socelars | 8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea

General

Target

8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Size

1.4MB
MD5

e415ffc957f15dd2b4de302e02150a41
SHA1

2a6b974e4453cc771cbe27c1b77cb2dbe220822a
SHA256

8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea
SHA512

7b2a2a582422b2836fcce48319467f93c032966111f7e3de3e85df7c2653bfcd0cca0920d7b3d6df432d5c00f97b2d642202023d95186d4fb19a6bb8869caf94
SSDEEP

24576:A9z7hp10GnN4BhDEYsN4OikFDEQ/lbCFjWlqIgV0edASvoxygyjTYofy:i7hpVNwh/s6OjFpF2jlJNdASvFgyjE5

Score

10^/10

socelars discovery spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2512 taskkill.exe

pid	process
2512	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Key created	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3618187007-3650799920-3290345941-1000\Software\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02401800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exetaskkill.exe

description	pid	process
Token: SeCreateTokenPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeAssignPrimaryTokenPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeLockMemoryPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeIncreaseQuotaPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeMachineAccountPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeTcbPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeSecurityPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeTakeOwnershipPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeLoadDriverPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeSystemProfilePrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeSystemtimePrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeProfSingleProcessPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeIncBasePriorityPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeCreatePagefilePrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeCreatePermanentPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeBackupPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeRestorePrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeShutdownPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeDebugPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeAuditPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeSystemEnvironmentPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeChangeNotifyPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeRemoteShutdownPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeUndockPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeSyncAgentPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeEnableDelegationPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeManageVolumePrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeImpersonatePrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeCreateGlobalPrivilege	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: 31	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: 32	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: 33	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: 34	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: 35	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
Token: SeDebugPrivilege	2512	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.execmd.exe

description	pid	process	target process
PID 3048 wrote to memory of 2744	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe	cmd.exe
PID 3048 wrote to memory of 2744	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe	cmd.exe
PID 3048 wrote to memory of 2744	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe	cmd.exe
PID 3048 wrote to memory of 2744	3048	8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe	cmd.exe
PID 2744 wrote to memory of 2512	2744	cmd.exe	taskkill.exe
PID 2744 wrote to memory of 2512	2744	cmd.exe	taskkill.exe
PID 2744 wrote to memory of 2512	2744	cmd.exe	taskkill.exe
PID 2744 wrote to memory of 2512	2744	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe
"C:\Users\Admin\AppData\Local\Temp\8aeb5943e50f456fa19f2832535643e60fbb9aa55afb588e79b77b3e09ae9cea.exe"
1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3048