Overview

overview

10

Static

static

01a53007f9...68.exe

windows7_x64

10

01a53007f9...68.exe

windows10_x64

10

022e3c30a1...66.exe

windows7_x64

10

022e3c30a1...66.exe

windows10_x64

10

02ca2b5bb7...35.exe

windows7_x64

10

02ca2b5bb7...35.exe

windows10_x64

10

0d69cafe70...cd.exe

windows7_x64

10

0d69cafe70...cd.exe

windows10_x64

10

0df647f0a2...bc.exe

windows7_x64

10

0df647f0a2...bc.exe

windows10_x64

10

1df367eead...2c.exe

windows7_x64

10

1df367eead...2c.exe

windows10_x64

10

1e083736ae...33.exe

windows7_x64

10

1e083736ae...33.exe

windows10_x64

10

1e662d9025...7d.exe

windows7_x64

10

1e662d9025...7d.exe

windows10_x64

10

2010009ff5...59.exe

windows7_x64

10

2010009ff5...59.exe

windows10_x64

10

243379992d...93.exe

windows7_x64

10

243379992d...93.exe

windows10_x64

10

2d63a14e4a...1a.exe

windows7_x64

10

2d63a14e4a...1a.exe

windows10_x64

10

30e6815ae0...51.exe

windows7_x64

1

30e6815ae0...51.exe

windows10_x64

1

364d3b0e94...fa.exe

windows7_x64

10

364d3b0e94...fa.exe

windows10_x64

10

3a4e2dfbd7...00.exe

windows7_x64

10

3a4e2dfbd7...00.exe

windows10_x64

10

4a4a606501...75.exe

windows7_x64

10

4a4a606501...75.exe

windows10_x64

10

4d89b00768...c0.exe

windows7_x64

10

4d89b00768...c0.exe

windows10_x64

10

Resubmissions

10-11-2021 14:52

211110-r84p8aedej 10

09-11-2021 13:19

211109-qkrv3sfcg4 10

Analysis

  • max time kernel
    116s
  • max time network
    172s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    09-11-2021 13:19

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4d89b007686d09c5143127f408435b76d2ea36991b728985ac47dcf797e6e7c0.exe

  • Size

    5.9MB

  • MD5

    1f998b076047371b95763abf57a2eb5f

  • SHA1

    8ef5c726e13d658b2be905e5274cdb0ae5fd60ca

  • SHA256

    4d89b007686d09c5143127f408435b76d2ea36991b728985ac47dcf797e6e7c0

  • SHA512

    c9f3603af56effaee8a6027339d359c4954251d17d3168e638eba99fdfc25d1082de86d6bff601f985b4f8819b9808c4e2dcaa8b97947d9595edf791f986f716

Score
10/10
socelarsaspackv2spywarestealer

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

Signatures

  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

    stealersocelars
  • Socelars Payload 5 IoCs
  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

