Analysis
-
max time kernel
125s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-04-2022 12:01
Static task
static1
Behavioral task
behavioral1
Sample
ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe
Resource
win10v2004-20220414-en
General
-
Target
ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe
-
Size
293KB
-
MD5
3558dd95b0781abdbf68553e9fade5d2
-
SHA1
841d66b95cb59561cdac3b24cd9bddd342b43a60
-
SHA256
ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68
-
SHA512
46a742670dab503e2ee2970d2c0aa004098ec523e22df44969c1aed3899f2c7509e4055d35d38ec3839247161dabfe98de04e97d21807257c8d3553d9bb3b00b
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
resource yara_rule behavioral2/memory/1788-131-0x0000000002290000-0x00000000022D6000-memory.dmp family_onlylogger behavioral2/memory/1788-132-0x0000000000400000-0x0000000000503000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1081944012-3634099177-1681222835-1000\Control Panel\International\Geo\Nation ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
pid pid_target Process procid_target 1092 1788 WerFault.exe 80 2104 1788 WerFault.exe 80 1520 1788 WerFault.exe 80 1220 1788 WerFault.exe 80 3568 1788 WerFault.exe 80 2332 1788 WerFault.exe 80 2504 1788 WerFault.exe 80 4856 1788 WerFault.exe 80 -
Kills process with taskkill 1 IoCs
pid Process 3496 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3496 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1788 wrote to memory of 4868 1788 ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe 99 PID 1788 wrote to memory of 4868 1788 ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe 99 PID 1788 wrote to memory of 4868 1788 ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe 99 PID 4868 wrote to memory of 3496 4868 cmd.exe 103 PID 4868 wrote to memory of 3496 4868 cmd.exe 103 PID 4868 wrote to memory of 3496 4868 cmd.exe 103
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe"C:\Users\Admin\AppData\Local\Temp\ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1788 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 6202⤵
- Program crash
PID:1092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 6602⤵
- Program crash
PID:2104
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 5482⤵
- Program crash
PID:1520
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 8082⤵
- Program crash
PID:1220
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 8122⤵
- Program crash
PID:3568
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 10882⤵
- Program crash
PID:2332
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 12562⤵
- Program crash
PID:2504
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4868 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ae2b0e8314c477c7923cabf9e357c3d11b96c0871c6ae74a5e9cc75b0c9afd68.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1788 -s 14082⤵
- Program crash
PID:4856
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1788 -ip 17881⤵PID:32
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1788 -ip 17881⤵PID:3164
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1788 -ip 17881⤵PID:1492
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1788 -ip 17881⤵PID:3460
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1788 -ip 17881⤵PID:4456
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1788 -ip 17881⤵PID:3900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1788 -ip 17881⤵PID:5040
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 624 -p 1788 -ip 17881⤵PID:1504