onlylogger | 5fabd60a67c4394fdce061edc5853d0bcfd5e4a3f8018ab57d1915256beb101c | Triage

Analysis

max time kernel
4s
max time network
46s
platform
windows7_x64
resource
win7v20210408
submitted
28-07-2021 14:31

Sharing

Report Analysis Logs

General

Target

mixazed_20210728-153417.exe
Size

237KB
MD5

521326c41205a777a3ab2a5c8c365f25
SHA1

480da7fdb3feea0a1c9028e4e9b3ae20c884b9fa
SHA256

5fabd60a67c4394fdce061edc5853d0bcfd5e4a3f8018ab57d1915256beb101c
SHA512

fece6154c1f327f8cb51d26a32db89c52ad3e937920a14b4c20d3a265b3e6d57588693f31d4c6fce1a2a9da4b9585521a114dd6f5879f64e94642a87f700eff4

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/468-59-0x0000000000220000-0x0000000000236000-memory.dmp	family_onlylogger
behavioral1/memory/468-60-0x0000000000400000-0x00000000004BF000-memory.dmp	family_onlylogger

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\mixazed_20210728-153417.exe
"C:\Users\Admin\AppData\Local\Temp\mixazed_20210728-153417.exe"
1⤵
PID:468

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/468-59-0x0000000000220000-0x0000000000236000-memory.dmp

Filesize
88KB

Download
memory/468-60-0x0000000000400000-0x00000000004BF000-memory.dmp

Filesize
764KB

Download