    aspackv2
  • Downloads MZ/PE file
  • Executes dropped EXE 17 IoCs
  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Drops file in System32 directory 7 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 2 IoCs
    evasion
  • Modifies data under HKEY_USERS 61 IoCs
  • Modifies registry class 16 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:460
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:876
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Drops file in System32 directory
        • Checks processor information in registry
        • Modifies data under HKEY_USERS
        • Modifies registry class
        PID:2724
    • C:\Users\Admin\AppData\Local\Temp\4d89b007686d09c5143127f408435b76d2ea36991b728985ac47dcf797e6e7c0.exe
      "C:\Users\Admin\AppData\Local\Temp\4d89b007686d09c5143127f408435b76d2ea36991b728985ac47dcf797e6e7c0.exe"
      1⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:788
      • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\setup_install.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1904
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:556
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:1044
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Sun206dd01337.exe
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:732
          • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun206dd01337.exe
            Sun206dd01337.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:324
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 324 -s 780
              5⤵
              • Loads dropped DLL
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:2476
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Sun20b99c3db8.exe
          3⤵
          • Loads dropped DLL
          • Suspicious use of WriteProcessMemory
          PID:1180
          • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun20b99c3db8.exe
            Sun20b99c3db8.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:1748
            • C:\Users\Admin\AppData\Local\Temp\is-C3G2R.tmp\Sun20b99c3db8.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-C3G2R.tmp\Sun20b99c3db8.tmp" /SL5="$50128,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun20b99c3db8.exe"
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1700
              • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun20b99c3db8.exe
                "C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun20b99c3db8.exe" /SILENT
                6⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1108
                • C:\Users\Admin\AppData\Local\Temp\is-SM4G2.tmp\Sun20b99c3db8.tmp
                  "C:\Users\Admin\AppData\Local\Temp\is-SM4G2.tmp\Sun20b99c3db8.tmp" /SL5="$E015C,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun20b99c3db8.exe" /SILENT
                  7⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1536
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Sun200cf279a6744ade.exe
          3⤵
          • Loads dropped DLL
          PID:1236
          • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun200cf279a6744ade.exe
            Sun200cf279a6744ade.exe
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Modifies system certificate store
            • Suspicious use of AdjustPrivilegeToken
            PID:1952
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c Sun205d248acee.exe /mixone
          3⤵
            PID:1080
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Sun203f145fb9.exe
            3⤵
            • Loads dropped DLL
            PID:304
            • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun203f145fb9.exe
              Sun203f145fb9.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:948
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Sun2014ac4fc408.exe
            3⤵
            • Loads dropped DLL
            PID:1096
            • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2014ac4fc408.exe
              Sun2014ac4fc408.exe
              4⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1592
              • C:\Windows\SysWOW64\mshta.exe
                "C:\Windows\System32\mshta.exe" VbsCRiPT: cLosE (CrEaTeOBJeCt ( "WScrIPT.SheLL" ).RuN ( "CMD.exe /c copy /y ""C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2014ac4fc408.exe"" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If """" =="""" for %U iN ( ""C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2014ac4fc408.exe"" ) do taskkill /F -Im ""%~NxU"" " , 0 , tRUe) )
                5⤵
                  PID:1612
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /c copy /y "C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2014ac4fc408.exe" 09xU.exE && STarT 09xU.EXE -pPtzyIkqLZoCarb5ew & If "" =="" for %U iN ( "C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2014ac4fc408.exe" ) do taskkill /F -Im "%~NxU"
                    6⤵
                    • Loads dropped DLL
                    PID:2116
                    • C:\Users\Admin\AppData\Local\Temp\09xU.exE
                      09xU.EXE -pPtzyIkqLZoCarb5ew
                      7⤵
                      • Executes dropped EXE
                      PID:2184
                    • C:\Windows\SysWOW64\taskkill.exe
                      taskkill /F -Im "Sun2014ac4fc408.exe"
                      7⤵
                      • Kills process with taskkill
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2200
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Sun204668cb84a0.exe
              3⤵
              • Loads dropped DLL
              PID:288
              • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun204668cb84a0.exe
                Sun204668cb84a0.exe
                4⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1892
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Sun20cd15903bdf186c.exe
              3⤵
                PID:1648
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Sun204b8743bbceb04.exe
                3⤵
                  PID:1776
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Sun2095905c782bdef1b.exe
                  3⤵
                  • Loads dropped DLL
                  PID:1916
                  • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2095905c782bdef1b.exe
                    Sun2095905c782bdef1b.exe
                    4⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    PID:952
                    • C:\Windows\SysWOW64\mshta.exe
                      "C:\Windows\System32\mshta.exe" VbsCRiPt:CLOSE ( CREaTeObjECT ( "wSCRIPt.shELl" ). Run ( "CMd /C TYpE ""C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2095905c782bdef1b.exe"" > 2au6eXBO.eXe && STArt 2AU6EXBo.Exe -PLRf~LhydVIFdiJdSec33us2qKStp6& if """" == """" for %i iN (""C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2095905c782bdef1b.exe"" ) do taskkill -Im ""%~nXi"" -f " , 0 , trUe ) )
                      5⤵
                        PID:1672
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\System32\cmd.exe" /C TYpE "C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2095905c782bdef1b.exe" > 2au6eXBO.eXe && STArt 2AU6EXBo.Exe -PLRf~LhydVIFdiJdSec33us2qKStp6& if "" == "" for %i iN ("C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun2095905c782bdef1b.exe" ) do taskkill -Im "%~nXi" -f
                          6⤵
                          • Loads dropped DLL
                          PID:2136
                          • C:\Users\Admin\AppData\Local\Temp\2au6eXBO.eXe
                            2AU6EXBo.Exe -PLRf~LhydVIFdiJdSec33us2qKStp6
                            7⤵
                            • Executes dropped EXE
                            PID:2236
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill -Im "Sun2095905c782bdef1b.exe" -f
                            7⤵
                            • Kills process with taskkill
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2248
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Sun200936428e7b3.exe
                    3⤵
                    • Loads dropped DLL
                    PID:2036
                    • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun200936428e7b3.exe
                      Sun200936428e7b3.exe
                      4⤵
                      • Executes dropped EXE
                      PID:2852
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Sun200762fa1d3317c.exe
                    3⤵
                    • Loads dropped DLL
                    PID:652
                    • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun200762fa1d3317c.exe
                      Sun200762fa1d3317c.exe
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1656
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Sun201886ca1ab679bd7.exe
                    3⤵
                      PID:1100
                      • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun201886ca1ab679bd7.exe
                        Sun201886ca1ab679bd7.exe
                        4⤵
                        • Executes dropped EXE
                        PID:2876
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Sun204b77de9242c.exe
                      3⤵
                      • Loads dropped DLL
                      PID:1464
                    • C:\Windows\SysWOW64\WerFault.exe
                      C:\Windows\SysWOW64\WerFault.exe -u -p 1904 -s 476
                      3⤵
                      • Loads dropped DLL
                      • Program crash
                      • Suspicious behavior: EnumeratesProcesses
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2064
                • C:\Users\Admin\AppData\Local\Temp\7zS413C9EA6\Sun204b77de9242c.exe
                  Sun204b77de9242c.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:1780
                • C:\Windows\system32\rundll32.exe
                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                  1⤵
                  • Process spawned unexpected child process
                  PID:2552
                  • C:\Windows\SysWOW64\rundll32.exe
                    rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                    2⤵
                    • Loads dropped DLL
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2572

