socelars | 72073e22e81da454b5ec4028c5ed91e31dd1874b1479d105582a08b1f3b1ee69

Analysis

max time kernel
433s
max time network
439s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2023, 23:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Install.exe
Size

1.4MB
MD5

deeb8730435a83cb41ca5679429cb235
SHA1

c4eb99a6c3310e9b36c31b9572d57a210985b67d
SHA256

002f4696f089281a8c82f3156063cee84249d1715055e721a47618f2efecf150
SHA512

4235fa18fcc183ef02a1832790af466f7fdeda69435ebc561cb11209e049e890917b2c72be38fa8e1039493ae20fdbbe93776895b27a021d498f81d3e00c7379
SSDEEP

24576:EIVFA1pqtg/TnMbX0lwyh0FVmEBy/1kwFYyOscM5cPtSixJeQHYf7v:lFA1pvTMbOwa0TmzSMYElePtSiWQHYDv

Score

10^/10

socelars spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 1 IoCs

evasion

pid	Process
2352	taskkill.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	3412	Install.exe
Token: SeAssignPrimaryTokenPrivilege	3412	Install.exe
Token: SeLockMemoryPrivilege	3412	Install.exe
Token: SeIncreaseQuotaPrivilege	3412	Install.exe
Token: SeMachineAccountPrivilege	3412	Install.exe
Token: SeTcbPrivilege	3412	Install.exe
Token: SeSecurityPrivilege	3412	Install.exe
Token: SeTakeOwnershipPrivilege	3412	Install.exe
Token: SeLoadDriverPrivilege	3412	Install.exe
Token: SeSystemProfilePrivilege	3412	Install.exe
Token: SeSystemtimePrivilege	3412	Install.exe
Token: SeProfSingleProcessPrivilege	3412	Install.exe
Token: SeIncBasePriorityPrivilege	3412	Install.exe
Token: SeCreatePagefilePrivilege	3412	Install.exe
Token: SeCreatePermanentPrivilege	3412	Install.exe
Token: SeBackupPrivilege	3412	Install.exe
Token: SeRestorePrivilege	3412	Install.exe
Token: SeShutdownPrivilege	3412	Install.exe
Token: SeDebugPrivilege	3412	Install.exe
Token: SeAuditPrivilege	3412	Install.exe
Token: SeSystemEnvironmentPrivilege	3412	Install.exe
Token: SeChangeNotifyPrivilege	3412	Install.exe
Token: SeRemoteShutdownPrivilege	3412	Install.exe
Token: SeUndockPrivilege	3412	Install.exe
Token: SeSyncAgentPrivilege	3412	Install.exe
Token: SeEnableDelegationPrivilege	3412	Install.exe
Token: SeManageVolumePrivilege	3412	Install.exe
Token: SeImpersonatePrivilege	3412	Install.exe
Token: SeCreateGlobalPrivilege	3412	Install.exe
Token: 31	3412	Install.exe
Token: 32	3412	Install.exe
Token: 33	3412	Install.exe
Token: 34	3412	Install.exe
Token: 35	3412	Install.exe
Token: SeDebugPrivilege	2352	taskkill.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3412 wrote to memory of 3008	3412	Install.exe	88
PID 3412 wrote to memory of 3008	3412	Install.exe	88
PID 3412 wrote to memory of 3008	3412	Install.exe	88
PID 3008 wrote to memory of 2352	3008	cmd.exe	90
PID 3008 wrote to memory of 2352	3008	cmd.exe	90
PID 3008 wrote to memory of 2352	3008	cmd.exe	90

C:\Users\Admin\AppData\Local\Temp\Install.exe
"C:\Users\Admin\AppData\Local\Temp\Install.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3008
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2352

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...