Analysis

  • max time kernel
    1417s
  • max time network
    1493s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    20-11-2020 14:34

General

  • Target

    Lonelyscreen.1.2.9.keygen.by.Paradox.exe

Malware Config

Signatures

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Nirsoft ⋅ 4 IoCs
  • Executes dropped EXE ⋅ 14 IoCs
  • UPX packed file ⋅ 6 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file ⋅ 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application ⋅ 2 TTPs 1 IoCs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
  • Looks up external IP address via web service ⋅ 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store ⋅ 2 TTPs 9 IoCs
  • Runs ping.exe ⋅ 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 6 IoCs
  • Suspicious use of FindShellTrayWindow ⋅ 1 IoCs
  • Suspicious use of SetWindowsHookEx ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 60 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Lonelyscreen.1.2.9.keygen.by.Paradox.exe
    "C:\Users\Admin\AppData\Local\Temp\Lonelyscreen.1.2.9.keygen.by.Paradox.exe"
    Suspicious use of WriteProcessMemory
    PID:4736
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat" "
      Suspicious use of WriteProcessMemory
      PID:3488
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
        keygen-pr.exe -p83fsase3Ge
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        PID:4436
        • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe"
          Executes dropped EXE
          Suspicious use of WriteProcessMemory
          PID:2456
          • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
            C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe -txt -scanlocal -file:potato.dat
            PID:3708
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
        keygen-step-3.exe
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        PID:4468
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe"
          Suspicious use of WriteProcessMemory
          PID:4548
          • C:\Windows\SysWOW64\PING.EXE
            ping 1.1.1.1 -n 1 -w 3000
            Runs ping.exe
            PID:1460
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
        keygen-step-4.exe
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        PID:540
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe"
          Executes dropped EXE
          Suspicious use of WriteProcessMemory
          PID:3004
          • C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe
            "C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"
            Executes dropped EXE
            Suspicious use of WriteProcessMemory
            PID:2696
            • C:\Windows\SysWOW64\cmd.exe
              cmd.exe /C ping 1.1.1.1 -n 1 -w 3000 > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe"
              Suspicious use of WriteProcessMemory
              PID:4708
              • C:\Windows\SysWOW64\PING.EXE
                ping 1.1.1.1 -n 1 -w 3000
                Runs ping.exe
                PID:4668
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe"
          Executes dropped EXE
          Suspicious use of SetWindowsHookEx
          PID:232
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
          Executes dropped EXE
          Suspicious use of WriteProcessMemory
          PID:3008
          • C:\Users\Admin\AppData\Local\Temp\is-KQUE8.tmp\Setup.tmp
            "C:\Users\Admin\AppData\Local\Temp\is-KQUE8.tmp\Setup.tmp" /SL5="$3022C,1223153,733696,C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe"
            Executes dropped EXE
            Suspicious behavior: EnumeratesProcesses
            Suspicious use of FindShellTrayWindow
            Suspicious use of WriteProcessMemory
            PID:2012
            • C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe
              "C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe"
              Executes dropped EXE
              Modifies system certificate store
              PID:4316
        • C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe
          "C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe"
          Executes dropped EXE
          Adds Run key to start application
          Suspicious use of WriteProcessMemory
          PID:4648
          • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
            Executes dropped EXE
            PID:5052
          • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
            Executes dropped EXE
            Suspicious behavior: EnumeratesProcesses
            PID:4772
          • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
            C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
            Executes dropped EXE
            Suspicious behavior: EnumeratesProcesses
            PID:4220

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Privilege Escalation

                Replay Monitor

                00:00 00:00

                Downloads

                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-pr.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-3.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen-step-4.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX0\keygen.bat
                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\JOzWR.dat
                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX1\key.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\Setup.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe
                  MD5

                  7016ff8fcb9d9451139d7a7541512597

                  SHA1

                  bf20fea9aa80a94531c4c3af8549b3e32bcada77

                  SHA256

                  97d21bc11812933a88c45cec4bef20e346952fc4a4144c93b19a205d20420a57

                  SHA512

                  b1ceab00b09c6feb716658e19b3021a8fe2d79ff06888b94376652907931aa67a451bb775ed0fc53fbd661f8b3ecaf98b8304604c1341df4ef21e9feac035e99

                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\hjjgaa.exe
                  MD5

                  7016ff8fcb9d9451139d7a7541512597

                  SHA1

                  bf20fea9aa80a94531c4c3af8549b3e32bcada77

                  SHA256

                  97d21bc11812933a88c45cec4bef20e346952fc4a4144c93b19a205d20420a57

                  SHA512

                  b1ceab00b09c6feb716658e19b3021a8fe2d79ff06888b94376652907931aa67a451bb775ed0fc53fbd661f8b3ecaf98b8304604c1341df4ef21e9feac035e99

                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\id6.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe
                  MD5

                  5af346c85e6a347401ebd8798035df35

                  SHA1

                  036e6513eccaee195ba637e85683744a8dce09c0

                  SHA256

                  e7129b9545ead3dc009bcf40b5368eac467705889478cfac339cfa129631b87d

                  SHA512

                  117338b32f8610facf930748b4d916bb9cc90dba1c72f2059e52219726d19f8dc6314c46505e80e492104ac7b4e5222419036c8ceb9477da12fc9ce32fbdda77

                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\searzar\searzar.exe
                  MD5

