onlylogger

General

Target

58e4c92f1fe042c1ecfefe5039582c82089b1d9db4a45e5e13377b298f00bc87
Size

10.5MB
Sample

220724-gxrleaabbq
MD5

c1b2d4ddc5bc6a5328bcb060f2a5f588
SHA1

888167f5db59162118dfbc07b46c3cd6a8896b6b
SHA256

58e4c92f1fe042c1ecfefe5039582c82089b1d9db4a45e5e13377b298f00bc87
SHA512

d3a54c35a1512d780c67cbee5af92d52c6836b07ca6b6e2d0c9e8f5e58516809f99626e39cee2655cf6a97fd993c2094453e019503e64df83d36e620c38827bd

Score

10^/10

Malware Config

Extracted

Family

socelars

C2

http://www.mkpmc.com/

Targets

- Target
  
  58e4c92f1fe042c1ecfefe5039582c82089b1d9db4a45e5e13377b298f00bc87
- Size
  
  10.5MB
- MD5
  
  c1b2d4ddc5bc6a5328bcb060f2a5f588
- SHA1
  
  888167f5db59162118dfbc07b46c3cd6a8896b6b
- SHA256
  
  58e4c92f1fe042c1ecfefe5039582c82089b1d9db4a45e5e13377b298f00bc87
- SHA512
  
  d3a54c35a1512d780c67cbee5af92d52c6836b07ca6b6e2d0c9e8f5e58516809f99626e39cee2655cf6a97fd993c2094453e019503e64df83d36e620c38827bd
Score

10^/10

onlylogger socelars discovery loader spyware stealer suricata xmrig miner
- OnlyLogger
  A tiny loader that uses IPLogger to get its payload.
  loader onlylogger
- Process spawned unexpected child process
  This typically indicates the parent process was compromised via an exploit or macro.
- Socelars
  Socelars is an infostealer targeting browser cookies and credit card credentials.
  stealer socelars
- Socelars payload
- Suspicious use of NtCreateUserProcessOtherParentProcess
- suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata: ET MALWARE ClipBanker Variant Activity (POST)
  suricata
- xmrig
  XMRig is a high performance, open source, cross platform CPU/GPU miner.
  miner xmrig
- OnlyLogger payload
- XMRig Miner payload
  miner
- Downloads MZ/PE file
- Executes dropped EXE
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL
- Reads user/profile data of web browsers
  Infostealers often target stored browser data, which can include saved credentials etc.
  spyware stealer
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
- Legitimate hosting services abused for malware hosting/C2
- Looks up external IP address via web service
  Uses a legitimate IP lookup service to find the infected system's external IP.
- Drops file in System32 directory
- Suspicious use of SetThreadContext
behavioral1 behavioral2