Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    15-04-2022 15:14

General

  • Target

    5e75e5f1599859fa86b36ede416b1ce5966db6e420b6c9729101ce4f7117d924.exe

  • Size

    349KB

  • MD5

    178bcec8232631020ce5c7c0787dbaaf

  • SHA1

    c9c73fe7b8f081824c31c4cc7a626ce79b21c036

  • SHA256

    5e75e5f1599859fa86b36ede416b1ce5966db6e420b6c9729101ce4f7117d924

  • SHA512

    bc005fae9269340c3e1e91445cda05e9c1343c39888f5f55d4ea905ea38aa01f55e60e819dbaa160d3dc30dc1ca8a3cfe9c334da23470a3f338e099653bc33da

Score
10/10

Malware Config

Signatures

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

  • OnlyLogger Payload 2 IoCs
  • Program crash 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\5e75e5f1599859fa86b36ede416b1ce5966db6e420b6c9729101ce4f7117d924.exe
    "C:\Users\Admin\AppData\Local\Temp\5e75e5f1599859fa86b36ede416b1ce5966db6e420b6c9729101ce4f7117d924.exe"
    1⤵
      PID:3168
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 620
        2⤵
        • Program crash
        PID:4100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 640
        2⤵
        • Program crash
        PID:1960
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 744
        2⤵
        • Program crash
        PID:4280
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 784
        2⤵
        • Program crash
        PID:3180
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 856
        2⤵
        • Program crash
        PID:2796
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3168 -s 728
        2⤵
        • Program crash
        PID:2800
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3168 -ip 3168
      1⤵
        PID:5012
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3168 -ip 3168
        1⤵
          PID:4644
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 3168 -ip 3168
          1⤵
            PID:2408
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3168 -ip 3168
            1⤵
              PID:2024
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 3168 -ip 3168
              1⤵
                PID:3996
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 3168 -ip 3168
                1⤵
                  PID:3716

                Network

                MITRE ATT&CK Matrix

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/3168-130-0x0000000000720000-0x000000000073A000-memory.dmp

                  Filesize

                  104KB

                • memory/3168-131-0x0000000000740000-0x000000000076E000-memory.dmp

                  Filesize

                  184KB

                • memory/3168-132-0x0000000000400000-0x00000000004E8000-memory.dmp

                  Filesize

                  928KB