onlylogger | 301559f3ba75f3be51e18406fc9fd0e27b04dc4ceeb4fbd719b67a361b2967d5 | Triage

Analysis

max time kernel
122s
max time network
127s
platform
windows7_x64
resource
win7-en-20211104
submitted
21-11-2021 15:54

Sharing

Report Analysis Logs

General

Target

974b5b880750b82e0be5e6d3d6a0fce8.exe
Size

338KB
MD5

974b5b880750b82e0be5e6d3d6a0fce8
SHA1

59f5c934651660638e0f4db08e61208989eb7529
SHA256

301559f3ba75f3be51e18406fc9fd0e27b04dc4ceeb4fbd719b67a361b2967d5
SHA512

df9d08b1f66b0caaf70dc466e803e252760c04068e130bdf181ac6c645b88e5101cf8d61c5ec4cc552518ec8b9a0195e4fa7f58aee8f91b6de1fa75790890bba

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/808-56-0x0000000000020000-0x0000000000036000-memory.dmp	family_onlylogger
behavioral1/memory/808-57-0x0000000000400000-0x0000000002B4E000-memory.dmp	family_onlylogger

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

C:\Users\Admin\AppData\Local\Temp\974b5b880750b82e0be5e6d3d6a0fce8.exe
"C:\Users\Admin\AppData\Local\Temp\974b5b880750b82e0be5e6d3d6a0fce8.exe"
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/808-55-0x0000000002CB8000-0x0000000002CC9000-memory.dmp

Filesize
68KB

Download
memory/808-56-0x0000000000020000-0x0000000000036000-memory.dmp

Filesize
88KB

Download
memory/808-57-0x0000000000400000-0x0000000002B4E000-memory.dmp

Filesize
39.3MB

Download