Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
25-07-2024 06:23
Behavioral task
behavioral1
Sample
ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe
Resource
win7-20240705-en
windows7-x64
14 signatures
150 seconds
General
-
Target
ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe
-
Size
1.7MB
-
MD5
7bb46178f57f6ea01347b1790d7bfa27
-
SHA1
bad79fb2e79f12feabd5249636537842e45b9bef
-
SHA256
ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467
-
SHA512
86ea26f7f142020e1738de929b6de90400cfa7a1e7b8f69aa62c46b98c220e8f9966eb319bae04fef5c23cea21935d4f10c944e16e4bce4e2e47e5d7c30d9da5
-
SSDEEP
24576:DKAgpBGV2HpWHuREjDnI2AuADZ8KvqC75H2dtDPc/ExKFY/fwg:vgpG57R8InDPcsxKC/fwg
Malware Config
Extracted
Family
socelars
C2
https://sa-us-bucket.s3.us-east-2.amazonaws.com/jhvre24/
Signatures
-
Socelars payload 2 IoCs
resource yara_rule behavioral1/memory/1856-1-0x00000000000F0000-0x00000000002B3000-memory.dmp family_socelars behavioral1/memory/1856-54-0x00000000000F0000-0x00000000002B3000-memory.dmp family_socelars -
Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
-
resource yara_rule behavioral1/files/0x0007000000012119-4.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2080 MDSxhU.exe -
Loads dropped DLL 2 IoCs
pid Process 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 16 iplogger.org 17 iplogger.org -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe MDSxhU.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE MDSxhU.exe File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe MDSxhU.exe File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe MDSxhU.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\servertool.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WORDICON.EXE MDSxhU.exe File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE MDSxhU.exe File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe MDSxhU.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe MDSxhU.exe File opened for modification C:\Program Files\Windows Mail\wab.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\keytool.exe MDSxhU.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe MDSxhU.exe File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Google\Update\Install\{16435541-C196-4D4E-9379-340CA3D46D1B}\chrome_installer.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE MDSxhU.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Installer\chrmstp.exe MDSxhU.exe File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe MDSxhU.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\pack200.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jre7\bin\java.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroBroker.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateOnDemand.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe MDSxhU.exe File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe MDSxhU.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE MDSxhU.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe MDSxhU.exe File opened for modification C:\Program Files\Java\jre7\bin\policytool.exe MDSxhU.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MDSxhU.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Kills process with taskkill 1 IoCs
pid Process 1844 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeCreateTokenPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeAssignPrimaryTokenPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeLockMemoryPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeIncreaseQuotaPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeMachineAccountPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeTcbPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeSecurityPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeTakeOwnershipPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeLoadDriverPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeSystemProfilePrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeSystemtimePrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeProfSingleProcessPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeIncBasePriorityPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeCreatePagefilePrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeCreatePermanentPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeBackupPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeRestorePrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeShutdownPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeDebugPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeAuditPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeSystemEnvironmentPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeChangeNotifyPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeRemoteShutdownPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeUndockPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeSyncAgentPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeEnableDelegationPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeManageVolumePrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeImpersonatePrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeCreateGlobalPrivilege 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: 31 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: 32 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: 33 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: 34 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: 35 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe Token: SeDebugPrivilege 1844 taskkill.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1856 wrote to memory of 2080 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 30 PID 1856 wrote to memory of 2080 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 30 PID 1856 wrote to memory of 2080 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 30 PID 1856 wrote to memory of 2080 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 30 PID 1856 wrote to memory of 2660 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 34 PID 1856 wrote to memory of 2660 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 34 PID 1856 wrote to memory of 2660 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 34 PID 1856 wrote to memory of 2660 1856 ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe 34 PID 2660 wrote to memory of 1844 2660 cmd.exe 36 PID 2660 wrote to memory of 1844 2660 cmd.exe 36 PID 2660 wrote to memory of 1844 2660 cmd.exe 36 PID 2660 wrote to memory of 1844 2660 cmd.exe 36 PID 2080 wrote to memory of 580 2080 MDSxhU.exe 38 PID 2080 wrote to memory of 580 2080 MDSxhU.exe 38 PID 2080 wrote to memory of 580 2080 MDSxhU.exe 38 PID 2080 wrote to memory of 580 2080 MDSxhU.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe"C:\Users\Admin\AppData\Local\Temp\ded8995ef3dc7ea298fa16e1733b033e06261a76e1639430d4808600884c7467.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\MDSxhU.exeC:\Users\Admin\AppData\Local\Temp\MDSxhU.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\0b941256.bat" "3⤵
- System Location Discovery: System Language Discovery
PID:580
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1844
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\WK27LCMU\k2[1].rar
Filesize4B
MD5d3b07384d113edec49eaa6238ad5ff00
SHA1f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA5120cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6
-
Filesize
187B
MD548de9d6db8e1b3de212a679f26b08212
SHA1c2586545b1d8d710a5eb3f24525aa51d2ad5f9f6
SHA256e1ee59737bbc412f9bcd54d02d035ed68121b03de214a5d565e52c6559dae8f6
SHA5128f6fe7f23106a754cadf5ccd9d2a06f838dcb746c6808ecadccaee29eca67d5c6ef24882c9227f2139b6d3209f170e33d09c028b7cd5bdd3e98c5757e4e665a5
-
Filesize
15KB
MD5f7d21de5c4e81341eccd280c11ddcc9a
SHA1d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA2564485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3