Analysis
-
max time kernel
148s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-07-2022 07:25
Static task
static1
Behavioral task
behavioral1
Sample
3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe
Resource
win10v2004-20220414-en
General
-
Target
3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe
-
Size
435KB
-
MD5
c1fbe1e2fce911062f0d6b933e8689c3
-
SHA1
9d21b8582bbbecea6a67ce40906a975d99504b03
-
SHA256
3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62
-
SHA512
ba46705dfca8cb75707ca07b87f876a1217932522a7c14a69ccdc7822940aa8d9abdeeefba8517044d133b55041ecd8771c69c790b5ea2bc25e32fc1a1c69e3a
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1820-131-0x0000000000970000-0x00000000009B9000-memory.dmp family_onlylogger behavioral2/memory/1820-132-0x0000000000400000-0x000000000089C000-memory.dmp family_onlylogger behavioral2/memory/1820-135-0x0000000000400000-0x000000000089C000-memory.dmp family_onlylogger -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 8 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3452 1820 WerFault.exe 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe 4208 1820 WerFault.exe 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe 2040 1820 WerFault.exe 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe 3820 1820 WerFault.exe 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe 388 1820 WerFault.exe 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe 960 1820 WerFault.exe 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe 1996 1820 WerFault.exe 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe 4512 1820 WerFault.exe 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4508 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 4508 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.execmd.exedescription pid process target process PID 1820 wrote to memory of 4008 1820 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe cmd.exe PID 1820 wrote to memory of 4008 1820 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe cmd.exe PID 1820 wrote to memory of 4008 1820 3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe cmd.exe PID 4008 wrote to memory of 4508 4008 cmd.exe taskkill.exe PID 4008 wrote to memory of 4508 4008 cmd.exe taskkill.exe PID 4008 wrote to memory of 4508 4008 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe"C:\Users\Admin\AppData\Local\Temp\3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 6882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 7642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 7602⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 9282⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 9442⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 9642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 9522⤵
- Program crash
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "3c74459ec6c11dd5a32d154b27eed6b90c1359edd2edb9f662a5bf9f0e7faf62.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 11322⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1820 -ip 18201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1820 -ip 18201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1820 -ip 18201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 360 -p 1820 -ip 18201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 1820 -ip 18201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1820 -ip 18201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1820 -ip 18201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1820 -ip 18201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1820-130-0x0000000000BD3000-0x0000000000BFC000-memory.dmpFilesize
164KB
-
memory/1820-131-0x0000000000970000-0x00000000009B9000-memory.dmpFilesize
292KB
-
memory/1820-132-0x0000000000400000-0x000000000089C000-memory.dmpFilesize
4.6MB
-
memory/1820-135-0x0000000000400000-0x000000000089C000-memory.dmpFilesize
4.6MB
-
memory/4008-133-0x0000000000000000-mapping.dmp
-
memory/4508-134-0x0000000000000000-mapping.dmp