Analysis
-
max time kernel
90s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-04-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe
Resource
win10v2004-20220414-en
General
-
Target
a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe
-
Size
223KB
-
MD5
90421274471a9baf4eaa0fd1ed7941f3
-
SHA1
77be04f6cb6170128a5d284877eedfbe936be9a0
-
SHA256
a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1
-
SHA512
cea09b3d1869bf3d53f40ae86377ec6fb72d0f670372cc2b1a2a3ffba99151831fcd795ebb844931b63f1b1a77e4b4110cf162908b9765d1304bc4f556206066
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
resource yara_rule behavioral2/memory/4424-131-0x0000000002120000-0x0000000002166000-memory.dmp family_onlylogger behavioral2/memory/4424-132-0x0000000000400000-0x00000000004F1000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 1248 4424 WerFault.exe 80 -
Kills process with taskkill 1 IoCs
pid Process 4268 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4268 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4424 wrote to memory of 64 4424 a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe 83 PID 4424 wrote to memory of 64 4424 a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe 83 PID 4424 wrote to memory of 64 4424 a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe 83 PID 64 wrote to memory of 4268 64 cmd.exe 87 PID 64 wrote to memory of 4268 64 cmd.exe 87 PID 64 wrote to memory of 4268 64 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe"C:\Users\Admin\AppData\Local\Temp\a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4424 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:64 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "a616ad2a94b21ef8eb938dfaef352b22273422da4240b52ac859b258587723b1.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4268
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4424 -s 12762⤵
- Program crash
PID:1248
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4424 -ip 44241⤵PID:4252