Analysis
-
max time kernel
90s -
max time network
137s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-06-2022 18:16
Static task
static1
Behavioral task
behavioral1
Sample
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe
Resource
win10v2004-20220414-en
General
-
Target
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe
-
Size
330KB
-
MD5
b1d2c89e74f0ec2ada4a2e22bc2b3cf3
-
SHA1
e39914dc8958516442e0c8e2cbe8050162dbca55
-
SHA256
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df
-
SHA512
c2f20835f66ef28c48a11ab7579d928c9dedb639a1b7af40b13bed8b16be9985da573819ddbebe85ac44cc91406d1bbe3e74c6e59b5a85277070d58d2ca27200
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3212-131-0x0000000004900000-0x0000000004946000-memory.dmp family_onlylogger behavioral2/memory/3212-132-0x0000000000400000-0x00000000047D3000-memory.dmp family_onlylogger behavioral2/memory/3212-136-0x0000000000400000-0x00000000047D3000-memory.dmp family_onlylogger -
Processes:
resource yara_rule behavioral2/memory/3212-130-0x0000000000400000-0x00000000047D3000-memory.dmp upx -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4688 3212 WerFault.exe 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2732 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 2732 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.execmd.exedescription pid process target process PID 3212 wrote to memory of 1428 3212 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe cmd.exe PID 3212 wrote to memory of 1428 3212 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe cmd.exe PID 3212 wrote to memory of 1428 3212 94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe cmd.exe PID 1428 wrote to memory of 2732 1428 cmd.exe taskkill.exe PID 1428 wrote to memory of 2732 1428 cmd.exe taskkill.exe PID 1428 wrote to memory of 2732 1428 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe"C:\Users\Admin\AppData\Local\Temp\94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "94dbe686e1458a9eec6d49ec38e1b98b3b4710dfb86d451fd1b28ad3fe3fc5df.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3212 -s 12642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3212 -ip 32121⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1428-134-0x0000000000000000-mapping.dmp
-
memory/2732-135-0x0000000000000000-mapping.dmp
-
memory/3212-130-0x0000000000400000-0x00000000047D3000-memory.dmpFilesize
67.8MB
-
memory/3212-131-0x0000000004900000-0x0000000004946000-memory.dmpFilesize
280KB
-
memory/3212-132-0x0000000000400000-0x00000000047D3000-memory.dmpFilesize
67.8MB
-
memory/3212-133-0x00000000001C0000-0x00000000001E8000-memory.dmpFilesize
160KB
-
memory/3212-136-0x0000000000400000-0x00000000047D3000-memory.dmpFilesize
67.8MB