Analysis
-
max time kernel
150s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
07-11-2022 07:15
Static task
static1
Behavioral task
behavioral1
Sample
abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe
Resource
win10v2004-20220812-en
General
-
Target
abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe
-
Size
385KB
-
MD5
667516f3a184f164a0758f2572571254
-
SHA1
5e7c1b3123fbef064d585037a841c5245677ae61
-
SHA256
abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f
-
SHA512
da8f56bd33c8a08576f066278d165efcbc67a6182015c4fb7d5405886cc7b702fb64ef3451b2dcacb650161b130a2c6083cd0cfb97b14d62876e3686ecfbdea0
-
SSDEEP
12288:SCROxGUN562WbIoOma4KReVWdVwRagjzn5a:bZew2GIegwRaIA
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/1824-133-0x00000000001C0000-0x00000000001EF000-memory.dmp family_onlylogger behavioral2/memory/1824-134-0x0000000000400000-0x000000000088F000-memory.dmp family_onlylogger behavioral2/memory/1824-136-0x00000000001C0000-0x00000000001EF000-memory.dmp family_onlylogger -
Program crash 9 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4864 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe 1444 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe 4496 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe 2368 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe 220 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe 1176 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe 4644 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe 492 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe 2168 1824 WerFault.exe abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe"C:\Users\Admin\AppData\Local\Temp\abb461c9293b8085242b31029f4aeeec38a0c469a3d4f1bc7b8601dc5b90c31f.exe"1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 6202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 6642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 6842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 8162⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 9882⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 10042⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 12922⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 11522⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1824 -s 10842⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1824 -ip 18241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1824 -ip 18241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1824 -ip 18241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1824 -ip 18241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 1824 -ip 18241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 1824 -ip 18241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1824 -ip 18241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 1824 -ip 18241⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1824 -ip 18241⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1824-132-0x0000000000903000-0x000000000091F000-memory.dmpFilesize
112KB
-
memory/1824-133-0x00000000001C0000-0x00000000001EF000-memory.dmpFilesize
188KB
-
memory/1824-134-0x0000000000400000-0x000000000088F000-memory.dmpFilesize
4.6MB
-
memory/1824-135-0x0000000000903000-0x000000000091F000-memory.dmpFilesize
112KB
-
memory/1824-136-0x00000000001C0000-0x00000000001EF000-memory.dmpFilesize
188KB