Static task
static1
Behavioral task
behavioral1
Sample
356bbcec7867f89555b633c6764c082511178036046c5c8206713bdd8c4724e8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
356bbcec7867f89555b633c6764c082511178036046c5c8206713bdd8c4724e8.exe
Resource
win10v2004-20220414-en
General
-
Target
356bbcec7867f89555b633c6764c082511178036046c5c8206713bdd8c4724e8
-
Size
992KB
-
MD5
a4bb662d473fbfff6180e3ff6a3b5d74
-
SHA1
246e05cc59947ccf7157513c970b71874cb29c27
-
SHA256
356bbcec7867f89555b633c6764c082511178036046c5c8206713bdd8c4724e8
-
SHA512
ba894c67f29774b478017a732004ea280bfb3591b418adb88e6e0c40a281aa1ac70e3dceb00225a05073a536769f67f8ac8c609e31ce6d2a8a2ed9a7847d1292
-
SSDEEP
24576:GkTXpAGNHKifnS+oYG0h47O1ZGqr9czXCDziLK/Cks0glhRU:5TXpoi/S2GCyO11cmDziLK/Xs0gO
Malware Config
Extracted
socelars
http://www.likewisemeticulous.com/index.php/
Signatures
-
Socelars family
Files
-
356bbcec7867f89555b633c6764c082511178036046c5c8206713bdd8c4724e8.exe windows x86
e82dad21876ce5c1716751d8682fb138
Code Sign
31:7c:c2:7e:2f:21:9e:7f:b6:58:ea:56:5a:dc:bc:9bCertificate
IssuerCN=Microsoft CorporationNot Before29-01-2019 07:53Not After31-12-2039 23:59SubjectCN=Microsoft Corporation7e:93:eb:fb:7c:c6:4e:59:ea:4b:9a:77:d4:06:fc:3bCertificate
IssuerCN=Thawte Timestamping CA,OU=Thawte Certification,O=Thawte,L=Durbanville,ST=Western Cape,C=ZANot Before21-12-2012 00:00Not After30-12-2020 23:59SubjectCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageCertSign
KeyUsageCRLSign
0e:cf:f4:38:c8:fe:bf:35:6e:04:d8:6a:98:1b:1a:50Certificate
IssuerCN=Symantec Time Stamping Services CA - G2,O=Symantec Corporation,C=USNot Before18-10-2012 00:00Not After29-12-2020 23:59SubjectCN=Symantec Time Stamping Services Signer - G4,O=Symantec Corporation,C=USExtended Key Usages
ExtKeyUsageTimeStamping
Key Usages
KeyUsageDigitalSignature
a8:5f:a1:42:ce:34:47:56:56:37:fd:ce:c1:37:14:2d:14:f7:7f:69Signer
Actual PE Digesta8:5f:a1:42:ce:34:47:56:56:37:fd:ce:c1:37:14:2d:14:f7:7f:69Digest Algorithmsha1PE Digest MatchestrueSignature Validations
TrustedfalseVerification
Signing CertificateCN=Microsoft Corporation30-01-2019 03:21 Valid: false
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
Imports
kernel32
GetLastError
GetProcAddress
LoadLibraryW
GetShortPathNameA
MultiByteToWideChar
WideCharToMultiByte
Sleep
SetStdHandle
SetEnvironmentVariableW
FreeEnvironmentStringsW
AreFileApisANSI
ReadFile
TryEnterCriticalSection
HeapCreate
HeapFree
EnterCriticalSection
GetFullPathNameW
WriteFile
GetDiskFreeSpaceW
OutputDebugStringA
LockFile
LeaveCriticalSection
InitializeCriticalSection
SetFilePointer
GetFullPathNameA
SetEndOfFile
UnlockFileEx
GetTempPathW
CreateMutexW
WaitForSingleObject
CreateFileW
GetFileAttributesW
GetCurrentThreadId
UnmapViewOfFile
HeapValidate
HeapSize
GetTempPathA
FormatMessageW
GetDiskFreeSpaceA
GetFileAttributesA
GetFileAttributesExW
OutputDebugStringW
FlushViewOfFile
CreateFileA
LoadLibraryA
WaitForSingleObjectEx
DeleteFileA
DeleteFileW
HeapReAlloc
CloseHandle
GetSystemInfo
HeapAlloc
HeapCompact
HeapDestroy
UnlockFile
LocalFree
LockFileEx
GetFileSize
DeleteCriticalSection
GetCurrentProcessId
GetProcessHeap
SystemTimeToFileTime
FreeLibrary
GetSystemTimeAsFileTime
GetSystemTime
FormatMessageA
CreateFileMappingW
MapViewOfFile
QueryPerformanceCounter
GetTickCount
FlushFileBuffers
GetCPInfo
EncodePointer
DecodePointer
SetLastError
InitializeCriticalSectionAndSpinCount
CreateEventW
SwitchToThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
GetModuleHandleW
CompareStringW
LCMapStringW
GetLocaleInfoW
GetStringTypeW
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
SetEvent
ResetEvent
IsDebuggerPresent
GetStartupInfoW
InitializeSListHead
RtlUnwind
RaiseException
LoadLibraryExW
CreateThread
ExitThread
FreeLibraryAndExitThread
GetModuleHandleExW
ExitProcess
GetModuleFileNameW
GetStdHandle
GetCommandLineA
GetCommandLineW
GetConsoleMode
ReadConsoleW
SetFilePointerEx
GetFileType
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetConsoleCP
GetTimeZoneInformation
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
WriteConsoleW
wininet
InternetGetCookieExA
Sections
.text Size: 820KB - Virtual size: 819KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zzzstuc Size: 512B - Virtual size: 138B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zzzstuc Size: 1024B - Virtual size: 634B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.protect Size: 512B - Virtual size: 403B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sony3 Size: 1024B - Virtual size: 742B
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sony1 Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.sony2 Size: 2KB - Virtual size: 2KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 124KB - Virtual size: 123KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 8KB - Virtual size: 15KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 2KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 26KB - Virtual size: 26KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