socelars | 11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc

Analysis

max time kernel
31s
max time network
148s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
31-10-2023 12:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Size

1.4MB
MD5

93789abbde84977083ca1014adb78b36
SHA1

2ccf6a9639078b3958cab3c52ff1350029a92780
SHA256

11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc
SHA512

6a1e30b7b85dd3cc2690eebf6623285c5d554e13e0e451decb880e3a17ae2f508dc83ec9141d37b6ee1151cf8abf15811f6592ff8ce68244381093794a612c30
SSDEEP

24576:XQpyBPGxrdclka3bP2WwgTKbgtD8rs1gPPKetzqBRs:ApcEiKdaTmPPKepqjs

Score

10^/10

socelars spyware stealer

Malware Config

Extracted

Family

socelars

https://hdbywe.s3.us-west-2.amazonaws.com/wduwe19/

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

Socelars payload 1 IoCs

resource	yara_rule
behavioral1/memory/2232-0-0x0000000000180000-0x00000000002F6000-memory.dmp	family_socelars

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
1668	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeAssignPrimaryTokenPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeLockMemoryPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeIncreaseQuotaPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeMachineAccountPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeTcbPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeSecurityPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeTakeOwnershipPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeLoadDriverPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeSystemProfilePrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeSystemtimePrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeProfSingleProcessPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeIncBasePriorityPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeCreatePagefilePrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeCreatePermanentPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeBackupPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeRestorePrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeShutdownPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeDebugPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeAuditPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeSystemEnvironmentPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeChangeNotifyPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeRemoteShutdownPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeUndockPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeSyncAgentPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeEnableDelegationPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeManageVolumePrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeImpersonatePrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeCreateGlobalPrivilege	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: 31	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: 32	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: 33	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: 34	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: 35	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
Token: SeDebugPrivilege	1668	taskkill.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe
Token: SeShutdownPrivilege	2628	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe
2628	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 2604	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe	28
PID 2232 wrote to memory of 2604	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe	28
PID 2232 wrote to memory of 2604	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe	28
PID 2232 wrote to memory of 2604	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe	28
PID 2604 wrote to memory of 1668	2604	cmd.exe	30
PID 2604 wrote to memory of 1668	2604	cmd.exe	30
PID 2604 wrote to memory of 1668	2604	cmd.exe	30
PID 2604 wrote to memory of 1668	2604	cmd.exe	30
PID 2232 wrote to memory of 2628	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe	33
PID 2232 wrote to memory of 2628	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe	33
PID 2232 wrote to memory of 2628	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe	33
PID 2232 wrote to memory of 2628	2232	11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe	33
PID 2628 wrote to memory of 2508	2628	chrome.exe	34
PID 2628 wrote to memory of 2508	2628	chrome.exe	34
PID 2628 wrote to memory of 2508	2628	chrome.exe	34
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2884	2628	chrome.exe	36
PID 2628 wrote to memory of 2400	2628	chrome.exe	38
PID 2628 wrote to memory of 2400	2628	chrome.exe	38
PID 2628 wrote to memory of 2400	2628	chrome.exe	38
PID 2628 wrote to memory of 2828	2628	chrome.exe	37
PID 2628 wrote to memory of 2828	2628	chrome.exe	37
PID 2628 wrote to memory of 2828	2628	chrome.exe	37
PID 2628 wrote to memory of 2828	2628	chrome.exe	37
PID 2628 wrote to memory of 2828	2628	chrome.exe	37
PID 2628 wrote to memory of 2828	2628	chrome.exe	37
PID 2628 wrote to memory of 2828	2628	chrome.exe	37

C:\Users\Admin\AppData\Local\Temp\11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe
"C:\Users\Admin\AppData\Local\Temp\11aa18cd6b00fd424f437cc18edaf8ac2ab395743695933e20abc94bf0acdadc.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2604
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1668
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef73c9758,0x7fef73c9768,0x7fef73c9778
    3⤵
    PID:2508
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:2
    3⤵
    PID:2884
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1600 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:8
    3⤵
    PID:2828
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1512 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:8
    3⤵
    PID:2400
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2324 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:1
    3⤵
    PID:2856
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2312 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:1
    3⤵
    PID:2872
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2628 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:1
    3⤵
    PID:1660
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1180 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:2
    3⤵
    PID:1644
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=2656 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:2
    3⤵
    PID:804
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --mojo-platform-channel-handle=3584 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:1
    3⤵
    PID:2688
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3800 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:8
    3⤵
    PID:2568
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=3936 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:8
    3⤵
    PID:2132
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4060 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:8
    3⤵
    PID:2900
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=4076 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:8
    3⤵
    PID:2224
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4676 --field-trial-handle=1196,i,16526267166486547741,15496608791840535314,131072 /prefetch:8
    3⤵
    PID:1976

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html

Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png

Filesize
6KB

MD5
c8d8c174df68910527edabe6b5278f06

SHA1
8ac53b3605fea693b59027b9b471202d150f266f

SHA256
9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5

SHA512
d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js

Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js

Filesize
20KB

MD5
ad6c154ab1bc0f12b34821057922cffa

SHA1
6b42562cce5ac45556f9ded22add5c2322ca1a95

SHA256
1976618857b24067f435e871fcff096d0a426e39ac9ff5868bc4602a90591316

SHA512
2380a8077e20643cdf1a5c7c45b8e80175aea3a805884d83c53a82d45f5ce46ec76b6b848bef6afb53111e37554645188788430126f26e957b3cee9e8f4295f8

