Overview

overview

10

Static

static

46e2db7081...fb.exe

windows7_x64

10

46e2db7081...fb.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    151s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    14-07-2022 08:25

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    46e2db7081cfa3a19b4c740c103ca3db02234c1aa5c4addf15ae2a09ab7a99fb.exe

  • Size

    301KB

  • MD5

    6a7fa81b5d9147c23b0ba79e6e715fd1

  • SHA1

    b2b7f2ef21e255b81ebf09fb0ffe077edec059b7

  • SHA256

    46e2db7081cfa3a19b4c740c103ca3db02234c1aa5c4addf15ae2a09ab7a99fb

  • SHA512

    0da996b9c356d5a0cb3ac0b2fdb7e3511b46eb1840664cc8ab87a9cb23f721d6ee2580f24392f87093704c25ae0c851e7e4ff86c539403a4f0e050cf5f8c1690

Score
10/10
onlyloggerloader

Malware Config

Signatures

  • OnlyLogger

    A tiny loader that uses IPLogger to get its payload.

    loaderonlylogger
  • OnlyLogger payload 2 IoCs
  • Program crash 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\46e2db7081cfa3a19b4c740c103ca3db02234c1aa5c4addf15ae2a09ab7a99fb.exe
    "C:\Users\Admin\AppData\Local\Temp\46e2db7081cfa3a19b4c740c103ca3db02234c1aa5c4addf15ae2a09ab7a99fb.exe"
    1⤵
      PID:4124
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 624
        2⤵
        • Program crash
        PID:764
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 660
        2⤵
        • Program crash
        PID:4528
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 752
        2⤵
        • Program crash
        PID:1468
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 788
        2⤵
        • Program crash
        PID:4396
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1016
        2⤵
        • Program crash
        PID:3356
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1028
        2⤵
        • Program crash
        PID:3480
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1296
        2⤵
        • Program crash
        PID:1636
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1360
        2⤵
        • Program crash
        PID:176
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1356
        2⤵
        • Program crash
        PID:3116
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 4124 -ip 4124
      1⤵
        PID:5108
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 4124 -ip 4124
        1⤵
          PID:4412
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 4124 -ip 4124
          1⤵
            PID:2212
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4124 -ip 4124
            1⤵
              PID:4292
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4124 -ip 4124
              1⤵
                PID:836
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4124 -ip 4124
                1⤵
                  PID:5040
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 4124 -ip 4124
                  1⤵
                    PID:3520
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4124 -ip 4124
                    1⤵
                      PID:2256
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4124 -ip 4124
                      1⤵
                        PID:1016

                      Network

                      MITRE ATT&CK Matrix

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/4124-130-0x00000000001C0000-0x00000000001E7000-memory.dmp

                        Filesize

                        156KB

                        Download

                      • memory/4124-131-0x0000000000460000-0x00000000004A4000-memory.dmp

                        Filesize

                        272KB

                        Download

                      • memory/4124-132-0x0000000000400000-0x0000000000456000-memory.dmp

                        Filesize

                        344KB

                        Download