Analysis
-
max time kernel
33s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe
Resource
win10v2004-20220414-en
General
-
Target
a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe
-
Size
223KB
-
MD5
90421274471a9baf4eaa0fd1ed7941f3
-
SHA1
77be04f6cb6170128a5d284877eedfbe936be9a0
-
SHA256
a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1
-
SHA512
cea09b3d1869bf3d53f40ae86377ec6fb72d0f670372cc2b1a2a3ffba99151831fcd795ebb844931b63f1b1a77e4b4110cf162908b9765d1304bc4f556206066
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
resource yara_rule behavioral1/memory/852-57-0x0000000000220000-0x0000000000266000-memory.dmp family_onlylogger behavioral1/memory/852-58-0x0000000000400000-0x00000000004F1000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
pid Process 1744 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1940 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1940 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 852 wrote to memory of 1744 852 a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe 27 PID 852 wrote to memory of 1744 852 a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe 27 PID 852 wrote to memory of 1744 852 a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe 27 PID 852 wrote to memory of 1744 852 a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe 27 PID 1744 wrote to memory of 1940 1744 cmd.exe 29 PID 1744 wrote to memory of 1940 1744 cmd.exe 29 PID 1744 wrote to memory of 1940 1744 cmd.exe 29 PID 1744 wrote to memory of 1940 1744 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe"C:\Users\Admin\AppData\Local\Temp\a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1940
-
-