onlylogger | 2b54528c6bd185b8ca01db6f9e9f9bfbaf8aedcf7e9b02e959b8e6ef93a693d6

Analysis

max time kernel
173s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
15/06/2022, 02:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2b54528c6bd185b8ca01db6f9e9f9bfbaf8aedcf7e9b02e959b8e6ef93a693d6.exe
Size 362KB
Sample220615-c2tt4sdbc3
SHA256 2b54528c6bd185b8ca01db6f9e9f9bfbaf8aedcf7e9b02e959b8e6ef93a693d6
MD5 0a0c4acc35ac87df533f3f56e3effd68
SHA1 a6dcca97f3b4250281bbdcc969a83ae7f32a0b4d
SHA512 3b0a3b3ce241e8e244647777d3c457bcb6af85dabf19f3e13a7c556b20cbe5fdff6a2d676087c452de8b2911a08b2a566840a5c5882176f66e61d0ad9fcf8cd3
MD5 SHA1 SHA512

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2628-131-0x0000000002120000-0x0000000002164000-memory.dmp	family_onlylogger
behavioral2/memory/2628-132-0x0000000000400000-0x0000000000484000-memory.dmp	family_onlylogger

Program crash 8 IoCs

pid	pid_target	Process	procid_target
4640	2628	WerFault.exe	56
868	2628	WerFault.exe	56
4428	2628	WerFault.exe	56
1528	2628	WerFault.exe	56
4808	2628	WerFault.exe	56
4328	2628	WerFault.exe	56
4308	2628	WerFault.exe	56
5052	2628	WerFault.exe	56

C:\Users\Admin\AppData\Local\Temp\2b54528c6bd185b8ca01db6f9e9f9bfbaf8aedcf7e9b02e959b8e6ef93a693d6.exe
"C:\Users\Admin\AppData\Local\Temp\2b54528c6bd185b8ca01db6f9e9f9bfbaf8aedcf7e9b02e959b8e6ef93a693d6.exe"
1⤵
PID:2628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 640
  2⤵
  - Program crash
  PID:4640
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 648
  2⤵
  - Program crash
  PID:868
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 588
  2⤵
  - Program crash
  PID:4428
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 584
  2⤵
  - Program crash
  PID:1528
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 912
  2⤵
  - Program crash
  PID:4808
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 1096
  2⤵
  - Program crash
  PID:4328
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 1296
  2⤵
  - Program crash
  PID:4308
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2628 -s 1348
  2⤵
  - Program crash
  PID:5052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2628 -ip 2628
1⤵
PID:1000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2628 -ip 2628
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2628 -ip 2628
1⤵
PID:4472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 504 -p 2628 -ip 2628
1⤵
PID:4504

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2628 -ip 2628
1⤵
PID:1576

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2628 -ip 2628
1⤵
PID:2032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2628 -ip 2628
1⤵
PID:3344

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2628 -ip 2628
1⤵
PID:224

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2628-130-0x000000000058D000-0x00000000005B5000-memory.dmp

Download

memory/2628-131-0x0000000002120000-0x0000000002164000-memory.dmp

Download

memory/2628-132-0x0000000000400000-0x0000000000484000-memory.dmp

Download

memory/2628-133-0x000000000058D000-0x00000000005B5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads