Overview

overview

10

Static

static

dridex

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    f4e22465a3a1d007d678751b7b5b751577988244cc299e8939127c50be3cb3c4

  • Size

    183KB

  • Sample

    220803-s1exkadffr

  • MD5

    c0e3f6c3e90453823ff78f18e2760dbb

  • SHA1

    558301de47973642798e7d463ce042bd2949140c

  • SHA256

    f4e22465a3a1d007d678751b7b5b751577988244cc299e8939127c50be3cb3c4

  • SHA512

    6a2e85c34774d5dde5de64fb7c0722ee03e5d35e4df13f44c7f9e9220b5e0017717ca3aeaf77c0f552340c8869eaf9ee23b6ff2fa170dd9ca53efbc7c959e17e

Score
10/10
socelarsstealervmprotect

Malware Config

Extracted

Family

socelars

C2

https://hueduy.s3.eu-west-1.amazonaws.com/dkfjrg725/

Targets

    • Target

      f4e22465a3a1d007d678751b7b5b751577988244cc299e8939127c50be3cb3c4

    • Size

      183KB

    • MD5

      c0e3f6c3e90453823ff78f18e2760dbb

    • SHA1

      558301de47973642798e7d463ce042bd2949140c

    • SHA256

      f4e22465a3a1d007d678751b7b5b751577988244cc299e8939127c50be3cb3c4

    • SHA512

      6a2e85c34774d5dde5de64fb7c0722ee03e5d35e4df13f44c7f9e9220b5e0017717ca3aeaf77c0f552340c8869eaf9ee23b6ff2fa170dd9ca53efbc7c959e17e

    Score
    10/10
    socelarsstealervmprotect

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Socelars

      Socelars is an infostealer targeting browser cookies and credit card credentials.

      stealersocelars

    • Socelars payload

    • Downloads MZ/PE file

    • Executes dropped EXE

    • VMProtect packed file

      Detects executables packed with VMProtect commercial packer.

      vmprotect

    • Checks computer location settings

      Looks up country code configured in the registry, likely geofence.

    • Loads dropped DLL

    • Looks up external IP address via web service

      Uses a legitimate IP lookup service to find the infected system's external IP.

    behavioral1

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

3
T1082

Peripheral Device Discovery

1
T1120

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Tasks