Analysis
-
max time kernel
122s -
max time network
127s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
-
submitted
11-10-2024 14:05
General
-
Target
2024-10-11_30cad29a59ac340db201eeeff45ebdd5_avoslocker.exe
-
Size
1.4MB
-
MD5
30cad29a59ac340db201eeeff45ebdd5
-
SHA1
618e11093f8445ae1ac096d9fe68f0e7afb1431d
-
SHA256
9daf6dd041934892100ae2edf69e27db7b2baa0ba22ce101e7c6fdfe179de5c3
-
SHA512
33ea1643df24bffbde854aad4f3b261e9565420e7c0f9eed49460740e927ebf859d16ba077e26fea531599191d1396a3b9d834b1272eccc5b86b1e62406dd54c
-
SSDEEP
24576:NxpXPaR2J33o3S7P5zuHHOF26ufehMHsGKzOYffEMSXkduZ1H1:3py+VDr8rCHSXuuZV1
Malware Config
Signatures
-
Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Kills process with taskkill 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 35 IoCs
-
Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-10-11_30cad29a59ac340db201eeeff45ebdd5_avoslocker.exe"C:\Users\Admin\AppData\Local\Temp\2024-10-11_30cad29a59ac340db201eeeff45ebdd5_avoslocker.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-