Analysis
-
max time kernel
61s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-04-2022 12:02
Static task
static1
Behavioral task
behavioral1
Sample
2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe
Resource
win10v2004-20220414-en
General
-
Target
2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe
-
Size
377KB
-
MD5
fc9b47ae8962c3d595cfdf97b657f418
-
SHA1
0801a1c1426327ceec63c195399770753b080c12
-
SHA256
2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c
-
SHA512
fb1fd9e367a1f0f39a9674837812b75cb0fefac2dcfc11a45cd3430039f9b6983e91a75f0705a8d86ec7579c2315a23e2549524b681aab2a138e3ba0d30dec5e
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
resource yara_rule behavioral2/memory/456-131-0x0000000002110000-0x0000000002156000-memory.dmp family_onlylogger behavioral2/memory/456-132-0x0000000000400000-0x0000000000519000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 4448 456 WerFault.exe 80 -
Kills process with taskkill 1 IoCs
pid Process 1104 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1104 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 456 wrote to memory of 800 456 2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe 81 PID 456 wrote to memory of 800 456 2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe 81 PID 456 wrote to memory of 800 456 2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe 81 PID 800 wrote to memory of 1104 800 cmd.exe 85 PID 800 wrote to memory of 1104 800 cmd.exe 85 PID 800 wrote to memory of 1104 800 cmd.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe"C:\Users\Admin\AppData\Local\Temp\2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:456 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "2ec373a4e410e0f1cfd2d6da931f219934f3d7c9f9e68be9d56262aae65e356c.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1104
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 456 -s 12562⤵
- Program crash
PID:4448
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 456 -ip 4561⤵PID:3020