onlylogger | 83e348a75fc49a16af4c0b80c678e433d71ce915b2a757635135f0f05a2d4ccf

Analysis

max time kernel
150s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
14-11-2022 09:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
Size

390KB
MD5

2e86f7dfe3f2f795ef1995bd9d6efdea
SHA1

a2c279c2c2ffd37bd6ee59eadfe037d7e3524c1e
SHA256

20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0
SHA512

1c3aca6e80ddd3353c0fcb62895c81b3e398a44d40539dba37768e11ca6eb0cb7657d4a1b4d3878a3e0317153a2629288f34e34d15f2b6eaea26aebd704b18d0
SSDEEP

6144:jt1zW2+ZjvI9IprJzx36m5ANPLJvlQmod4D+uvw3+6G:ZNzCjOIpU9LJvlQN4D+4I+x

Score

10^/10

onlylogger loader

Malware Config

Signatures

OnlyLogger
A tiny loader that uses IPLogger to get its payload.
loader onlylogger

OnlyLogger payload 3 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4808-133-0x0000000003420000-0x0000000003469000-memory.dmp	family_onlylogger
behavioral2/memory/4808-134-0x0000000000400000-0x00000000016D5000-memory.dmp	family_onlylogger
behavioral2/memory/4808-136-0x0000000000400000-0x00000000016D5000-memory.dmp	family_onlylogger

Program crash 11 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
5084	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
4084	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
4680	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
676	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
4224	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
5048	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
1244	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
3244	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
2004	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
3260	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
2272	4808	WerFault.exe	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe

pid process

4808 20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe

pid	process
4808	20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe

C:\Users\Admin\AppData\Local\Temp\20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe
"C:\Users\Admin\AppData\Local\Temp\20e5765385bc92922a64f7454367d98a77693adfd62bcb4a44703705ddffbdb0.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:4808

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 612
2⤵
- Program crash
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 632
2⤵
- Program crash
PID:4084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 744
2⤵
- Program crash
PID:4680

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 780
2⤵
- Program crash
PID:676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 860
2⤵
- Program crash
PID:4224

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 652
2⤵
- Program crash
PID:5048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 772
2⤵
- Program crash
PID:1244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1072
2⤵
- Program crash
PID:3244

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1080
2⤵
- Program crash
PID:2004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 844
2⤵
- Program crash
PID:3260

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4808 -s 1124
2⤵
- Program crash
PID:2272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4808 -ip 4808
1⤵
PID:3472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4808 -ip 4808
1⤵
PID:628

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4808 -ip 4808
1⤵
PID:1476

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4808 -ip 4808
1⤵
PID:3512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 180 -p 4808 -ip 4808
1⤵
PID:3544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 536 -p 4808 -ip 4808
1⤵
PID:5072

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 200 -p 4808 -ip 4808
1⤵
PID:4264

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 4808 -ip 4808
1⤵
PID:3640

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4808 -ip 4808
1⤵
PID:2372

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 4808 -ip 4808
1⤵
PID:444

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 4808 -ip 4808
1⤵
PID:4444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4808-132-0x000000000178E000-0x00000000017B7000-memory.dmp

Filesize
164KB

Download
memory/4808-133-0x0000000003420000-0x0000000003469000-memory.dmp

Filesize
292KB

Download
memory/4808-134-0x0000000000400000-0x00000000016D5000-memory.dmp

Filesize
18.8MB

Download
memory/4808-135-0x000000000178E000-0x00000000017B7000-memory.dmp

Filesize
164KB

Download
memory/4808-136-0x0000000000400000-0x00000000016D5000-memory.dmp

Filesize
18.8MB

Download