socelars | 13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78

Analysis

Target

13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe
Size

569KB
MD5

eab34089ba89eb30bab4d46d0d1d7c63
SHA1

676f13707c42ff4b0324ae9854096729f7541d0f
SHA256

13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78
SHA512

c47ac4760e1950575d2f5012b2bfd029cbf1d670f9e075f2b2faa18a129785957342d3bef0f3120e37c4610a221f489aef705b8e647da0861d678278e77bff6e

Score

10^/10

Family

socelars

http://www.createinfo.pw/

http://www.allinfo.pw/

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

Processes:

resource	yara_rule
behavioral1/memory/1492-55-0x0000000000400000-0x0000000000541000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1820 1492 WerFault.exe 13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe

pid	pid_target	process	target process
1820	1492	WerFault.exe	13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe

description	pid	process	target process
PID 1492 wrote to memory of 1820	1492	13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe	WerFault.exe
PID 1492 wrote to memory of 1820	1492	13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe	WerFault.exe
PID 1492 wrote to memory of 1820	1492	13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe	WerFault.exe
PID 1492 wrote to memory of 1820	1492	13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe
"C:\Users\Admin\AppData\Local\Temp\13f90329010f340108f283ae7c832b5c51e32d4ddfd48657f8a9961b1b09ed78.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1492 -s 500
2⤵
- Program crash
PID:1820

memory/1492-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

Filesize
8KB

Download
memory/1492-55-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/1820-56-0x0000000000000000-mapping.dmp

Download