Analysis
-
max time kernel
60s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe
Resource
win10v2004-20220414-en
General
-
Target
ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe
-
Size
293KB
-
MD5
3558dd95b0781abdbf68553e9fade5d2
-
SHA1
841d66b95cb59561cdac3b24cd9bddd342b43a60
-
SHA256
ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68
-
SHA512
46a742670dab503e2ee2970d2c0aa004098ec523e22df44969c1aed3899f2c7509e4055d35d38ec3839247161dabfe98de04e97d21807257c8d3553d9bb3b00b
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
resource yara_rule behavioral1/memory/908-57-0x00000000001B0000-0x00000000001F6000-memory.dmp family_onlylogger behavioral1/memory/908-58-0x0000000000400000-0x0000000000503000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
pid Process 2028 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1976 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1976 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 908 wrote to memory of 2028 908 ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe 28 PID 908 wrote to memory of 2028 908 ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe 28 PID 908 wrote to memory of 2028 908 ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe 28 PID 908 wrote to memory of 2028 908 ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe 28 PID 2028 wrote to memory of 1976 2028 cmd.exe 30 PID 2028 wrote to memory of 1976 2028 cmd.exe 30 PID 2028 wrote to memory of 1976 2028 cmd.exe 30 PID 2028 wrote to memory of 1976 2028 cmd.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe"C:\Users\Admin\AppData\Local\Temp\ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
-