Analysis
-
max time kernel
108s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
18-04-2022 16:14
Static task
static1
Behavioral task
behavioral1
Sample
ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe
Resource
win10v2004-20220414-en
General
-
Target
ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe
-
Size
350KB
-
MD5
ec20f59c643f79deb7283f412064de0c
-
SHA1
63c6c812dcaabb37af21221543a6a67e828233d1
-
SHA256
ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69
-
SHA512
1c4d907c6159c5eb9e962d3ea49aad7efaaf9657c9c400da547ef1cc244fe4a1ee6eb55112552b8cc3b5cabd35bc6234c469991276a0bc064a632a5721cd4dec
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
resource yara_rule behavioral2/memory/1376-132-0x0000000002970000-0x00000000029B6000-memory.dmp family_onlylogger behavioral2/memory/1376-133-0x0000000000400000-0x0000000000C31000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 9 IoCs
pid pid_target Process procid_target 1276 1376 WerFault.exe 78 4624 1376 WerFault.exe 78 5080 1376 WerFault.exe 78 4824 1376 WerFault.exe 78 4676 1376 WerFault.exe 78 4404 1376 WerFault.exe 78 4292 1376 WerFault.exe 78 3816 1376 WerFault.exe 78 2216 1376 WerFault.exe 78 -
Kills process with taskkill 1 IoCs
pid Process 2236 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2236 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1376 wrote to memory of 4612 1376 ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe 97 PID 1376 wrote to memory of 4612 1376 ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe 97 PID 1376 wrote to memory of 4612 1376 ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe 97 PID 4612 wrote to memory of 2236 4612 cmd.exe 101 PID 4612 wrote to memory of 2236 4612 cmd.exe 101 PID 4612 wrote to memory of 2236 4612 cmd.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe"C:\Users\Admin\AppData\Local\Temp\ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 6122⤵
- Program crash
PID:1276
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 6322⤵
- Program crash
PID:4624
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 6402⤵
- Program crash
PID:5080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 7602⤵
- Program crash
PID:4824
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 8002⤵
- Program crash
PID:4676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 8602⤵
- Program crash
PID:4404
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 10642⤵
- Program crash
PID:4292
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 12322⤵
- Program crash
PID:3816
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "ee5b6ae8714a10c59d415b59114d1c6901a9dfc60f0b1111eabd49a6ca0b5d69.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2236
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1376 -s 12682⤵
- Program crash
PID:2216
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 1376 -ip 13761⤵PID:4088
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1376 -ip 13761⤵PID:4356
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1376 -ip 13761⤵PID:1668
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1376 -ip 13761⤵PID:4844
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1376 -ip 13761⤵PID:2068
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1376 -ip 13761⤵PID:4900
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1376 -ip 13761⤵PID:4756
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 1376 -ip 13761⤵PID:5064
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1376 -ip 13761⤵PID:4580