onlylogger | ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9

Analysis

max time kernel
153s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220901-en
resource tags

arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
submitted
07-11-2022 08:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
Size

420KB
MD5

5349428cdeb3b971fd0d6a0a2dee75dd
SHA1

b94143e240418b745dfea26e05568ad10ea9b37b
SHA256

ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9
SHA512

f8b07cc531ae2bb5ef53bea78b8cc9b09a5645b39f2c4f28a1bd9050ecdd3427667dbd2da9afd1d2284b704697a93ade711cba0a58ec4dc3a7f0885918f67615
SSDEEP

12288:n4MksIF74MqjRi86aGWaX7HyPfCX5CzXFU5nthZ:49F4MGRh6aGWgLpQO5nth

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3404-133-0x0000000002480000-0x00000000024C3000-memory.dmp	family_onlylogger
behavioral2/memory/3404-134-0x0000000000400000-0x0000000000869000-memory.dmp	family_onlylogger
behavioral2/memory/3404-136-0x0000000000400000-0x0000000000869000-memory.dmp	family_onlylogger

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
1016	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
1152	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
4496	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
4520	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
3740	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
864	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
4052	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
1020	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
1144	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
5004	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
3796	3404	WerFault.exe	ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe

C:\Users\Admin\AppData\Local\Temp\ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe
"C:\Users\Admin\AppData\Local\Temp\ab9311ccda07b4679bf2732a5f76efb60af363a5f7bf920bb8d1a7c6b786aeb9.exe"
1⤵
PID:3404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 464
2⤵
- Program crash
PID:1016

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 664
2⤵
- Program crash
PID:1152

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 724
2⤵
- Program crash
PID:4496

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 864
2⤵
- Program crash
PID:4520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 952
2⤵
- Program crash
PID:3740

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1016
2⤵
- Program crash
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1172
2⤵
- Program crash
PID:4052

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1172
2⤵
- Program crash
PID:1020

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 884
2⤵
- Program crash
PID:1144

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 1472
2⤵
- Program crash
PID:5004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3404 -s 596
2⤵
- Program crash
PID:3796

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 3404 -ip 3404
1⤵
PID:4092

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 3404 -ip 3404
1⤵
PID:4492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 540 -p 3404 -ip 3404
1⤵
PID:516

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3404 -ip 3404
1⤵
PID:4104

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 3404 -ip 3404
1⤵
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 3404 -ip 3404
1⤵
PID:3308

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3404 -ip 3404
1⤵
PID:2848

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 3404 -ip 3404
1⤵
PID:2816

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 3404 -ip 3404
1⤵
PID:2224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3404 -ip 3404
1⤵
PID:4180

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3404 -ip 3404
1⤵
PID:4076

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3404-132-0x0000000000AFD000-0x0000000000B24000-memory.dmp

Filesize
156KB

Download
memory/3404-133-0x0000000002480000-0x00000000024C3000-memory.dmp

Filesize
268KB

Download
memory/3404-134-0x0000000000400000-0x0000000000869000-memory.dmp

Filesize
4.4MB

Download
memory/3404-135-0x0000000000AFD000-0x0000000000B24000-memory.dmp

Filesize
156KB

Download
memory/3404-136-0x0000000000400000-0x0000000000869000-memory.dmp

Filesize
4.4MB

Download