                Network

                MITRE ATT&CK Enterprise v6

                Replay Monitor

                Loading Replay Monitor...

                Downloads

                • memory/788-54-0x0000000075D41000-0x0000000075D43000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/1044-143-0x00000000021C0000-0x0000000002E0A000-memory.dmp

                  Filesize

                  12.3MB

                  Download

                • memory/1044-178-0x00000000021C0000-0x0000000002E0A000-memory.dmp

                  Filesize

                  12.3MB

                  Download

                • memory/1044-157-0x00000000021C0000-0x0000000002E0A000-memory.dmp

                  Filesize

                  12.3MB

                  Download

                • memory/1108-203-0x0000000000400000-0x0000000000414000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/1536-205-0x0000000000360000-0x0000000000361000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1656-200-0x0000000000B20000-0x0000000000B21000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1700-167-0x0000000000260000-0x0000000000261000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1748-188-0x0000000000400000-0x0000000000414000-memory.dmp

                  Filesize

                  80KB

                  Download

                • memory/1780-230-0x0000000000C20000-0x0000000000C21000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1892-233-0x00000000002B0000-0x00000000002B1000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1892-224-0x0000000001160000-0x0000000001161000-memory.dmp

                  Filesize

                  4KB

                  Download

                • memory/1904-78-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1904-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1904-91-0x000000006B440000-0x000000006B4CF000-memory.dmp

                  Filesize

                  572KB

                  Download

                • memory/1904-90-0x0000000064940000-0x0000000064959000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/1904-87-0x0000000064940000-0x0000000064959000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/1904-93-0x000000006B280000-0x000000006B2A6000-memory.dmp

                  Filesize

                  152KB

                  Download

                • memory/1904-88-0x0000000064940000-0x0000000064959000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/1904-81-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1904-82-0x000000006B280000-0x000000006B2A6000-memory.dmp

                  Filesize

                  152KB

                  Download

                • memory/1904-80-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1904-79-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                  Filesize

                  1.5MB

                  Download

                • memory/1904-89-0x0000000064940000-0x0000000064959000-memory.dmp

                  Filesize

                  100KB

                  Download

                • memory/1904-75-0x000000006B440000-0x000000006B4CF000-memory.dmp

                  Filesize

                  572KB

                  Download

                • memory/1904-76-0x000000006B440000-0x000000006B4CF000-memory.dmp

                  Filesize

                  572KB

                  Download

                • memory/1904-77-0x000000006B440000-0x000000006B4CF000-memory.dmp

                  Filesize

                  572KB

                  Download

                • memory/2724-228-0x000007FEFC4B1000-0x000007FEFC4B3000-memory.dmp

                  Filesize

                  8KB

                  Download

                • memory/2724-226-0x0000000000060000-0x00000000000AD000-memory.dmp

                  Filesize

                  308KB

                  Download