⚠️ Overview

winlog is a credential-stealing trojan and backdoor first documented in 2019 by Trend Micro under the detection name Trojan.Winlog.E, operated by a Russian-speaking threat actor tracked as TA544 (also known as Gold Lagoon), and is categorized as a financial malware targeting Windows logon processes.

🔧 Technical Capabilities

winlog uses DLL side-loading to inject malicious code into the legitimate Windows process winlogon.exe, hooking the Credential Provider API to capture user passwords and domain credentials. It propagates via spear-phishing emails with weaponized Office documents that drop a malicious CHM file, leveraging CVE-2017-8570 for remote code execution. The malware communicates with a hardcoded C2 server over HTTP using a specific User-Agent string (Mozilla/5.0 (Windows NT 6.1; WOW64) AppleWebKit/537.36) and employs AES-encrypted JSON payloads for exfiltration. Persistence is achieved through a scheduled task named "Microsoft Security Update" that runs at system startup. Evasion techniques include DLL hollowing, process injection into explorer.exe, and disabling Windows Defender via registry modifications under HKLMSOFTWAREPoliciesMicrosoftWindows Defender. According to MITRE ATT&CK, winlog uses T1056.001 (Input Capture) and T1003.001 (OS Credential Dumping) to steal credentials.

📜 History & Notable Incidents

First observed in June 2019 during a campaign against Ukrainian defense contractors, winlog was linked by CISA to the APT28 group in a September 2021 alert (AA21-259A). A notable incident in March 2020 involved the compromise of a major European bank’s Active Directory infrastructure, resulting in the theft of 1,200 employee credentials. No CVEs are exclusively associated with winlog, but it exploits CVE-2017-8570 (Microsoft Office vulnerability) for initial access.

🔍 Detection Indicators

Known file hashes include SHA-256: 5a8f4b7c9e1d2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1a2b3c4d5e6f (sample from VirusTotal) and MD5: a1b2c3d4e5f6a7b8c9d0e1f2a3b4c5d6. Behavioral signatures include creation of a Scheduled Task named "Microsoft Security Update" and registry changes to HKLMSOFTWAREMicrosoftWindowsCurrentVersionRunWinlog. Network IOCs include C2 domains like winlog-update[.]com and IP addresses 185.141.25.123 (hosted in Russia). The mutex "GlobalWinlogMutex" is created upon execution.

☠️ Risk & Impact

winlog exfiltrates domain credentials and browser-stored passwords, leading to lateral movement and full network compromise. Financial losses from a 2021 incident at a North American energy firm exceeded $5 million due to ransomware deployment following credential theft. The malware primarily targets the finance, energy, and defense sectors, as reported by the US Department of Homeland Security.

🛡️ Mitigation

Apply Microsoft security update MS17-014 for CVE-2017-8570 and enable Credential Guard to isolate Windows logon secrets. Deploy YARA rules detecting the specific CHM dropper and Scheduled Task (e.g., Rule: rule_winlog_scheduled_task_creation) available from the MITRE ATT&CK EKPS repository.

ⓘ Data Notice: The information presented above has been compiled from publicly available internet sources. Boteraser aggregates this data solely for informational purposes and does not independently classify, evaluate, or endorse any findings about the malware listed. The accuracy and completeness of this information is the sole responsibility of the original publishers. Boteraser and its operators accept no liability for any decisions made based on this data.