Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
24-06-2022 10:13
General
-
Target
e08d8ddb2ef5d353f6e5cc7fdb514e73.exe
-
Size
378KB
-
MD5
e08d8ddb2ef5d353f6e5cc7fdb514e73
-
SHA1
712477107b3ff723416fd85120cdd9ebf7756724
-
SHA256
79352910f5e31ab1c843a5a7230d1f278dda20f721ad03243dd44f8d7806c2ed
-
SHA512
443be0b4b82725e822773e2bf20a49dba836f105ea99330ecaaa8375f536aa5853d96ad96e37d9a194029e9f3df0c6140dfbeaa36ad8d3abe73f2de9e2e26864
Malware Config
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs 7 IoCs
-
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
suricata: ET MALWARE Win32/Spy.Socelars.S CnC Activity M3
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e08d8ddb2ef5d353f6e5cc7fdb514e73.exe"C:\Users\Admin\AppData\Local\Temp\e08d8ddb2ef5d353f6e5cc7fdb514e73.exe"1⤵
- Modifies Windows Defender Real-time Protection settings
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\Adobe Films\4BwsNIsNVN3L71CHB3aU8dq8.exe"C:\Users\Admin\Pictures\Adobe Films\4BwsNIsNVN3L71CHB3aU8dq8.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1600 -s 14362⤵
- Program crash
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
318KB
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
Filesize
318KB
MD53f22bd82ee1b38f439e6354c60126d6d
SHA163b57d818f86ea64ebc8566faeb0c977839defde
SHA256265c2ddc8a21e6fa8dfaa38ef0e77df8a2e98273a1abfb575aef93c0cc8ee96a
SHA512b73e8e17e5e99d0e9edfb690ece8b0c15befb4d48b1c4f2fe77c5e3daf01df35858c06e1403a8636f86363708b80123d12122cb821a86b575b184227c760988f
-
Filesize
8KB
-
Filesize
204KB
-
Filesize
112KB
-
Filesize
636KB
-
Filesize
112KB
-
Filesize
636KB
-
Filesize
1.7MB
-
Filesize
1.7MB
-
-