socelars | 7210c506a970ba7a56858c9e3b9d2c82e190f687bb16d33b2a483429efda8efe

General

Target

7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Size

1.4MB
MD5

7fc8487d2620dee659c08371a5fe08e2
SHA1

634f46833870f18504cadbe6d5c0c2ed50c1e2f2
SHA256

7210c506a970ba7a56858c9e3b9d2c82e190f687bb16d33b2a483429efda8efe
SHA512

7875328ae80d28badcff802c0e1718fff1f7c80ac2a3bd36220f1a2d9e6312f43d4c791aafbd7cd7582be394d52c182d657d2a1d021f7f683a3c02b5acd56cd7
SSDEEP

24576:4IVFA1pqtg/TnMbX0lwyh0FVmEByA1swFYyOsdwsuQOSIt21QxYf+6DP:JFA1pvTMbOwa0TmUqMYEOFQOSIsQxYGm

Score

10^/10

socelars discovery spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Socelars family
socelars
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

8 iplogger.org
7 iplogger.org
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
8	iplogger.org
7	iplogger.org

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.execmd.exetaskkill.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Kills process with taskkill 1 IoCs
evasion

Processes:

taskkill.exe

pid process

2956 taskkill.exe

pid	process
2956	taskkill.exe

Suspicious use of AdjustPrivilegeToken 35 IoCs

Processes:

7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exetaskkill.exe

description	pid	process
Token: SeCreateTokenPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeAssignPrimaryTokenPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeLockMemoryPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeIncreaseQuotaPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeMachineAccountPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeTcbPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeSecurityPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeTakeOwnershipPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeLoadDriverPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeSystemProfilePrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeSystemtimePrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeProfSingleProcessPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeIncBasePriorityPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeCreatePagefilePrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeCreatePermanentPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeBackupPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeRestorePrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeShutdownPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeDebugPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeAuditPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeSystemEnvironmentPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeChangeNotifyPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeRemoteShutdownPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeUndockPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeSyncAgentPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeEnableDelegationPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeManageVolumePrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeImpersonatePrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeCreateGlobalPrivilege	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: 31	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: 32	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: 33	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: 34	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: 35	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
Token: SeDebugPrivilege	2956	taskkill.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.execmd.exe

description	pid	process	target process
PID 1980 wrote to memory of 2928	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe	cmd.exe
PID 1980 wrote to memory of 2928	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe	cmd.exe
PID 1980 wrote to memory of 2928	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe	cmd.exe
PID 1980 wrote to memory of 2928	1980	7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe	cmd.exe
PID 2928 wrote to memory of 2956	2928	cmd.exe	taskkill.exe
PID 2928 wrote to memory of 2956	2928	cmd.exe	taskkill.exe
PID 2928 wrote to memory of 2956	2928	cmd.exe	taskkill.exe
PID 2928 wrote to memory of 2956	2928	cmd.exe	taskkill.exe

C:\Users\Admin\AppData\Local\Temp\7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\7fc8487d2620dee659c08371a5fe08e2_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2928
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2956