onlylogger | 3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f

General

Target

3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe
Size

331KB
MD5

b2a69cc061804bf1d720f3179eb2880d
SHA1

3d94e67d3a4cda0fab72e94eb0b6eb359c4fa2ab
SHA256

3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f
SHA512

9ddbb9af6f1aaa124969a597adb57169da8e24543336eaa003c4cd96a16c788c86ec28b404085da813d997df23f153f5a91e1bc08339b64e643f493054bc8423

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger Payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/756-55-0x0000000000400000-0x00000000047D2000-memory.dmp	family_onlylogger
behavioral1/memory/756-57-0x0000000000300000-0x0000000000346000-memory.dmp	family_onlylogger
behavioral1/memory/756-60-0x0000000000400000-0x00000000047D2000-memory.dmp	family_onlylogger

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

1744 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 1744 taskkill.exe

pid	process
1744	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	1744	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.execmd.exe

description	pid	process	target process
PID 756 wrote to memory of 1976	756	3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe	cmd.exe
PID 756 wrote to memory of 1976	756	3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe	cmd.exe
PID 756 wrote to memory of 1976	756	3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe	cmd.exe
PID 756 wrote to memory of 1976	756	3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe	cmd.exe
PID 1976 wrote to memory of 1744	1976	cmd.exe	taskkill.exe
PID 1976 wrote to memory of 1744	1976	cmd.exe	taskkill.exe
PID 1976 wrote to memory of 1744	1976	cmd.exe	taskkill.exe
PID 1976 wrote to memory of 1744	1976	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe
"C:\Users\Admin\AppData\Local\Temp\3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:756

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:1976

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1744

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/756-54-0x00000000763E1000-0x00000000763E3000-memory.dmp

Filesize
8KB

Download
memory/756-55-0x0000000000400000-0x00000000047D2000-memory.dmp

Filesize
67.8MB

Download
memory/756-57-0x0000000000300000-0x0000000000346000-memory.dmp

Filesize
280KB

Download
memory/756-56-0x0000000000250000-0x0000000000278000-memory.dmp

Filesize
160KB

Download
memory/756-60-0x0000000000400000-0x00000000047D2000-memory.dmp

Filesize
67.8MB

Download
memory/1744-59-0x0000000000000000-mapping.dmp

Download
memory/1976-58-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing