Analysis
-
max time kernel
151s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
30-04-2022 21:23
General
-
Target
aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5.exe
-
Size
160KB
-
MD5
8f70a0f45532261cb4df2800b141551d
-
SHA1
521bbc045dfb7bf9fca55058ed2fc03d86cf8d00
-
SHA256
aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5
-
SHA512
3ea19ee472f3c7f9b7452fb4769fc3cc7591acff0f155889d08dadbd1f6ae289eaa310e220279318ac1536f99ea88e43ff75836aee47f3b4fbe8aa477cb9d099
Malware Config
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
-
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 10 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5.exe"C:\Users\Admin\AppData\Local\Temp\aa2c0a9e34f9fa4cbf1780d757cc84f32a8bd005142012e91a6888167f80f4d5.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\dTw7bWV4FbM6rRFVyc70AjbL.exe"C:\Users\Admin\Pictures\Adobe Films\dTw7bWV4FbM6rRFVyc70AjbL.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\Pictures\Adobe Films\JziJnZN0J69Fa862aaoLglhY.exe"C:\Users\Admin\Pictures\Adobe Films\JziJnZN0J69Fa862aaoLglhY.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 116 -s 7163⤵
- Program crash
-
-
-
C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe"C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe"C:\Users\Admin\Pictures\Adobe Films\FkmRdN5Ol8K_GIEhD3qhfdOk.exe" -u3⤵
- Executes dropped EXE
-
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 444 -p 116 -ip 1161⤵
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD50a525c03073b1e847112516645afb12a
SHA14c5918b8c22840c4cf7cc1c295c9bf65ae735186
SHA256933f5238b8923fa533d794b844223c45989aa310ea3822c495f78c4b7255bc82
SHA51223768e8fbecc3b7bb58463621083e02aa51b2ab11a0af196b975aed47d6b4d8a49fa11d4588d35c160589155f1870ed5b8707e7d97b380f3d46e9076aa76fed2
-
Filesize
124KB
MD52e1ed9a6411f5457e15eb9962d9badc3
SHA1bf803cfd24fe8e890e2bf420a9e27567b878f000
SHA25697ead2057976cc989c024fa9ad761549fa57e53b16ca38aeecf3aa70da77c0ea
SHA512b9d3be71b33b9eea68dd7274e7cb587fa5d59c073f134db147a7d74c357d8f5037a75cfa086c838129ec88a3961061f1e8d95ba00d63ceca5db79674df8cf917
-
Filesize
124KB
MD52e1ed9a6411f5457e15eb9962d9badc3
SHA1bf803cfd24fe8e890e2bf420a9e27567b878f000
SHA25697ead2057976cc989c024fa9ad761549fa57e53b16ca38aeecf3aa70da77c0ea
SHA512b9d3be71b33b9eea68dd7274e7cb587fa5d59c073f134db147a7d74c357d8f5037a75cfa086c838129ec88a3961061f1e8d95ba00d63ceca5db79674df8cf917
-
Filesize
124KB
MD52e1ed9a6411f5457e15eb9962d9badc3
SHA1bf803cfd24fe8e890e2bf420a9e27567b878f000
SHA25697ead2057976cc989c024fa9ad761549fa57e53b16ca38aeecf3aa70da77c0ea
SHA512b9d3be71b33b9eea68dd7274e7cb587fa5d59c073f134db147a7d74c357d8f5037a75cfa086c838129ec88a3961061f1e8d95ba00d63ceca5db79674df8cf917
-
Filesize
3.5MB
MD57cbc3a715be50a7a2ac90aa00fdda5dc
SHA1c6e9102a2898b18d99e6a0defe54e5f3b2cf0474
SHA256f47755c073f054a4e37db79d062ff80bcf5db3681b7f73cb17e5e7c50a9ef000
SHA512772ff2c641918fa3705dac48dd43a5ba258192c15b21e9fc0ed485af4700ceb15f92d88c40498d9ce1893958cb63d42209fa901f2c6d6c09c2d40dd073ae7f9a
-
Filesize
3.5MB
MD57cbc3a715be50a7a2ac90aa00fdda5dc
SHA1c6e9102a2898b18d99e6a0defe54e5f3b2cf0474
SHA256f47755c073f054a4e37db79d062ff80bcf5db3681b7f73cb17e5e7c50a9ef000
SHA512772ff2c641918fa3705dac48dd43a5ba258192c15b21e9fc0ed485af4700ceb15f92d88c40498d9ce1893958cb63d42209fa901f2c6d6c09c2d40dd073ae7f9a
-
Filesize
318KB
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
Filesize
318KB
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
Filesize
6.0MB
-
-
-
Filesize
1.8MB
-
-