Analysis
-
max time kernel
63s -
max time network
170s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
03-07-2022 08:11
Static task
static1
Behavioral task
behavioral1
Sample
3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
Resource
win10v2004-20220414-en
General
-
Target
3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
-
Size
422KB
-
MD5
cfca9ac2b0a1b969f80dfa7f76ed131e
-
SHA1
404c46ee53a8a47941a342bb2924e5cd5ff0495d
-
SHA256
3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641
-
SHA512
f9a42bcf75b76dada47a0febb9710b72a2a1f2c31b1c9e01fb4533edd159664fd55e784d13dc191603e52946b97aa96e5a923fbaf1237273d873bfe7573e189b
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/108-57-0x0000000000270000-0x00000000002B4000-memory.dmp family_onlylogger behavioral1/memory/108-58-0x0000000000400000-0x0000000002BC3000-memory.dmp family_onlylogger -
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/108-54-0x0000000002D98000-0x0000000002DC0000-memory.dmpFilesize
160KB
-
memory/108-55-0x0000000075A61000-0x0000000075A63000-memory.dmpFilesize
8KB
-
memory/108-56-0x0000000002D98000-0x0000000002DC0000-memory.dmpFilesize
160KB
-
memory/108-57-0x0000000000270000-0x00000000002B4000-memory.dmpFilesize
272KB
-
memory/108-58-0x0000000000400000-0x0000000002BC3000-memory.dmpFilesize
39.8MB
-
memory/108-59-0x0000000002D98000-0x0000000002DC0000-memory.dmpFilesize
160KB