                  5af346c85e6a347401ebd8798035df35

                  SHA1

                  036e6513eccaee195ba637e85683744a8dce09c0

                  SHA256

                  e7129b9545ead3dc009bcf40b5368eac467705889478cfac339cfa129631b87d

                  SHA512

                  117338b32f8610facf930748b4d916bb9cc90dba1c72f2059e52219726d19f8dc6314c46505e80e492104ac7b4e5222419036c8ceb9477da12fc9ce32fbdda77

                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX2\whhw.exe
                • C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe
                  MD5

                  7d72db8aaceccd5cab82e0f618ce9d81

                  SHA1

                  c690d1e3a90499ce1b63ee9388dfaec786751e1e

                  SHA256

                  a8374f4efacd0d4ace4f78a781baf7a1e0913edaceb8feddcb82d07b68a1bcab

                  SHA512

                  88ff9256d7bfe8d724e42f59be08e51e70244d546ac8ef6466864d2466e52aac5d84acb0ea552168701e5e1d1eceee0696a0e3a40de2d83ab720e0e69de0d6d2

                • C:\Users\Admin\AppData\Local\Temp\RarSFX3\setup.upx.exe
                  MD5

                  7d72db8aaceccd5cab82e0f618ce9d81

                  SHA1

                  c690d1e3a90499ce1b63ee9388dfaec786751e1e

                  SHA256

                  a8374f4efacd0d4ace4f78a781baf7a1e0913edaceb8feddcb82d07b68a1bcab

                  SHA512

                  88ff9256d7bfe8d724e42f59be08e51e70244d546ac8ef6466864d2466e52aac5d84acb0ea552168701e5e1d1eceee0696a0e3a40de2d83ab720e0e69de0d6d2

                • C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
                • C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
                • C:\Users\Admin\AppData\Local\Temp\fjgha23_fa.txt
                • C:\Users\Admin\AppData\Local\Temp\is-KQUE8.tmp\Setup.tmp
                • C:\Users\Admin\AppData\Local\Temp\is-KQUE8.tmp\Setup.tmp
                • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
                  MD5

                  7fee8223d6e4f82d6cd115a28f0b6d58

                  SHA1

                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                  SHA256

                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                  SHA512

                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
                  MD5

                  7fee8223d6e4f82d6cd115a28f0b6d58

                  SHA1

                  1b89c25f25253df23426bd9ff6c9208f1202f58b

                  SHA256

                  a45317c374d54e322153afd73f0e90f1486638d77b7fd85746d091071bbecd59

                  SHA512

                  3ed900b83dd178637c2fd4e8444a899f17f12c4ec92a6f4de4fe544fe8d41b521c69b8f348343cb397d0e160f23e27429042d758b5fa5acac0bab5c3584bace4

                • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
                  MD5

                  4d4c98eca32b14aeb074db34cd0881e4

                  SHA1

                  92f213d609bba05d41d6941652a88c44936663a4

                  SHA256

                  4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

                  SHA512

                  959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

                • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
                  MD5

                  4d4c98eca32b14aeb074db34cd0881e4

                  SHA1

                  92f213d609bba05d41d6941652a88c44936663a4

                  SHA256

                  4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

                  SHA512

                  959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

                • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
                  MD5

                  4d4c98eca32b14aeb074db34cd0881e4

                  SHA1

                  92f213d609bba05d41d6941652a88c44936663a4

                  SHA256

                  4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

                  SHA512

                  959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

                • C:\Users\Admin\AppData\Local\Temp\jfiag_gg.exe
                  MD5

                  4d4c98eca32b14aeb074db34cd0881e4

                  SHA1

                  92f213d609bba05d41d6941652a88c44936663a4

                  SHA256

                  4182172a01bdfc08c5cf7e8652f7d9d81858345a770e2b6b507840e4c1c7764f

                  SHA512

                  959da8bbf6084e802ed366de8d240382b8a5ab2f18bc58881f42ecb7a8ed082d0e078b3ad18dbf90ac0a14cd491b5ac8b00cf1f0a266bdb7ebb8d95c5c71cacf

                • memory/232-30-0x0000000000000000-mapping.dmp
                • memory/232-33-0x0000000010000000-0x00000000100E3000-memory.dmp
                • memory/540-14-0x0000000000000000-mapping.dmp
                • memory/540-13-0x0000000000000000-mapping.dmp
                • memory/1460-16-0x0000000000000000-mapping.dmp
                • memory/2012-41-0x0000000000000000-mapping.dmp
                • memory/2456-18-0x0000000000000000-mapping.dmp
                • memory/2696-25-0x0000000000000000-mapping.dmp
                • memory/3004-22-0x0000000000000000-mapping.dmp
                • memory/3008-38-0x0000000000000000-mapping.dmp
                • memory/3488-2-0x0000000000000000-mapping.dmp
                • memory/4220-58-0x0000000000000000-mapping.dmp
                • memory/4316-44-0x0000000000000000-mapping.dmp
                • memory/4436-5-0x0000000000000000-mapping.dmp
                • memory/4436-4-0x0000000000000000-mapping.dmp
                • memory/4468-8-0x0000000000000000-mapping.dmp
                • memory/4468-9-0x0000000000000000-mapping.dmp
                • memory/4548-12-0x0000000000000000-mapping.dmp
                • memory/4648-47-0x0000000000000000-mapping.dmp
                • memory/4668-29-0x0000000000000000-mapping.dmp
                • memory/4708-28-0x0000000000000000-mapping.dmp
                • memory/4772-54-0x0000000000000000-mapping.dmp
                • memory/5052-50-0x0000000000000000-mapping.dmp