onlylogger | 5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8

Resubmissions

15-09-2022 10:15

220915-maqy9acfh2 10

31-07-2022 17:39

220731-v8mcqaahcr 10

Analysis

max time kernel
137s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2022 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe
Size

362KB
MD5

8b6f3a6e8d9797093a78f0b85da4a1fc
SHA1

2f8346a3ec3427c5a7681d166501f8f42f620b3b
SHA256

5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8
SHA512

c0ad94faa01f5f3fd67a90df327bd0862243c1f335ccf2582f92867f3c751dfdaf73b7e2d86bd494ca1cc8ba199db7964d61493cd37855a35acbfe0256d2f7ef
SSDEEP

6144:jMBqR7GNXx/qukHSTS4pkUSRE8UgYULy/1q5sU5AtatTFqX7tNfVXVHQLIiu8c:j4gGNBOyfpnmaDd2shQfwZGEX8c

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4288-135-0x0000000004C70000-0x0000000004CB9000-memory.dmp	family_onlylogger
behavioral2/memory/4288-136-0x0000000000400000-0x0000000002F22000-memory.dmp	family_onlylogger

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation	5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4496 4288 WerFault.exe 5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

4460 taskkill.exe
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

taskkill.exe

description pid process

Token: SeDebugPrivilege 4460 taskkill.exe

pid	pid_target	process	target process
4496	4288	WerFault.exe	5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe

pid	process
4460	taskkill.exe

description	pid	process
Token: SeDebugPrivilege	4460	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.execmd.exe

description	pid	process	target process
PID 4288 wrote to memory of 4148	4288	5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe	cmd.exe
PID 4288 wrote to memory of 4148	4288	5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe	cmd.exe
PID 4288 wrote to memory of 4148	4288	5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe	cmd.exe
PID 4148 wrote to memory of 4460	4148	cmd.exe	taskkill.exe
PID 4148 wrote to memory of 4460	4148	cmd.exe	taskkill.exe
PID 4148 wrote to memory of 4460	4148	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe
"C:\Users\Admin\AppData\Local\Temp\5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4288

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /im "5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe" & exit
2⤵
- Suspicious use of WriteProcessMemory
PID:4148

C:\Windows\SysWOW64\taskkill.exe
taskkill /im "5f465c9a74f35fef4a66cbf336dc90bed8bc8caf7b51a98cb52406942c05a0e8.exe" /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4460

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4288 -s 984
2⤵
- Program crash
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4288 -ip 4288
1⤵
PID:712

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4148-132-0x0000000000000000-mapping.dmp

Download
memory/4288-134-0x00000000032ED000-0x0000000003316000-memory.dmp

Filesize
164KB

Download
memory/4288-135-0x0000000004C70000-0x0000000004CB9000-memory.dmp

Filesize
292KB

Download
memory/4288-136-0x0000000000400000-0x0000000002F22000-memory.dmp

Filesize
43.1MB

Download
memory/4460-133-0x0000000000000000-mapping.dmp

Download