onlylogger | 83e348a75fc49a16af4c0b80c678e433d71ce915b2a757635135f0f05a2d4ccf

Analysis

max time kernel
146s
max time network
142s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
14-11-2022 09:44

Target

20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
Size

390KB
MD5

2e86f7dfe3f2f795ef1995bd9d6efdea
SHA1

a2c279c2c2ffd37bd6ee59eadfe037d7e3524c1e
SHA256

20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0
SHA512

1c3aca6e80ddd3353c0fcb62895c81b3e398a44d40539dba37768e11ca6eb0cb7657d4a1b4d3878a3e0317153a2629288f34e34d15f2b6eaea26aebd704b18d0
SSDEEP

6144:jt1zW2+ZjvI9IprJzx36m5ANPLJvlQmod4D+uvw3+6G:ZNzCjOIpU9LJvlQN4D+4I+x

Score

10^/10

onlylogger loader

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1372-56-0x00000000001B0000-0x00000000001F9000-memory.dmp	family_onlylogger
behavioral1/memory/1372-57-0x0000000000400000-0x00000000016D5000-memory.dmp	family_onlylogger
behavioral1/memory/1372-58-0x0000000000400000-0x00000000016D5000-memory.dmp	family_onlylogger

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe

pid process

1372 20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe

pid	process
1372	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe

C:\Users\Admin\AppData\Local\Temp\20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
"C:\Users\Admin\AppData\Local\Temp\20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1372

memory/1372-54-0x0000000075921000-0x0000000075923000-memory.dmp

Filesize
8KB

Download
memory/1372-56-0x00000000001B0000-0x00000000001F9000-memory.dmp

Filesize
292KB

Download
memory/1372-55-0x000000000030D000-0x0000000000336000-memory.dmp

Filesize
164KB

Download
memory/1372-57-0x0000000000400000-0x00000000016D5000-memory.dmp

Filesize
18.8MB

Download
memory/1372-58-0x0000000000400000-0x00000000016D5000-memory.dmp

Filesize
18.8MB

Download