Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
30-11-2022 14:43
Static task
static1
Behavioral task
behavioral1
Sample
8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe
Resource
win10v2004-20220901-en
General
-
Target
8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe
-
Size
252KB
-
MD5
8e6e835dede4156784b26cb01339f050
-
SHA1
d0f3846526cf7ed69b67301e419f72ce8ba981fd
-
SHA256
8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762
-
SHA512
05a4bda590b1d147aeb2a32b5c0c758700c585502083c003295b4ebe46927455e646b67b3570c11981441c3f90fb89e1441b72b7192755c8b8fa3efb50979516
-
SSDEEP
6144:pIYAQk0weX2qSCpwv3+Ag/DomARu+Vd9Unv:CY3k2X2qJpC3PoX+VP
Malware Config
Signatures
-
OnlyLogger
A tiny loader that uses IPLogger to get its payload.
-
OnlyLogger payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1340-57-0x0000000000400000-0x00000000004EA000-memory.dmp family_onlylogger behavioral1/memory/1340-56-0x0000000000220000-0x000000000026C000-memory.dmp family_onlylogger behavioral1/memory/1340-60-0x0000000000400000-0x00000000004EA000-memory.dmp family_onlylogger -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1180 cmd.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1472 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
taskkill.exedescription pid process Token: SeDebugPrivilege 1472 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.execmd.exedescription pid process target process PID 1340 wrote to memory of 1180 1340 8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe cmd.exe PID 1340 wrote to memory of 1180 1340 8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe cmd.exe PID 1340 wrote to memory of 1180 1340 8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe cmd.exe PID 1340 wrote to memory of 1180 1340 8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe cmd.exe PID 1180 wrote to memory of 1472 1180 cmd.exe taskkill.exe PID 1180 wrote to memory of 1472 1180 cmd.exe taskkill.exe PID 1180 wrote to memory of 1472 1180 cmd.exe taskkill.exe PID 1180 wrote to memory of 1472 1180 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe"C:\Users\Admin\AppData\Local\Temp\8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im "8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe" /f & erase "C:\Users\Admin\AppData\Local\Temp\8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe" & exit2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im "8ad6deb9fd771066e35d6a4806f5164a9c4df53418966715778c1d7ffc063762.exe" /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1180-58-0x0000000000000000-mapping.dmp
-
memory/1340-54-0x00000000758B1000-0x00000000758B3000-memory.dmpFilesize
8KB
-
memory/1340-57-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1340-56-0x0000000000220000-0x000000000026C000-memory.dmpFilesize
304KB
-
memory/1340-55-0x00000000006CA000-0x00000000006F5000-memory.dmpFilesize
172KB
-
memory/1340-59-0x00000000006CA000-0x00000000006F5000-memory.dmpFilesize
172KB
-
memory/1340-60-0x0000000000400000-0x00000000004EA000-memory.dmpFilesize
936KB
-
memory/1472-61-0x0000000000000000-mapping.dmp