onlylogger | 301559f3ba75f3be51e18406fc9fd0e27b04dc4ceeb4fbd719b67a361b2967d5 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-en-20211104
submitted
21-11-2021 15:54

Sharing

Report Analysis Logs

General

Target

974b5b880750b82e0be5e6d3d6a0fce8.exe
Size

338KB
MD5

974b5b880750b82e0be5e6d3d6a0fce8
SHA1

59f5c934651660638e0f4db08e61208989eb7529
SHA256

301559f3ba75f3be51e18406fc9fd0e27b04dc4ceeb4fbd719b67a361b2967d5
SHA512

df9d08b1f66b0caaf70dc466e803e252760c04068e130bdf181ac6c645b88e5101cf8d61c5ec4cc552518ec8b9a0195e4fa7f58aee8f91b6de1fa75790890bba

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/808-56-0x0000000000020000-0x0000000000036000-memory.dmp	family_onlylogger
behavioral1/memory/808-57-0x0000000000400000-0x0000000002B4E000-memory.dmp	family_onlylogger

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\974b5b880750b82e0be5e6d3d6a0fce8.exe
"C:\Users\Admin\AppData\Local\Temp\974b5b880750b82e0be5e6d3d6a0fce8.exe"
1⤵
PID:808

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-55-0x0000000002CB8000-0x0000000002CC9000-memory.dmp

Filesize
68KB

Download
memory/808-56-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/808-57-0x0000000000400000-0x0000000002B4E000-memory.dmp

Filesize
39.3MB

Download