlogon.dll
File type: pe · Size: 200704 bytes
Verdict: malicious (98/100) · Family: MmJfa4pdRVd

Detections (6 of 55 engines)

MalwareAnalyser heuristics (entropy/packer): UPX
ClamAV (daily): Win.Ransomware.Somhoveran-9870372-0
Detect It Easy (packer/type): DIE:Turbo Linker
Microsoft Defender: Trojan:Win32/Vindor!pz
Emsisoft (Emergency Kit): Gen:Trojan.ShellHook.mmJfa4pdRVd
Kaspersky (KVRT): Worm.Win32.Wenper.b

MITRE ATT&CK

Why this verdict

The malicious score of 98/100 is the fusion of 8 weighted signals:

ClamAV (daily) flagged Win.Ransomware.Somhoveran-9870372-0 (rule Win.Ransomware.Somhoveran-9870372-0) - engine signal, weight 0.90, confidence 0.95
Observed at runtime: Windows Service (T1543.003) (rule Windows Service) - dynamic signal, weight 0.40, confidence 0.90
1 behavioral detection(s): Windows Service Installation [medium] (rule tl-service-install) - dynamic signal, weight 0.40, confidence 0.90
Contacted 28 external host(s) at runtime (16 HTTP) - network signal, weight 0.40, confidence 0.80
Detect It Easy (packer/type) flagged DIE:Turbo Linker (rule DIE:Turbo Linker) - engine signal, weight 0.35, confidence 0.70
Packing/obfuscation: UPX, high-entropy-sections:UPX1, Turbo Linker - static signal, weight 0.25, confidence 0.55
Dropped 3 executable file(s) at runtime - dynamic signal, weight 0.20, confidence 0.60
Observed at runtime: Modify Registry (T1112) (rule Modify Registry) - dynamic signal, weight 0.12, confidence 0.90

Dynamic analysis (windows)

318 behavior events · 2 ATT&CK techniques · 4 dropped files.

Dropped files

C:\Windows\System32\lcss.exe - d4e58251b31179c0c8ac6414d9e6d010aad856e733233cd0f89e5c76e160a82c
C:\Windows\System32\crypto.dll - 7e8b4cf9c337c2e0509173df22ae1aeb4056fd677138386a4523ecee1397096d
C:\Windows\System32\wlogon.dll - bfee73a771c8ced45e55ef77cd5ae69fac306fc929a8f8c71c1fee5f5b1bb886
C:\Windows\System32\net.cpl - a0b1956fd916252ce367a55fe45f65438dc1f66b308862a003cda86dc6f8f73a

Embedded URLs

http://www.msftconnecttest.com/connecttest.txt
http://rb.symcd.com/MFEwTzBNMEswSTAJBgUrDgMCGgUABBTDRSYViRCZTxmZjLENmnwVjLly9QQU1MAGIknrOUvdk%2BJcobhHdglyA1gCEF0QyxjrOnkAh4OrdHf50xk%3D
http://rb.symcb.com/rb.crl
http://203.26.79.13/filestreamingservice//files/753bb2df-a166-494f-aa7d-5678b1ef0c56/pieceshash?cacheHostOrigin=dl.delivery.mp.microsoft.com
http://203.26.79.13/filestreamingservice/files/753bb2df-a166-494f-aa7d-5678b1ef0c56?P1=1787648265&P2=404&P3=2&P4=gDkGmlwNw9hjJHTacRoVKNfvt9N1dYRg7Q8DO%2f3QcnsoKwvXvJYrCCxloVgrLS2UGsQ9VBq%2fDOE3Ik%2bHiWcX1w%3d%3d&cacheHostOrigin=msedge.b.tlu.dl.delivery.mp.microsoft.com

Embedded IP addresses

40.84.85.40
20.42.73.31
72.153.5.63
52.123.252.242
4.230.171.124
4.247.188.233
74.178.76.44
52.230.59.222
74.178.76.128
74.179.77.164
20.42.65.88
74.179.77.204
40.99.133.210
20.76.201.171
52.123.129.14
162.159.142.9
52.168.117.168
203.26.79.13
52.123.252.234
52.110.12.38
52.110.12.2
172.178.240.162
52.123.252.231
72.154.7.104
92.223.78.30

More MmJfa4pdRVd samples · Latest analyzed threats · ATT&CK coverage

Analyzed on MalwareAnalyzer by Cyble · Open interactive report