Analysis

  • max time kernel
    151s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    27/12/2021, 00:11

General

  • Target

    a485cb752e66e54c92ef00a9ae8f2eba.exe

  • Size

    6.4MB

  • MD5

    a485cb752e66e54c92ef00a9ae8f2eba

  • SHA1

    c267fb5e1d5bd1abd6b3d4d4faea91587b600586

  • SHA256

    1d7c3a08d1e69e704039850f64a88363fc6c9f3721907aa3c0d8165ae20de3a1

  • SHA512

    c8b4a0c892f00a395ad01edcc2798f1ba51c1efe94b7579c5f857277658f6ce18e6da46dfde3969fd1dfc45083de68552b86a8d16658816f2c91c8eec2b278b1

Malware Config

Extracted

Family

socelars

C2

http://www.chosenncrowned.com/

Extracted

Family

vidar

Version

49.2

Botnet

915

C2

https://mstdn.social/@kipriauk9

https://qoto.org/@kipriauk8

Attributes
  • profile_id

    915

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 2 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • NirSoft WebBrowserPassView 4 IoCs

    Password recovery tool for various web browsers

  • Nirsoft 5 IoCs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Downloads MZ/PE file
  • Executes dropped EXE 21 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 2 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 42 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a485cb752e66e54c92ef00a9ae8f2eba.exe
    "C:\Users\Admin\AppData\Local\Temp\a485cb752e66e54c92ef00a9ae8f2eba.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:836
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:524
      • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1392
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
          4⤵
            PID:1760
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1068
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1088
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1700
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri05e80376d7965136.exe
            4⤵
            • Loads dropped DLL
            PID:1488
            • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri05e80376d7965136.exe
              Fri05e80376d7965136.exe
              5⤵
              • Executes dropped EXE
              PID:456
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Fri0573cd0e4548.exe
            4⤵
            • Loads dropped DLL
            PID:832
            • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0573cd0e4548.exe
              Fri0573cd0e4548.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Checks processor information in registry
              PID:1400
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /im Fri0573cd0e4548.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0573cd0e4548.exe" & del C:\ProgramData\*.dll & exit
                6⤵
                  PID:2120
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /im Fri0573cd0e4548.exe /f
                    7⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2196
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 6
                    7⤵
                    • Delays execution with timeout.exe
                    PID:2292
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Fri053a5ee7e3db.exe
              4⤵
              • Loads dropped DLL
              PID:1544
              • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri053a5ee7e3db.exe
                Fri053a5ee7e3db.exe
                5⤵
                • Executes dropped EXE
                PID:1468
                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                  C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  PID:2192
                • C:\Users\Admin\AppData\Local\Temp\11111.exe
                  C:\Users\Admin\AppData\Local\Temp\11111.exe /stab C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                  6⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious behavior: EnumeratesProcesses
                  PID:2272
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Fri055ab567d9ab89d73.exe
              4⤵
              • Loads dropped DLL
              PID:1616
              • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri055ab567d9ab89d73.exe
                Fri055ab567d9ab89d73.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1732
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Fri05d87299ab2865e.exe
              4⤵
              • Loads dropped DLL
              PID:316
              • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri05d87299ab2865e.exe
                Fri05d87299ab2865e.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:2564
                • C:\Windows\SysWOW64\control.exe
                  "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                  6⤵
                    PID:2652
                    • C:\Windows\SysWOW64\rundll32.exe
                      "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                      7⤵
                      • Loads dropped DLL
                      PID:2684
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c Fri05f64325d01.exe
                4⤵
                • Loads dropped DLL
                PID:1696
                • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri05f64325d01.exe
                  Fri05f64325d01.exe
                  5⤵
                    PID:888
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c Fri058313bd59e.exe
                  4⤵
                    PID:1888
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c Fri0510f5b933f.exe /mixtwo
                    4⤵
                      PID:1528
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Fri0519054cecb36fc1b.exe
