onlylogger | a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486

Analysis

max time kernel
152s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
08-11-2022 07:59

Target

a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
Size

358KB
MD5

d0cb1bcecc615db6be72c5c68576932e
SHA1

c127d890420d9205d3426d3edb5746678d0047cd
SHA256

a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486
SHA512

38e7df8234ceab44dd77b322526e23174cb69f54dc0eb4c547747ad25f833197cd815609780b5cac0993892a6793564a1ea1daf4c1e57896fe0b714f963e57ca
SSDEEP

6144:WYHpe4aM7iXeBPcnRE9LxiLAW+fDqRWrmzuOlHJvXwyCTlOp2K:WL4f2OBPce9LxiT0W8SrpvXwyCTl

Score

10^/10

onlylogger loader

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 2 IoCs

Processes:

resource	yara_rule
behavioral2/memory/1932-133-0x0000000000620000-0x0000000000664000-memory.dmp	family_onlylogger
behavioral2/memory/1932-134-0x0000000000400000-0x0000000000484000-memory.dmp	family_onlylogger

Program crash 8 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4116	1932	WerFault.exe	a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
1192	1932	WerFault.exe	a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
1284	1932	WerFault.exe	a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
1524	1932	WerFault.exe	a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
4112	1932	WerFault.exe	a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
4984	1932	WerFault.exe	a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
4416	1932	WerFault.exe	a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
3024	1932	WerFault.exe	a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe

C:\Users\Admin\AppData\Local\Temp\a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe
"C:\Users\Admin\AppData\Local\Temp\a9e6db79464d9992a31482f0cf46b96a2646bcac70545692fb1e7fd703624486.exe"
1⤵
PID:1932

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 624
2⤵
- Program crash
PID:4116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 644
2⤵
- Program crash
PID:1192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 752
2⤵
- Program crash
PID:1284

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 772
2⤵
- Program crash
PID:1524

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 1016
2⤵
- Program crash
PID:4112

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 1004
2⤵
- Program crash
PID:4984

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 1296
2⤵
- Program crash
PID:4416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1932 -s 1536
2⤵
- Program crash
PID:3024

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1932 -ip 1932
1⤵
PID:1660

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1932 -ip 1932
1⤵
PID:1644

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1932 -ip 1932
1⤵
PID:1520

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1932 -ip 1932
1⤵
PID:4756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1932 -ip 1932
1⤵
PID:4920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 572 -p 1932 -ip 1932
1⤵
PID:2140

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 576 -p 1932 -ip 1932
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1932 -ip 1932
1⤵
PID:772

memory/1932-132-0x000000000068D000-0x00000000006B4000-memory.dmp

Filesize
156KB

Download
memory/1932-133-0x0000000000620000-0x0000000000664000-memory.dmp

Filesize
272KB

Download
memory/1932-134-0x0000000000400000-0x0000000000484000-memory.dmp

Filesize
528KB

Download
memory/1932-135-0x000000000068D000-0x00000000006B4000-memory.dmp

Filesize
156KB

Download