onlylogger | 3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641 | Triage

Analysis

max time kernel
152s
max time network
167s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
03-07-2022 08:11

Sharing

Report Analysis Logs

General

Target

3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
Size

422KB
MD5

cfca9ac2b0a1b969f80dfa7f76ed131e
SHA1

404c46ee53a8a47941a342bb2924e5cd5ff0495d
SHA256

3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641
SHA512

f9a42bcf75b76dada47a0febb9710b72a2a1f2c31b1c9e01fb4533edd159664fd55e784d13dc191603e52946b97aa96e5a923fbaf1237273d873bfe7573e189b

Score

10^/10

onlylogger loader suricata

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata: ET MALWARE Possible Zeus GameOver/FluBot Related DGA NXDOMAIN Responses
suricata

OnlyLogger Payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1872-131-0x0000000002BD0000-0x0000000002C14000-memory.dmp	family_onlylogger
behavioral2/memory/1872-132-0x0000000000400000-0x0000000002BC3000-memory.dmp	family_onlylogger

Program crash 9 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5096	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
5036	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
4256	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
4652	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
4604	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
4592	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
2000	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
1600	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
3132	1872	WerFault.exe	3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe

C:\Users\Admin\AppData\Local\Temp\3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe
"C:\Users\Admin\AppData\Local\Temp\3c3a3e87ec02e301b748c730a7c379424e93e6f3bbe2128000b8f33084b7d641.exe"
1⤵
PID:1872

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 632
2⤵
- Program crash
PID:5096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 640
2⤵
- Program crash
PID:5036

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 740
2⤵
- Program crash
PID:4256

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 816
2⤵
- Program crash
PID:4652

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 752
2⤵
- Program crash
PID:4604

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 912
2⤵
- Program crash
PID:4592

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 1072
2⤵
- Program crash
PID:2000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 1944
2⤵
- Program crash
PID:1600

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 648
2⤵
- Program crash
PID:3132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 1872 -ip 1872
1⤵
PID:3856

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 1872 -ip 1872
1⤵
PID:3720

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1872 -ip 1872
1⤵
PID:2668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1872 -ip 1872
1⤵
PID:4748

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1872 -ip 1872
1⤵
PID:1972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1872 -ip 1872
1⤵
PID:5100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1872 -ip 1872
1⤵
PID:2616

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 1872 -ip 1872
1⤵
PID:4824

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 1872 -ip 1872
1⤵
PID:4568

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1872-130-0x0000000002D93000-0x0000000002DBA000-memory.dmp

Filesize
156KB

Download
memory/1872-131-0x0000000002BD0000-0x0000000002C14000-memory.dmp

Filesize
272KB

Download
memory/1872-132-0x0000000000400000-0x0000000002BC3000-memory.dmp

Filesize
39.8MB

Download