                      4⤵
                      • Loads dropped DLL
                      PID:1416
                      • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0519054cecb36fc1b.exe
                        Fri0519054cecb36fc1b.exe
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        PID:1940
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Fri059521701074cbcde.exe
                      4⤵
                      • Loads dropped DLL
                      PID:1728
                      • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri059521701074cbcde.exe
                        Fri059521701074cbcde.exe
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Checks SCSI registry key(s)
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious behavior: MapViewOfSection
                        PID:976
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c Fri05cac54300eb.exe
                      4⤵
                      • Loads dropped DLL
                      PID:1600
                      • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri05cac54300eb.exe
                        Fri05cac54300eb.exe
                        5⤵
                        • Executes dropped EXE
                        • Loads dropped DLL
                        • Modifies system certificate store
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1676
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c taskkill /f /im chrome.exe
                          6⤵
                            PID:2540
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im chrome.exe
                              7⤵
                              • Kills process with taskkill
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2592
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Fri0573351d0136.exe
                        4⤵
                        • Loads dropped DLL
                        PID:1560
                        • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0573351d0136.exe
                          Fri0573351d0136.exe
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:280
                          • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0573351d0136.exe
                            C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0573351d0136.exe
                            6⤵
                            • Executes dropped EXE
                            PID:2860
                          • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0573351d0136.exe
                            C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0573351d0136.exe
                            6⤵
                            • Executes dropped EXE
                            • Loads dropped DLL
                            PID:3056
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Fri0506cb2ead94f.exe
                        4⤵
                        • Loads dropped DLL
                        PID:708
                        • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0506cb2ead94f.exe
                          Fri0506cb2ead94f.exe
                          5⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Loads dropped DLL
                          • Suspicious behavior: EnumeratesProcesses
                          PID:1240
                          • C:\Users\Admin\Pictures\Adobe Films\aXsiEubc0n7fJWBLEuPsyQeI.exe
                            "C:\Users\Admin\Pictures\Adobe Films\aXsiEubc0n7fJWBLEuPsyQeI.exe"
                            6⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:2748
                          • C:\Windows\SysWOW64\WerFault.exe
                            C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1512
                            6⤵
                            • Program crash
                            PID:3044
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Fri05c25ad4f6fe4.exe
                        4⤵
                        • Loads dropped DLL
                        PID:1020
                        • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri05c25ad4f6fe4.exe
                          Fri05c25ad4f6fe4.exe
                          5⤵
                          • Executes dropped EXE
                          PID:1128
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c Fri0550507893048c.exe
                        4⤵
                        • Loads dropped DLL
                        PID:1208
                        • C:\Users\Admin\AppData\Local\Temp\7zSC024FDF5\Fri0550507893048c.exe
                          Fri0550507893048c.exe
                          5⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          PID:1280
                          • C:\Windows\SysWOW64\control.exe
                            "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                            6⤵
                              PID:2324
                              • C:\Windows\SysWOW64\rundll32.exe
                                "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\KGG6K.cpL",
                                7⤵
                                • Loads dropped DLL
                                PID:2352
                  • C:\Users\Admin\AppData\Local\Temp\560C.exe
                    C:\Users\Admin\AppData\Local\Temp\560C.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1088
                    • C:\Users\Admin\AppData\Local\Temp\560C.exe
                      C:\Users\Admin\AppData\Local\Temp\560C.exe
                      2⤵
                      • Executes dropped EXE
                      PID:1068

                  Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/280-199-0x0000000000B50000-0x0000000000BDA000-memory.dmp

                          Filesize

                          552KB

                        • memory/280-197-0x0000000000B50000-0x0000000000BDA000-memory.dmp

                          Filesize

                          552KB

                        • memory/280-210-0x0000000002440000-0x0000000002441000-memory.dmp

                          Filesize

                          4KB

                        • memory/280-212-0x0000000000350000-0x0000000000351000-memory.dmp

                          Filesize

                          4KB

                        • memory/836-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

                          Filesize

                          8KB

                        • memory/976-231-0x0000000000400000-0x00000000004D3000-memory.dmp

                          Filesize

                          844KB

                        • memory/976-226-0x0000000000630000-0x0000000000640000-memory.dmp

                          Filesize

                          64KB

                        • memory/976-229-0x0000000000240000-0x0000000000249000-memory.dmp

                          Filesize

                          36KB

                        • memory/1068-200-0x0000000001F90000-0x0000000002BDA000-memory.dmp

                          Filesize

                          12.3MB

                        • memory/1068-270-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/1068-201-0x0000000001F90000-0x0000000002BDA000-memory.dmp

                          Filesize

                          12.3MB

                        • memory/1068-269-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/1068-264-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/1068-271-0x0000000001F00000-0x0000000001F01000-memory.dmp

                          Filesize

                          4KB

                        • memory/1088-260-0x0000000000820000-0x00000000008AA000-memory.dmp

                          Filesize

                          552KB

                        • memory/1088-259-0x0000000000820000-0x00000000008AA000-memory.dmp

                          Filesize

                          552KB

                        • memory/1088-261-0x0000000004B10000-0x0000000004B11000-memory.dmp

                          Filesize

                          4KB

                        • memory/1088-262-0x0000000000330000-0x0000000000331000-memory.dmp

                          Filesize

                          4KB

                        • memory/1240-228-0x0000000004100000-0x000000000424E000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/1380-239-0x0000000002600000-0x0000000002616000-memory.dmp

                          Filesize

                          88KB

                        • memory/1392-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                          Filesize

                          1.5MB

                        • memory/1392-95-0x000000006B440000-0x000000006B4CF000-memory.dmp

                          Filesize

                          572KB

                        • memory/1392-97-0x000000006B280000-0x000000006B2A6000-memory.dmp

                          Filesize

                          152KB

                        • memory/1392-92-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                          Filesize

                          1.5MB

                        • memory/1392-96-0x000000006B280000-0x000000006B2A6000-memory.dmp

                          Filesize

                          152KB

                        • memory/1392-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                          Filesize

                          1.5MB

                        • memory/1392-93-0x0000000064940000-0x0000000064959000-memory.dmp

                          Filesize

                          100KB

                        • memory/1392-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                          Filesize

                          1.5MB

                        • memory/1392-85-0x0000000064940000-0x0000000064959000-memory.dmp

                          Filesize

                          100KB

                        • memory/1392-86-0x000000006B440000-0x000000006B4CF000-memory.dmp

                          Filesize

                          572KB

                        • memory/1392-94-0x000000006FE40000-0x000000006FFC6000-memory.dmp

                          Filesize

                          1.5MB

                        • memory/1392-83-0x000000006B440000-0x000000006B4CF000-memory.dmp

                          Filesize

                          572KB

                        • memory/1392-87-0x0000000064940000-0x0000000064959000-memory.dmp

                          Filesize

                          100KB

                        • memory/1392-91-0x0000000064940000-0x0000000064959000-memory.dmp

                          Filesize

                          100KB

                        • memory/1392-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

                          Filesize

                          572KB

                        • memory/1400-204-0x0000000001FA0000-0x0000000002075000-memory.dmp

                          Filesize

                          852KB

                        • memory/1400-202-0x0000000000650000-0x00000000006CC000-memory.dmp

                          Filesize

                          496KB

                        • memory/1400-205-0x0000000000400000-0x0000000000535000-memory.dmp

                          Filesize

                          1.2MB

                        • memory/1700-203-0x0000000001E50000-0x0000000002A9A000-memory.dmp

                          Filesize

                          12.3MB

                        • memory/1700-198-0x0000000001E50000-0x0000000002A9A000-memory.dmp

                          Filesize

                          12.3MB

                        • memory/1732-272-0x000000001AA90000-0x000000001AA92000-memory.dmp

                          Filesize

                          8KB

                        • memory/1732-219-0x0000000000D50000-0x0000000000D58000-memory.dmp

                          Filesize

                          32KB

                        • memory/1732-218-0x0000000000D50000-0x0000000000D58000-memory.dmp

                          Filesize

                          32KB

                        • memory/2192-208-0x0000000000400000-0x0000000000455000-memory.dmp

                          Filesize

                          340KB

                        • memory/2272-213-0x0000000000400000-0x000000000047C000-memory.dmp

                          Filesize

                          496KB

                        • memory/2352-236-0x0000000000DF0000-0x0000000000EA6000-memory.dmp

                          Filesize

                          728KB

                        • memory/2352-235-0x00000000009F0000-0x0000000000AA9000-memory.dmp

                          Filesize

                          740KB

                        • memory/3056-244-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/3056-250-0x00000000006A0000-0x00000000006A1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3056-243-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/3056-242-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/3056-241-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/3056-245-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/3056-248-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/3056-249-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB