socelars | 9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65

General

Target

9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Size

1.4MB
MD5

0774cae2c8987d305170460113f90085
SHA1

075f70a3e17c4d8c2819bdb1f87a486ab86d0413
SHA256

9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65
SHA512

a6c68c0ce269c8772dd4fc36b29adaa1407b114d60aadbeaad4fa5ca85a3b47f43c9ea9b460683015c533f96eca4c1700562c6de8666b10ef05010521a2b8ee3
SSDEEP

24576:H9z7hp10GnN4BhDEYsN4OikFDEQ/lbCFjWlqIgV0edASvoxygyjTYofy:97hpVNwh/s6OjFpF2jlJNdASvFgyjE5

Score

10^/10

socelars discovery spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2792 taskkill.exe

pid	process
2792	taskkill.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Key created	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2084844033-2744876406-2053742436-1000\Software\Microsoft\SystemCertificates\CA\Certificates\151682F5218C0A511C28F4060A73B9CA78CE9A53\Blob = 030000000100000014000000151682f5218c0a511c28f4060a73b9ca78ce9a531400000001000000140000007c4296aede4b483bfa92f89e8ccf6d8ba972379504000000010000001000000029f1c1b26d92e893b6e6852ab708cce10f00000001000000200000005aef843ffcf2ec7055f504a162f229f8391c370ff3a6163d2db3f3d604d622be19000000010000001000000070d4f0bec2078234214bd651643b02401800000001000000100000002fe1f70bb05d7c92335bc5e05b984da62000000001000000640400003082046030820248a0030201020210079e492886376fd40848c23fc631e463300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3230303930343030303030305a170d3235303931353136303030305a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f742058323076301006072a8648ce3d020106052b8104002203620004cd9bd59f80830aec094af3164a3e5ccf77acde67050d1d07b6dc16fb5a8b14dbe27160c4ba459511898eea06dff72a161ca4b9c5c532e003e01e8218388bd745d80a6a6ee60077fb02517d22d80a6e9a5b77dff0fa41ec39dc75ca68070c1feaa381e53081e2300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e041604147c4296aede4b483bfa92f89e8ccf6d8ba9723795301f0603551d2304183016801479b459e67bb6e5e40173800888c81a58f6e99b6e303206082b0601050507010104263024302206082b060105050730028616687474703a2f2f78312e692e6c656e63722e6f72672f30270603551d1f0420301e301ca01aa0188616687474703a2f2f78312e632e6c656e63722e6f72672f30220603551d20041b30193008060667810c010201300d060b2b0601040182df13010101300d06092a864886f70d01010b050003820201001b7f252b907a0876007718e1c32e8a364c417ebf174be330d75b0c7e9c96986f7bb068c02444cce2f2fcd1eadbd29f01f9174d0c9d55fda5ad6dd22f3f4b72c02eae73c7251657c23e15ade031d10a84846c6278423122461aed7a40bf9716814477ca6c7b5d215c07f2119121bfe12fc2ef6efd0520e4b4f779f32dbb372af0c6b1acac51f51fb35a1e66ce580718387f71a93c83bad7bc829e9a760f9eb029fdcbf38907481bfeab932e14210d5faf8eb754ab5d0ed45b4c71d092ea3da3369b7c1fe03b55b9d85353cc8366bb4adc810600188bf4b3d748b11341b9c4b69ecf2c778e42200b807e9fc5ab48dbbc6f048d6c4629020d708a1df11273b64624429e2a1718e3acc798c272cc6d2d766ddd2c2b2696a5cf21081be5da2fcbef9f7393aef8365f478f9728ceabe29826988bfdee28322229ed4c9509c420fa07e1862c44f68147c0e46232ed1dd83c488896c35e91b6af7b59a4eee3869cc78858ca282a66559b8580b91dd8402bc91c133ca9ebde99c21640f6f5a4ae2a256c52bac7044cb432bbfc385ca00c617b57ec774e50cfaf06a20f378ce10ed2d32f1abd9c713ecce1f8d1a8a3bd04f619c0f986aff50e1aaa956befca47714b631c4d96db55230a9d0f8175a0e640f56446036ecefa6a7d06eca4340674da53d8b9b8c6237da9f82a2da482a62e2d11cae6cd31587985e6721ca79fd34cd066d0a7bb	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exetaskkill.exe

description	pid	process
Token: SeCreateTokenPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeAssignPrimaryTokenPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeLockMemoryPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeIncreaseQuotaPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeMachineAccountPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeTcbPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeSecurityPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeTakeOwnershipPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeLoadDriverPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeSystemProfilePrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeSystemtimePrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeProfSingleProcessPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeIncBasePriorityPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeCreatePagefilePrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeCreatePermanentPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeBackupPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeRestorePrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeShutdownPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeDebugPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeAuditPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeSystemEnvironmentPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeChangeNotifyPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeRemoteShutdownPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeUndockPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeSyncAgentPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeEnableDelegationPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeManageVolumePrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeImpersonatePrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeCreateGlobalPrivilege	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: 31	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: 32	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: 33	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: 34	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: 35	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
Token: SeDebugPrivilege	2792	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.execmd.exe

description	pid	process	target process
PID 1684 wrote to memory of 2040	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe	cmd.exe
PID 1684 wrote to memory of 2040	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe	cmd.exe
PID 1684 wrote to memory of 2040	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe	cmd.exe
PID 1684 wrote to memory of 2040	1684	9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe	cmd.exe
PID 2040 wrote to memory of 2792	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 2792	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 2792	2040	cmd.exe	taskkill.exe
PID 2040 wrote to memory of 2792	2040	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe
"C:\Users\Admin\AppData\Local\Temp\9ff666098ebbd5b46610c0830ccda32b132601e7a16db6d4e48ca5034e22ec65.exe"
1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1684