socelars | ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841

General

Target

f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe
Size

1.9MB
MD5

f0faa31e557acb4d73a8351ee80b6a3e
SHA1

ba4f77d0b7803df4fca1d9b797dbc09b18c6501c
SHA256

ef0d1682a04ee6f23153e295a9e66070464ffe903b8a7a8e393d55d12313e841
SHA512

afa4c1aaa236d61f5567decd1333c4b120e0b3265f2ce42d22197e30aa6ee11468e68ab6b0e2178809c4331850fa6ee0571ea86bb1315e8e3c92abc8dbc882fc
SSDEEP

49152:QcW4fJpuypG3kv/NOgEg9Yj9d+AGx5yskwU:QX4xpuyI3E/Wd+leskwU

Score

10^/10

socelars discovery stealer upx

Malware Config

Extracted

Family

socelars

C2

http://www.createinfo.pw/

http://www.allinfo.pw/

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exe	upx
behavioral1/memory/2796-22-0x0000000000400000-0x0000000000541000-memory.dmp	upx
behavioral1/memory/2796-34-0x0000000000400000-0x0000000000541000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Executes dropped EXE 2 IoCs

Processes:

f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmpDiskScan.exe

pid process

2136 f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
2796 DiskScan.exe

pid	process
2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
2796	DiskScan.exe

Loads dropped DLL 9 IoCs

Processes:

f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exef0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmpWerFault.exe

pid	process
1992	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe
2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe
2852	WerFault.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

2852 2796 WerFault.exe DiskScan.exe

pid	pid_target	process	target process
2852	2796	WerFault.exe	DiskScan.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exef0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmpDiskScan.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DiskScan.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp

pid process

2136 f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
2136 f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp

pid process

2136 f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp

pid	process
2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp

pid	process
2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exef0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmpDiskScan.exe

description	pid	process	target process
PID 1992 wrote to memory of 2136	1992	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
PID 1992 wrote to memory of 2136	1992	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
PID 1992 wrote to memory of 2136	1992	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
PID 1992 wrote to memory of 2136	1992	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
PID 1992 wrote to memory of 2136	1992	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
PID 1992 wrote to memory of 2136	1992	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
PID 1992 wrote to memory of 2136	1992	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
PID 2136 wrote to memory of 2796	2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp	DiskScan.exe
PID 2136 wrote to memory of 2796	2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp	DiskScan.exe
PID 2136 wrote to memory of 2796	2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp	DiskScan.exe
PID 2136 wrote to memory of 2796	2136	f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp	DiskScan.exe
PID 2796 wrote to memory of 2852	2796	DiskScan.exe	WerFault.exe
PID 2796 wrote to memory of 2852	2796	DiskScan.exe	WerFault.exe
PID 2796 wrote to memory of 2852	2796	DiskScan.exe	WerFault.exe
PID 2796 wrote to memory of 2852	2796	DiskScan.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Users\Admin\AppData\Local\Temp\is-QC0G4.tmp\f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-QC0G4.tmp\f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp" /SL5="$5014E,1302756,816640,C:\Users\Admin\AppData\Local\Temp\f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exe
    "C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2796 -s 668
      4⤵
      Loads dropped DLL
      Program crash
      PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\pdfreader2010\DiskScan.exe

Filesize
569KB

MD5
55307d9adfbcc76551eb24aa2f650dd4

SHA1
86bbbaa938d4a1f0077d30b661c0cfac40a079ff

SHA256
a65dcf1408ac9eab201fabf115df1dbe1516a713552e9ef58e0cacef7e05a97e

SHA512
35463548786681d53813b4b869e62a900f92e2f129afa8011a2260baaf5a76c6d27d2390d8a9be4fdea8d5d80ff3aafaafc87694c8751a8a551081768f939b57

Download Submit
\Users\Admin\AppData\Local\Temp\is-QC0G4.tmp\f0faa31e557acb4d73a8351ee80b6a3e_JaffaCakes118.tmp

Filesize
2.5MB

MD5
066108c4b0102357ebdaf3791ba38fe8

SHA1
59e9e8043232169c0554e350c233433b0bc4c83c

SHA256
a720dd6efcd1910ea490c0095ff0efa36eb5228712e61294eeb4b3072715c035

SHA512
a2bb074f042d7214536083dfe341da9dafe1d170cf52e9c0f4ff0041f959d4a28cc6be9cb0e5ec3adf63188d658332b7440d6b5ac8e02af2801e7f34a04acad2

Download Submit
memory/1992-2-0x0000000000401000-0x00000000004A9000-memory.dmp

Filesize
672KB

Download
memory/1992-0-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/1992-25-0x0000000000400000-0x00000000004D5000-memory.dmp

Filesize
852KB

Download
memory/2136-9-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/2136-20-0x0000000004170000-0x00000000042B1000-memory.dmp

Filesize
1.3MB

Download
memory/2136-24-0x0000000000400000-0x0000000000690000-memory.dmp

Filesize
2.6MB

Download
memory/2796-22-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download
memory/2796-34-0x0000000000400000-0x0000000000541000-memory.dmp

Filesize
1.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads