onlylogger | 3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f

General

Target

3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe
Size

331KB
MD5

b2a69cc061804bf1d720f3179eb2880d
SHA1

3d94e67d3a4cda0fab72e94eb0b6eb359c4fa2ab
SHA256

3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f
SHA512

9ddbb9af6f1aaa124969a597adb57169da8e24543336eaa003c4cd96a16c788c86ec28b404085da813d997df23f153f5a91e1bc08339b64e643f493054bc8423

Score

10^/10

onlylogger loader upx

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger Payload 4 IoCs

Processes:

resource	yara_rule
behavioral2/memory/996-131-0x00000000047E0000-0x0000000004826000-memory.dmp	family_onlylogger
behavioral2/memory/996-133-0x0000000000400000-0x00000000047D2000-memory.dmp	family_onlylogger
behavioral2/memory/996-134-0x00000000047E0000-0x0000000004826000-memory.dmp	family_onlylogger
behavioral2/memory/996-137-0x0000000000400000-0x00000000047D2000-memory.dmp	family_onlylogger

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/996-130-0x0000000000400000-0x00000000047D2000-memory.dmp	upx

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2028 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 2028 taskkill.exe

pid	process
2028	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	2028	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.execmd.exe

description	pid	process	target process
PID 996 wrote to memory of 916	996	3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe	cmd.exe
PID 996 wrote to memory of 916	996	3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe	cmd.exe
PID 996 wrote to memory of 916	996	3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe	cmd.exe
PID 916 wrote to memory of 2028	916	cmd.exe	taskkill.exe
PID 916 wrote to memory of 2028	916	cmd.exe	taskkill.exe
PID 916 wrote to memory of 2028	916	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe
"C:\Users\Admin\AppData\Local\Temp\3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:916

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "3549ee744fcc5216277e4d687d71221459ee8735cc68033eb4df70c2341cd12f.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2028

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/916-135-0x0000000000000000-mapping.dmp

Download
memory/996-130-0x0000000000400000-0x00000000047D2000-memory.dmp

Filesize
67.8MB

Download
memory/996-131-0x00000000047E0000-0x0000000004826000-memory.dmp

Filesize
280KB

Download
memory/996-132-0x00000000001D0000-0x00000000001F8000-memory.dmp

Filesize
160KB

Download
memory/996-133-0x0000000000400000-0x00000000047D2000-memory.dmp

Filesize
67.8MB

Download
memory/996-134-0x00000000047E0000-0x0000000004826000-memory.dmp

Filesize
280KB

Download
memory/996-137-0x0000000000400000-0x00000000047D2000-memory.dmp

Filesize
67.8MB

Download
memory/2028-136-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads