Analysis
-
max time kernel
41s -
max time network
56s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-04-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe
Resource
win10v2004-20220414-en
General
-
Target
2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe
-
Size
377KB
-
MD5
fc9b47ae8962c3d595cfdf97b657f418
-
SHA1
0801a1c1426327ceec63c195399770753b080c12
-
SHA256
2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c
-
SHA512
fb1fd9e367a1f0f39a9674837812b75cb0fefac2dcfc11a45cd3430039f9b6983e91a75f0705a8d86ec7579c2315a23e2549524b681aab2a138e3ba0d30dec5e
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
resource yara_rule behavioral1/memory/908-57-0x00000000002E0000-0x0000000000326000-memory.dmp family_onlylogger behavioral1/memory/908-58-0x0000000000400000-0x0000000000519000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
pid Process 2004 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 1960 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1960 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 908 wrote to memory of 2004 908 2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe 27 PID 908 wrote to memory of 2004 908 2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe 27 PID 908 wrote to memory of 2004 908 2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe 27 PID 908 wrote to memory of 2004 908 2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe 27 PID 2004 wrote to memory of 1960 2004 cmd.exe 29 PID 2004 wrote to memory of 1960 2004 cmd.exe 29 PID 2004 wrote to memory of 1960 2004 cmd.exe 29 PID 2004 wrote to memory of 1960 2004 cmd.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe"C:\Users\Admin\AppData\Local\Temp\2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:908 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1960
-
-