Analysis
-
max time kernel
141s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
14-04-2022 12:54
Static task
static1
Behavioral task
behavioral1
Sample
65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe
Resource
win10v2004-en-20220113
General
-
Target
65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe
-
Size
392KB
-
MD5
2efec2dc8a4fc089b5d9727c390c7e87
-
SHA1
0ebc7c12d02e1d717c64ae82c2b6d59826f989c7
-
SHA256
65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac
-
SHA512
e68025a4bb9639073b874f4eaf2566ffbb17c2b339d984ac3d9e2fc9e97848bf855b27dda212c18add383d929e41e2d0ec401064be201f1b5f8ed3aa2f0ae842
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
resource yara_rule behavioral2/memory/492-132-0x0000000004D30000-0x0000000004D76000-memory.dmp family_onlylogger behavioral2/memory/492-133-0x0000000000400000-0x0000000002FEE000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4080 492 WerFault.exe 80 -
Kills process with taskkill 1 IoCs
pid Process 3484 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3484 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 492 wrote to memory of 2964 492 65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe 89 PID 492 wrote to memory of 2964 492 65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe 89 PID 492 wrote to memory of 2964 492 65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe 89 PID 2964 wrote to memory of 3484 2964 cmd.exe 93 PID 2964 wrote to memory of 3484 2964 cmd.exe 93 PID 2964 wrote to memory of 3484 2964 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe"C:\Users\Admin\AppData\Local\Temp\65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:2964 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "65e7cd17a891b2f4866a7299a6edb9a202588af2c3ce7c64b35d80505c7101ac.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3484
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 492 -s 12522⤵
- Program crash
PID:4080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 492 -ip 4921⤵PID:3344