Static task
static1
Behavioral task
behavioral1
Sample
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe
Resource
win10v2004-20220414-en
General
-
Target
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642
-
Size
990KB
-
MD5
2908e633ef1caa87c76d224dccca4273
-
SHA1
614e4fc794f18f541bf6ea1fcc2ba7d16fb6f6b8
-
SHA256
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642
-
SHA512
597b05b132e1cf6547826072c07c7e79ea2ae69edd0d025fca654f0b352225133f34d920fa0fd8b44aff04c79a7264cc8864c5ab49534ba7d4c0fa64e51d0ad6
-
SSDEEP
24576:BKaypcZ8ZZbAvZnEoOHUP2MnsiTQEPXM3O4fH6UGBunSdDg:gayprZsvdO0uM0wEO4fH67BunWM
Malware Config
Extracted
socelars
http://www.clinkccaddress.com/index.php/
Signatures
-
Socelars family
Files
-
33698dda39e4e785fa22187b7db0d1b4f9fbaf924f06b045c6666c3ef1a2e642.exe windows x86
cfdde2da245e8f28fba053832236d33f
Code Sign
31:7c:c2:7e:2f:21:9e:7f:b6:58:ea:56:5a:dc:bc:9bCertificate
IssuerCN=Microsoft CorporationNot Before29-01-2019 07:53Not After31-12-2039 23:59SubjectCN=Microsoft Corporation7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21-12-2012 00:00Not After30-12-2020 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18-10-2012 00:00Not After29-12-2020 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
20:35:b0:e0:70:6c:03:55:81:38:07:b5:ca:ae:6a:ea:c5:9c:1b:18Signer
Actual PE Digest20:35:b0:e0:70:6c:03:55:81:38:07:b5:ca:ae:6a:ea:c5:9c:1b:18Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Microsoft Corporation18-02-2019 06:50 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetProcAddress
LoadLibraryW
GetShortPathNameA
MultiByteToWideChar
WideCharToMultiByte
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
Sleep
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetCPInfo
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
WriteConsoleW
wininet
InternetGetCookieExA
Sections
.text Size: 825KB - Virtual size: 825KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 123KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 25KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