socelars | 4651270dd4ecec382fc2b62f0f946379107945dea1b36f168be59db502be81ee

Analysis

max time kernel
65s
max time network
120s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05-12-2022 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8194c5a8a145a9c76349c08afc5caa1f.exe
Size

675KB
MD5

8194c5a8a145a9c76349c08afc5caa1f
SHA1

059ec1283f5d812533d662c3d569eb286973602e
SHA256

4651270dd4ecec382fc2b62f0f946379107945dea1b36f168be59db502be81ee
SHA512

1443cb59203de429f7f12e75af0912a372e83d6fd74508f514affdad6545c0883b77fd3b227be709145882088868a5c90389b4a527e5621e14ad5127237b6d24
SSDEEP

12288:xqlMhfymUyZzk8ri+hcGgn9cJBJYGahyHY2oSjqOe6zUDmg:x5kxyZFe+hcGEXGwiY2j25

Score

10^/10

socelars stealer upx

Malware Config

Extracted

Family

socelars

https://hdbywe.s3.us-west-2.amazonaws.com/sauydga27/

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1544-55-0x0000000000400000-0x000000000058E000-memory.dmp	family_socelars

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral1/memory/1544-55-0x0000000000400000-0x000000000058E000-memory.dmp	upx

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1444 1544 WerFault.exe 8194c5a8a145a9c76349c08afc5caa1f.exe

pid	pid_target	process	target process
1444	1544	WerFault.exe	8194c5a8a145a9c76349c08afc5caa1f.exe

Suspicious use of AdjustPrivilegeToken 34 IoCs

Processes:

8194c5a8a145a9c76349c08afc5caa1f.exe

description	pid	process
Token: SeCreateTokenPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeAssignPrimaryTokenPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeLockMemoryPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeIncreaseQuotaPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeMachineAccountPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeTcbPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeSecurityPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeTakeOwnershipPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeLoadDriverPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeSystemProfilePrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeSystemtimePrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeProfSingleProcessPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeIncBasePriorityPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeCreatePagefilePrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeCreatePermanentPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeBackupPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeRestorePrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeShutdownPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeDebugPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeAuditPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeSystemEnvironmentPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeChangeNotifyPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeRemoteShutdownPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeUndockPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeSyncAgentPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeEnableDelegationPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeManageVolumePrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeImpersonatePrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: SeCreateGlobalPrivilege	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: 31	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: 32	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: 33	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: 34	1544	8194c5a8a145a9c76349c08afc5caa1f.exe
Token: 35	1544	8194c5a8a145a9c76349c08afc5caa1f.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

8194c5a8a145a9c76349c08afc5caa1f.exe

description	pid	process	target process
PID 1544 wrote to memory of 1444	1544	8194c5a8a145a9c76349c08afc5caa1f.exe	WerFault.exe
PID 1544 wrote to memory of 1444	1544	8194c5a8a145a9c76349c08afc5caa1f.exe	WerFault.exe
PID 1544 wrote to memory of 1444	1544	8194c5a8a145a9c76349c08afc5caa1f.exe	WerFault.exe
PID 1544 wrote to memory of 1444	1544	8194c5a8a145a9c76349c08afc5caa1f.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\8194c5a8a145a9c76349c08afc5caa1f.exe
"C:\Users\Admin\AppData\Local\Temp\8194c5a8a145a9c76349c08afc5caa1f.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1544

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1544 -s 652
2⤵
- Program crash
PID:1444

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1444-56-0x0000000000000000-mapping.dmp

Download
memory/1544-54-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download
memory/1544-55-0x0000000000400000-0x000000000058E000-memory.dmp

Filesize
1.6MB

Download