onlylogger | 7da1b87c80b960324cf66de21fb10d04c9a22864786926fe3965ea9f56353d11 | Triage

Analysis

max time kernel
151s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
01-07-2022 13:44

Sharing

Report Analysis Logs

General

Target

new.exe
Size

498KB
MD5

d45be0997ab95f6b3881b14528276a75
SHA1

9bfd019c5de71af44fff2c48b7929271c5bdf0dc
SHA256

7da1b87c80b960324cf66de21fb10d04c9a22864786926fe3965ea9f56353d11
SHA512

75f8bd0ada1bcd961847d7b21c1cc8c4a5a913452959e37f96516b2cf752696c45d01d91afbae24e3f79536d6ab6ad77c7f43ca560a6bfeb992acb685c35506c

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/752-131-0x0000000000A10000-0x0000000000A3D000-memory.dmp	family_onlylogger
behavioral1/memory/752-132-0x0000000000400000-0x0000000000867000-memory.dmp	family_onlylogger

Program crash 6 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4072	752	WerFault.exe	new.exe
5100	752	WerFault.exe	new.exe
4400	752	WerFault.exe	new.exe
3544	752	WerFault.exe	new.exe
548	752	WerFault.exe	new.exe
232	752	WerFault.exe	new.exe

C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
1⤵
PID:752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 620
2⤵
- Program crash
PID:4072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 640
2⤵
- Program crash
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 648
2⤵
- Program crash
PID:4400

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 648
2⤵
- Program crash
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 532
2⤵
- Program crash
PID:548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 752 -s 532
2⤵
- Program crash
PID:232

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 752 -ip 752
1⤵
PID:1324

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 752 -ip 752
1⤵
PID:4476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 752 -ip 752
1⤵
PID:4332

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 752 -ip 752
1⤵
PID:572

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 752 -ip 752
1⤵
PID:4764

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 752 -ip 752
1⤵
PID:3680

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/752-130-0x00000000008B9000-0x00000000008D4000-memory.dmp

Filesize
108KB

Download
memory/752-131-0x0000000000A10000-0x0000000000A3D000-memory.dmp

Filesize
180KB

Download
memory/752-132-0x0000000000400000-0x0000000000867000-memory.dmp

Filesize
4.4MB

Download
memory/752-133-0x00000000008B9000-0x00000000008D4000-memory.dmp

Filesize
108KB

Download