Analysis
-
max time kernel
95s -
max time network
140s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
12-05-2022 12:00
Static task
static1
Behavioral task
behavioral1
Sample
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe
Resource
win10v2004-20220414-en
General
-
Target
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe
-
Size
227KB
-
MD5
2af5a00d00befdcbc1a04d8a993ddfeb
-
SHA1
838211204c6a17149aa027882d4be61c4b29ce33
-
SHA256
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39
-
SHA512
866efcf751fe16d1607a17d16248b9bf68127f455a90c485628d7d45fce7155b705b38882e6bad83c9c926b5fad3189914e08312aa775b481678daf5dd5fc97b
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4032-131-0x0000000001070000-0x00000000010B6000-memory.dmp family_onlylogger behavioral2/memory/4032-132-0x0000000000400000-0x0000000000F96000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 4780 4032 WerFault.exe 82 -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid Process 1924 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid Process Token: SeDebugPrivilege 1924 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.execmd.exedescription pid Process procid_target PID 4032 wrote to memory of 4784 4032 4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe 84 PID 4032 wrote to memory of 4784 4032 4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe 84 PID 4032 wrote to memory of 4784 4032 4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe 84 PID 4784 wrote to memory of 1924 4784 cmd.exe 87 PID 4784 wrote to memory of 1924 4784 cmd.exe 87 PID 4784 wrote to memory of 1924 4784 cmd.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe"C:\Users\Admin\AppData\Local\Temp\4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
PID:4784 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im "4ce6cd07bcac1f637e4b5202c91957d3b3d0f77c19dbe53e0ef30f7baf766f39.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1924
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4032 -s 10762⤵
- Program crash
PID:4780
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4032 -ip 40321⤵PID:2020