onlylogger | 0fdfa2a4726c7e7035d89aee7e404691139cd4f96dda0bbde9c364d12a50b82d

Analysis

max time kernel
161s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
04/06/2022, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0fdfa2a4726c7e7035d89aee7e404691139cd4f96dda0bbde9c364d12a50b82d.exe
Size 339KB
Sample220604-rjhrfsafa3
SHA256 0fdfa2a4726c7e7035d89aee7e404691139cd4f96dda0bbde9c364d12a50b82d
MD5 ce5dd4babfc31b8afc2fe5ac34d4e7d2
SHA1 5847adb93060a59a3573e64b3a46df6d0e122b6b
SHA512 94b1d0e449398a7506b91212ee545922d80be1ce433a5f2898646d90a601a09d7fd970e2f54fe515c8d35c8ffed2a2947601958e4a19f10e44779805ea9bff79
MD5 SHA1 SHA512

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger Payload 2 IoCs

resource	yara_rule
behavioral2/memory/60-131-0x0000000000910000-0x0000000000954000-memory.dmp	family_onlylogger
behavioral2/memory/60-132-0x0000000000400000-0x000000000066D000-memory.dmp	family_onlylogger

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4352	60	WerFault.exe	76
3924	60	WerFault.exe	76
4936	60	WerFault.exe	76
4964	60	WerFault.exe	76
4396	60	WerFault.exe	76
5108	60	WerFault.exe	76
4552	60	WerFault.exe	76
1292	60	WerFault.exe	76
4432	60	WerFault.exe	76

C:\Users\Admin\AppData\Local\Temp\0fdfa2a4726c7e7035d89aee7e404691139cd4f96dda0bbde9c364d12a50b82d.exe
"C:\Users\Admin\AppData\Local\Temp\0fdfa2a4726c7e7035d89aee7e404691139cd4f96dda0bbde9c364d12a50b82d.exe"
1⤵
PID:60
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 624
  2⤵
  - Program crash
  PID:4352
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 660
  2⤵
  - Program crash
  PID:3924
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 752
  2⤵
  - Program crash
  PID:4936
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 788
  2⤵
  - Program crash
  PID:4964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 1028
  2⤵
  - Program crash
  PID:4396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 1072
  2⤵
  - Program crash
  PID:5108
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 1296
  2⤵
  - Program crash
  PID:4552
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 1768
  2⤵
  - Program crash
  PID:1292
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 60 -s 1032
  2⤵
  - Program crash
  PID:4432

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 60 -ip 60
1⤵
PID:4228

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 60 -ip 60
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 60 -ip 60
1⤵
PID:3300

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 60 -ip 60
1⤵
PID:5032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 60 -ip 60
1⤵
PID:4896

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 60 -ip 60
1⤵
PID:5116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 60 -ip 60
1⤵
PID:5080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 60 -ip 60
1⤵
PID:1344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 60 -ip 60
1⤵
PID:1952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/60-130-0x00000000007B0000-0x00000000007D7000-memory.dmp

Download

memory/60-131-0x0000000000910000-0x0000000000954000-memory.dmp

Download

memory/60-132-0x0000000000400000-0x000000000066D000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads