Analysis
-
max time kernel
37s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
12-05-2022 12:00
Static task
static1
Behavioral task
behavioral1
Sample
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe
Resource
win10v2004-20220414-en
General
-
Target
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe
-
Size
227KB
-
MD5
2af5a00d00befdcbc1a04d8a993ddfeb
-
SHA1
838211204c6a17149aa027882d4be61c4b29ce33
-
SHA256
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39
-
SHA512
866efcf751fe16d1607a17d16248b9bf68127f455a90c485628d7d45fce7155b705b38882e6bad83c9c926b5fad3189914e08312aa775b481678daf5dd5fc97b
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1296-57-0x0000000000220000-0x0000000000266000-memory.dmp family_onlylogger behavioral1/memory/1296-58-0x0000000000400000-0x0000000000F96000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
Processes:
cmd.exepid Process 2000 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid Process 1832 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid Process Token: SeDebugPrivilege 1832 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.execmd.exedescription pid Process procid_target PID 1296 wrote to memory of 2000 1296 4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe 26 PID 1296 wrote to memory of 2000 1296 4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe 26 PID 1296 wrote to memory of 2000 1296 4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe 26 PID 1296 wrote to memory of 2000 1296 4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe 26 PID 2000 wrote to memory of 1832 2000 cmd.exe 28 PID 2000 wrote to memory of 1832 2000 cmd.exe 28 PID 2000 wrote to memory of 1832 2000 cmd.exe 28 PID 2000 wrote to memory of 1832 2000 cmd.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe"C:\Users\Admin\AppData\Local\Temp\4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1296 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1832
-
-