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js

Filesize
3KB

MD5
f79618c53614380c5fdc545699afe890

SHA1
7804a4621cd9405b6def471f3ebedb07fb17e90a

SHA256
f3f30c5c271f80b0a3a329b11d8e72eb404d0c0dc9c66fa162ca97ccaa1e963c

SHA512
c4e0c4df6ac92351591859a7c4358b3dcd342e00051bf561e68e3fcc2c94fdd8d14bd0a042d88dca33f6c7e952938786378d804f56e84b4eab99e2a5fee96a4c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js

Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js

Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js

Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json

Filesize
1KB

MD5
6da6b303170ccfdca9d9e75abbfb59f3

SHA1
1a8070080f50a303f73eba253ba49c1e6d400df6

SHA256
66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333

SHA512
872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
b1003e10841e5dad878685def2641746

SHA1
a2acff6397ebd80a26527247f1fc2cfd857c753b

SHA256
0cbfc8ce28de3e4cb6a0456196922d17a635b8e86c0d3d082435c1a13443cdec

SHA512
9e55ff5ee84513636abdd8ceacea6c95e12ac0b40f0bfc694a9fe1edab95c298c56c6b5a37449ed9cad4a11e5b75657b4793e110a33ed7287584b68a05b60915

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
8a42ef79716d134983878ca529f51d49

SHA1
0be3140bbda94e05682aece2994e76cfaaf285df

SHA256
401964d253da4195b08727cbbbcbbc72f30fcd97d537296061f55dc74eb2ec01

SHA512
2afd57fd75eff64848696b15ab4de00852cd3a27a5665974f0d5aaa0dc4c5246e36a0b13e22612820ca6bc6958884880faf3ea60c0866c00abb62ccca823c23a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e8976cd90e2fe815eabb5d197b78e75a

SHA1
5feea84fb62f2c57f58eddde8424ccc19728af4e

SHA256
a29223a3baf1ff534409ceeb2c64d8cca8c19ec82e5c9c8d81e07e98196d4f13

SHA512
10dfb52cbf00743bd7400b4ee3518298f51fb10c0579e1e1c11e0920dee001a77a86e256282be3fea3ec79924d59f1c1cc0669a6c2a51e37506128163b1c74f5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
02a4d25e2baecff5b95fec34b97810cf

SHA1
63bc57b904aa5226ceb054fefc595eb17273a2a0

SHA256
ba1d5fd5cc86470fdce76a6f50d208f0a19d17ff734ae299e1297e024ac36c3f

SHA512
d589cc576f3e886e669c85cd3bb0341a3ed24d99125a14a3d04985cefca5c7f3e9355fd1073036a86a78f1c4eb06420cad076fbc46e1aacc3dcdc3f131a97528

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
e1040d44d31de623cba2c775bb615e32

SHA1
5a408452b4d0b23349f082d9dc35bf18a3230e2c

SHA256
7ef95f90b9d5fb9bb718a9c4f16e67bc09e2ac511d3d6172507de4ef5a1fc529

SHA512
c985d8a34cf7cde62f3998eac609d2949c5fd39b4ff18d9abddbf9e0177486531ad4bd135a7177f5e93a353ff65222873fa484122e248176fd3f7337148d2721

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
1277e63324c4b46e9c55f11deb839453

SHA1
0c6e1d9d91392003aca5603283d31d6c16dde3ef

SHA256
17ae3f284d782cb1433bc0cf0e91b0177660eb6951256efcff408a05dd36b52e

SHA512
406dc791b7403f8b4878d5986248c06dd7f62850f4508b74920cce5bfbc26a533eb17e97351e86acaa950f6b6e9a48daf7d1ba5aba3e9e337bdf1e27bd27e97a

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
346bbd07bf43325183639c8ab0eb519a

SHA1
94810623b5138a7d0d083059a58f3363865b6313

SHA256
eb369ca5172e28829b8e94395946d9fd3062c1c402cb9a4f195b771173052acf

SHA512
ce5c259cb6e3eed5effc5ab0663f3aec6661bd07f5f255542b543b4071822dd7a364d4fdf7ca5a0afdf696fc6b3e55eef748fcd113e3501196d446f5e7f9a25d

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
c50fcdc0975bb1c4d6ecf939e350a341

SHA1
d3c4abefc5ebf82b296269521ace5bd612f50b79

SHA256
4dc7b3c34798519dd0ee009129129abc6e0fa94e9d7420f0986090e9b5501e18

SHA512
e096394fbdd4641883b8599ec049fdd2e5fdd7856add3e4959abba3a512a0d484f1b8e7ae7efd11ceca05e0e1480f8f45e5b020a62f98e1bb57839773826903e

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
11KB

MD5
e6726314da5d9057e12426a22188fb7d

SHA1
b7fb83d52ee868a623a36c2cc476387e8b8bb267

SHA256
d50c9d73b51a5640338398f7f3cd0b4fcab0011450d8ec8616fea40b39321298

SHA512
7b63f911d445157ab6fff52b4073979eb43bcbbbd5c0a0e209d570f8919188720521921197f3e6e9da2674e2cb8d681b3d51e08c014d9b60e9844924933a8134

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\aieoplapobidheellikiicjfpamacpfd\CURRENT~RFf766039.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab61A2.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6203.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
memory/2232-0-0x0000000000180000-0x00000000002F6000-memory.dmp

Filesize
1.5MB

Download