onlylogger | 52cfafa6f30ffb18170970e495225a520ad766efc4a5ac20a7fa22c31581cdca

Analysis

max time kernel
153s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220715-en
resource tags

arch:x64arch:x86image:win10v2004-20220715-enlocale:en-usos:windows10-2004-x64system
submitted
17/07/2022, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52cfafa6f30ffb18170970e495225a520ad766efc4a5ac20a7fa22c31581cdca.exe
Size 364KB
Sample220717-b9bg3abbb3
SHA256 52cfafa6f30ffb18170970e495225a520ad766efc4a5ac20a7fa22c31581cdca
MD5 9e47888ff6b36c13f7df0ed338669fe7
SHA1 c2c9b834d4b649a48ba4c2101ef3665025a441b3
SHA512 50a446a4ec348c04961c3a4203e63cc9a1fad7b893b913c04ed28787043f4a4d1373080204ca78aaa2cb246265e0f9b3e4c63409bd717c2671042c7da9af5c0e
MD5 SHA1 SHA512

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 3 IoCs

resource	yara_rule
behavioral2/memory/2964-131-0x0000000003550000-0x0000000003593000-memory.dmp	family_onlylogger
behavioral2/memory/2964-132-0x0000000000400000-0x000000000192B000-memory.dmp	family_onlylogger
behavioral2/memory/2964-133-0x0000000000400000-0x000000000192B000-memory.dmp	family_onlylogger

Program crash 13 IoCs

pid	pid_target	Process	procid_target
4772	2964	WerFault.exe	77
3536	2964	WerFault.exe	77
5068	2964	WerFault.exe	77
4224	2964	WerFault.exe	77
4616	2964	WerFault.exe	77
4592	2964	WerFault.exe	77
4856	2964	WerFault.exe	77
3872	2964	WerFault.exe	77
1380	2964	WerFault.exe	77
4156	2964	WerFault.exe	77
1548	2964	WerFault.exe	77
2468	2964	WerFault.exe	77
3032	2964	WerFault.exe	77

C:\Users\Admin\AppData\Local\Temp\52cfafa6f30ffb18170970e495225a520ad766efc4a5ac20a7fa22c31581cdca.exe
"C:\Users\Admin\AppData\Local\Temp\52cfafa6f30ffb18170970e495225a520ad766efc4a5ac20a7fa22c31581cdca.exe"
1⤵
PID:2964
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 472
  2⤵
  - Program crash
  PID:4772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 644
  2⤵
  - Program crash
  PID:3536
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 724
  2⤵
  - Program crash
  PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 852
  2⤵
  - Program crash
  PID:4224
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 796
  2⤵
  - Program crash
  PID:4616
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 920
  2⤵
  - Program crash
  PID:4592
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 984
  2⤵
  - Program crash
  PID:4856
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1148
  2⤵
  - Program crash
  PID:3872
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1148
  2⤵
  - Program crash
  PID:1380
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1516
  2⤵
  - Program crash
  PID:4156
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1620
  2⤵
  - Program crash
  PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1300
  2⤵
  - Program crash
  PID:2468
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 2964 -s 1152
  2⤵
  - Program crash
  PID:3032

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 2964 -ip 2964
1⤵
PID:3956

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2964 -ip 2964
1⤵
PID:1372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 2964 -ip 2964
1⤵
PID:4972

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2964 -ip 2964
1⤵
PID:2940

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 2964 -ip 2964
1⤵
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2964 -ip 2964
1⤵
PID:4528

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2964 -ip 2964
1⤵
PID:2460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 2964 -ip 2964
1⤵
PID:1368

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 2964 -ip 2964
1⤵
PID:3560

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 2964 -ip 2964
1⤵
PID:4252

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 2964 -ip 2964
1⤵
PID:2328

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2964 -ip 2964
1⤵
PID:4988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2964 -ip 2964
1⤵
PID:3148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2964-130-0x0000000001A80000-0x0000000001AA6000-memory.dmp

Download

memory/2964-131-0x0000000003550000-0x0000000003593000-memory.dmp

Download

memory/2964-132-0x0000000000400000-0x000000000192B000-memory.dmp

Download

memory/2964-133-0x0000000000400000-0x000000000192B000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads