Analysis
- max time kernel
152s - max time network
162s - platform
windows7_x64 - resource
win7-20220331-en - submitted
10/04/2022, 11:06
Static task
static1
Behavioral task
behavioral1
Sample
c9586ef07c741e4a06eef3fa6e66e165.exe
Resource
win7-20220331-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c9586ef07c741e4a06eef3fa6e66e165.exe
Resource
win10v2004-20220331-en
windows10-2004_x64
0 signatures
0 seconds
General
- Target c9586ef07c741e4a06eef3fa6e66e165.exe
- Size 174KB
- Sample220410-m7dp7aaaak
- SHA256 1b6db2ff76f4564310210b20e13118f37c92e1ef46541b1aec6b5a98be598ae4
- MD5 c9586ef07c741e4a06eef3fa6e66e165
- SHA1 b67c05496d160eaf4b2f503c7afb15fe0734de27
- SHA512 59744d9dfb68e0648f209a8ab797f20d29497239fe076d30a7b063bf75d651695db74b589641ae91104a8fa6c87bf5aa1bf876221171df621b7abcca7d13e684
- MD5 SHA1 SHA512
Malware Config
Signatures
- suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
pid Process 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3422572840-2899912402-917774768-1000\Control Panel\International\Geo\Nation c9586ef07c741e4a06eef3fa6e66e165.exe - Loads dropped DLL 1 IoCs
pid Process 1572 c9586ef07c741e4a06eef3fa6e66e165.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 ipinfo.io 16 ipinfo.io - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 1628 1572 WerFault.exe 19 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe 1868 5mnCO2GDlCDHf2P1zT6olfxr.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1572 wrote to memory of 1868 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 30 PID 1572 wrote to memory of 1868 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 30 PID 1572 wrote to memory of 1868 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 30 PID 1572 wrote to memory of 1868 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 30 PID 1572 wrote to memory of 1628 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 31 PID 1572 wrote to memory of 1628 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 31 PID 1572 wrote to memory of 1628 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 31 PID 1572 wrote to memory of 1628 1572 c9586ef07c741e4a06eef3fa6e66e165.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c9586ef07c741e4a06eef3fa6e66e165.exe"C:\Users\Admin\AppData\Local\Temp\c9586ef07c741e4a06eef3fa6e66e165.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Users\Admin\Pictures\Adobe Films\5mnCO2GDlCDHf2P1zT6olfxr.exe"C:\Users\Admin\Pictures\Adobe Films\5mnCO2GDlCDHf2P1zT6olfxr.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1868
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 14162⤵
- Program crash
PID:1628
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\Pictures\Adobe Films\5mnCO2GDlCDHf2P1zT6olfxr.exe
- Size 318KB
- SHA256 265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
- MD5 3f22bd82ee1b38f439e6354c60126d6d
- SHA1 63b57d818f86ea64ebc8566faeb0c977839defde
- SHA512 b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
- SSDEEP 6144:ej4R3H20xSWLE2Sgct82tCOcfX+A5yF17s:ejcG72Et8Vf81
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\Pictures\Adobe Films\5mnCO2GDlCDHf2P1zT6olfxr.exe
- Size 318KB
- SHA256 265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
- MD5 3f22bd82ee1b38f439e6354c60126d6d
- SHA1 63b57d818f86ea64ebc8566faeb0c977839defde
- SHA512 b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
- SSDEEP 6144:ej4R3H20xSWLE2Sgct82tCOcfX+A5yF17s:ejcG72Et8Vf81
- MD5 SHA1 SHA512 SSDEEP