onlylogger

Sharing

General

Target

045A93EE4AA61FD3BB2C7F706085A249B9664876B7A2E.exe
Size

5.6MB
Sample

220310-w53qzadahm
MD5

e7dac1680784996bdbd5f97595c351b4
SHA1

98c265f9877abfb8c90c84f05ad0ca871bb38524
SHA256

045a93ee4aa61fd3bb2c7f706085a249b9664876b7a2e5d8282129ac6df15be2
SHA512

43b9c2bb29c497c566c5758fda9f3c1bfd59288f03d63ff0b8dd884c072cdd7bddd4c3b4345e846b36ca7f30ef64b2fabf2f688e7959366572f6b133bd75b915

Score

10^/10

Malware Config

Extracted

Family

socelars

http://www.kvubgc.com/

Extracted

Family

redline

Botnet

v2user1

88.99.35.59:63020

Attributes

auth_value
0cd1ad671efa88aa6b92a97334b72134

Extracted

Family

redline

Botnet

media1422

92.255.57.115:59426

Attributes

auth_value
3c2514d93ec6cbb5f4ebead8b1b21099

Extracted

Family

redline

Botnet

193.106.191.67:44400

Attributes

auth_value
5a1b28ccd05953f5c3f99729c12427cc

Extracted

Family

smokeloader

Version

2020

http://nahbleiben.at/upload/

http://noblecreativeaz.com/upload/

http://tvqaq.cn/upload/

http://recmaster.ru/upload/

http://sovels.ru/upload/

rc4.i32

Extracted

Family

redline

Botnet

193.203.203.82:23108

Attributes

auth_value
52b37b8702d697840527fac8a6ac247d

Targets

- Target
  
  045A93EE4AA61FD3BB2C7F706085A249B9664876B7A2E.exe
- Size
  
  5.6MB
- MD5
  
  e7dac1680784996bdbd5f97595c351b4
- SHA1
  
  98c265f9877abfb8c90c84f05ad0ca871bb38524
- SHA256
  
  045a93ee4aa61fd3bb2c7f706085a249b9664876b7a2e5d8282129ac6df15be2
- SHA512
  
  43b9c2bb29c497c566c5758fda9f3c1bfd59288f03d63ff0b8dd884c072cdd7bddd4c3b4345e846b36ca7f30ef64b2fabf2f688e7959366572f6b133bd75b915
Score

10^/10

redline socelars media1422 v2user1 ww aspackv2 infostealer stealer suricata onlylogger smokeloader 2 backdoor discovery evasion loader spyware trojan
- Modifies Windows Defender Real-time Protection settings
  evasion trojan
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- RedLine
  RedLine Stealer is a malware family written in C#, first appearing in early 2020.
  infostealer redline
- RedLine Payload
- SmokeLoader
  Modular backdoor trojan in use since 2014.
  trojan backdoor smokeloader
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars Payload
- suricata: ET MALWARE Danabot Key Exchange Request
  suricata: ET MALWARE Danabot Key Exchange Request
  suricata
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
  suricata
- suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
  suricata
- NirSoft WebBrowserPassView
  Password recovery tool for various web browsers
- Nirsoft
- OnlyLogger Payload
- ASPack v2.12-2.42
  Detects executables packed with ASPack v2.12-2.42
  aspackv2
- Blocklisted process makes network request
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Accesses cryptocurrency files/wallets, possible credential harvesting
  spyware
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Looks up geolocation information via web service
  Uses a legitimate geolocation service to find the infected system's geolocation info.
- Suspicious use of SetThreadContext
behavioral1 behavioral2

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Web Service

T1102

Impact

Tasks

Sharing

General

Malware Config

Extracted

Extracted

Extracted

Extracted

Extracted

Extracted

Targets

Modifies Windows Defender Real-time Protection settings

Process spawned unexpected child process

RedLine

RedLine Payload

SmokeLoader

Socelars

Socelars Payload

suricata: ET MALWARE Danabot Key Exchange Request

suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3

NirSoft WebBrowserPassView

Nirsoft

OnlyLogger Payload

ASPack v2.12-2.42

Blocklisted process makes network request

Downloads MZ/PE file

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Reads user/profile data of web browsers

Accesses cryptocurrency files/wallets, possible credential harvesting

Checks installed software on the system

Legitimate hosting services abused for malware hosting/C2

Looks up external IP address via web service

Looks up geolocation information via web service

Suspicious use of SetThreadContext

MITRE ATT&CK Matrix ATT&CK v6

Tasks

static1

behavioral1

behavioral2