Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
30-06-2022 18:16
Static task
static1
Behavioral task
behavioral1
Sample
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe
Resource
win10v2004-20220414-en
General
-
Target
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe
-
Size
330KB
-
MD5
b1d2c89e74f0ec2ada4a2e22bc2b3cf3
-
SHA1
e39914dc8958516442e0c8e2cbe8050162dbca55
-
SHA256
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df
-
SHA512
c2f20835f66ef28c48a11ab7579d928c9dedb639a1b7af40b13bed8b16be9985da573819ddbebe85ac44cc91406d1bbe3e74c6e59b5a85277070d58d2ca27200
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2024-55-0x0000000000400000-0x00000000047D3000-memory.dmp family_onlylogger behavioral1/memory/2024-57-0x0000000000310000-0x0000000000356000-memory.dmp family_onlylogger behavioral1/memory/2024-60-0x0000000000400000-0x00000000047D3000-memory.dmp family_onlylogger -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 832 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 832 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.execmd.exedescription pid process target process PID 2024 wrote to memory of 1672 2024 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe cmd.exe PID 2024 wrote to memory of 1672 2024 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe cmd.exe PID 2024 wrote to memory of 1672 2024 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe cmd.exe PID 2024 wrote to memory of 1672 2024 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe cmd.exe PID 1672 wrote to memory of 832 1672 cmd.exe taskkill.exe PID 1672 wrote to memory of 832 1672 cmd.exe taskkill.exe PID 1672 wrote to memory of 832 1672 cmd.exe taskkill.exe PID 1672 wrote to memory of 832 1672 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe"C:\Users\Admin\AppData\Local\Temp\94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/832-59-0x0000000000000000-mapping.dmp
-
memory/1672-58-0x0000000000000000-mapping.dmp
-
memory/2024-54-0x0000000076011000-0x0000000076013000-memory.dmpFilesize
8KB
-
memory/2024-55-0x0000000000400000-0x00000000047D3000-memory.dmpFilesize
67.8MB
-
memory/2024-56-0x0000000000220000-0x0000000000248000-memory.dmpFilesize
160KB
-
memory/2024-57-0x0000000000310000-0x0000000000356000-memory.dmpFilesize
280KB
-
memory/2024-60-0x0000000000400000-0x00000000047D3000-memory.dmpFilesize
67.8MB