Overview
overview
10Static
static
106c5db6dce1...3e.exe
windows7-x64
106c5db6dce1...3e.exe
windows10-2004-x64
10DusBrowserInst.exe
windows7-x64
6DusBrowserInst.exe
windows10-2004-x64
6IDWCH2.exe
windows7-x64
7IDWCH2.exe
windows10-2004-x64
7Litever01.exe
windows7-x64
10Litever01.exe
windows10-2004-x64
10NAN.exe
windows7-x64
10NAN.exe
windows10-2004-x64
10anyname.exe
windows7-x64
3anyname.exe
windows10-2004-x64
3app.exe
windows7-x64
10app.exe
windows10-2004-x64
10askinstall50.exe
windows7-x64
10askinstall50.exe
windows10-2004-x64
10farlab_setup.exe
windows7-x64
10farlab_setup.exe
windows10-2004-x64
7inst002.exe
windows7-x64
10inst002.exe
windows10-2004-x64
10jamesnew.exe
windows7-x64
3jamesnew.exe
windows10-2004-x64
3justdezine.exe
windows7-x64
10justdezine.exe
windows10-2004-x64
10md3_3kvm.exe
windows7-x64
10md3_3kvm.exe
windows10-2004-x64
10mixseven.exe
windows7-x64
10mixseven.exe
windows10-2004-x64
10redcloud.exe
windows7-x64
10redcloud.exe
windows10-2004-x64
10udptest.exe
windows7-x64
10udptest.exe
windows10-2004-x64
10Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
08-11-2024 09:08
Behavioral task
behavioral1
Sample
6c5db6dce13ded4e0e6c7e9a526b063e.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
6c5db6dce13ded4e0e6c7e9a526b063e.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
DusBrowserInst.exe
Resource
win7-20241010-en
Behavioral task
behavioral4
Sample
DusBrowserInst.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
IDWCH2.exe
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
IDWCH2.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
Litever01.exe
Resource
win7-20240903-en
Behavioral task
behavioral8
Sample
Litever01.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
NAN.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
NAN.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
anyname.exe
Resource
win7-20240729-en
Behavioral task
behavioral12
Sample
anyname.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
app.exe
Resource
win7-20240903-en
Behavioral task
behavioral14
Sample
app.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
askinstall50.exe
Resource
win7-20241010-en
Behavioral task
behavioral16
Sample
askinstall50.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
farlab_setup.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
farlab_setup.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
inst002.exe
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
inst002.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
jamesnew.exe
Resource
win7-20241023-en
Behavioral task
behavioral22
Sample
jamesnew.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
justdezine.exe
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
justdezine.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
md3_3kvm.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
md3_3kvm.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
mixseven.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
mixseven.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
redcloud.exe
Resource
win7-20241010-en
Behavioral task
behavioral30
Sample
redcloud.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
udptest.exe
Resource
win7-20240729-en
General
-
Target
askinstall50.exe
-
Size
1.4MB
-
MD5
68bc0c244bb2d261a9a7d007bb6e06d7
-
SHA1
4226d51ebf9d925de953e0a5a6b3784eabfc47b6
-
SHA256
fd53ca7be25f932d930f68ab7818359762dde5d3608271e7a27e815f5b30e9e4
-
SHA512
f52a04cd2a5d0f9f30be1b6827e95f5afe5f34d0453a78b000dd71d7d8e20467ef6f541a91858833704df6b1560cb5701eab08e5df0a86870b946b052cd6d9da
-
SSDEEP
24576:8IVFA1pqtg/TnMbX0lwyh0FVmEByA1EwFYyOsFTceoCSPZVjQtYfeXPPSTy:NFA1pvTMbOwa0TmUyMYEh1oCSPnQtY2/
Malware Config
Signatures
-
Socelars family
-
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up geolocation information via web service
Uses a legitimate geolocation service to find the infected system's geolocation info.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
askinstall50.execmd.exetaskkill.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language askinstall50.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 2932 taskkill.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
askinstall50.exetaskkill.exedescription pid process Token: SeCreateTokenPrivilege 2904 askinstall50.exe Token: SeAssignPrimaryTokenPrivilege 2904 askinstall50.exe Token: SeLockMemoryPrivilege 2904 askinstall50.exe Token: SeIncreaseQuotaPrivilege 2904 askinstall50.exe Token: SeMachineAccountPrivilege 2904 askinstall50.exe Token: SeTcbPrivilege 2904 askinstall50.exe Token: SeSecurityPrivilege 2904 askinstall50.exe Token: SeTakeOwnershipPrivilege 2904 askinstall50.exe Token: SeLoadDriverPrivilege 2904 askinstall50.exe Token: SeSystemProfilePrivilege 2904 askinstall50.exe Token: SeSystemtimePrivilege 2904 askinstall50.exe Token: SeProfSingleProcessPrivilege 2904 askinstall50.exe Token: SeIncBasePriorityPrivilege 2904 askinstall50.exe Token: SeCreatePagefilePrivilege 2904 askinstall50.exe Token: SeCreatePermanentPrivilege 2904 askinstall50.exe Token: SeBackupPrivilege 2904 askinstall50.exe Token: SeRestorePrivilege 2904 askinstall50.exe Token: SeShutdownPrivilege 2904 askinstall50.exe Token: SeDebugPrivilege 2904 askinstall50.exe Token: SeAuditPrivilege 2904 askinstall50.exe Token: SeSystemEnvironmentPrivilege 2904 askinstall50.exe Token: SeChangeNotifyPrivilege 2904 askinstall50.exe Token: SeRemoteShutdownPrivilege 2904 askinstall50.exe Token: SeUndockPrivilege 2904 askinstall50.exe Token: SeSyncAgentPrivilege 2904 askinstall50.exe Token: SeEnableDelegationPrivilege 2904 askinstall50.exe Token: SeManageVolumePrivilege 2904 askinstall50.exe Token: SeImpersonatePrivilege 2904 askinstall50.exe Token: SeCreateGlobalPrivilege 2904 askinstall50.exe Token: 31 2904 askinstall50.exe Token: 32 2904 askinstall50.exe Token: 33 2904 askinstall50.exe Token: 34 2904 askinstall50.exe Token: 35 2904 askinstall50.exe Token: SeDebugPrivilege 2932 taskkill.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
askinstall50.execmd.exedescription pid process target process PID 2904 wrote to memory of 2700 2904 askinstall50.exe cmd.exe PID 2904 wrote to memory of 2700 2904 askinstall50.exe cmd.exe PID 2904 wrote to memory of 2700 2904 askinstall50.exe cmd.exe PID 2904 wrote to memory of 2700 2904 askinstall50.exe cmd.exe PID 2700 wrote to memory of 2932 2700 cmd.exe taskkill.exe PID 2700 wrote to memory of 2932 2700 cmd.exe taskkill.exe PID 2700 wrote to memory of 2932 2700 cmd.exe taskkill.exe PID 2700 wrote to memory of 2932 2700 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\askinstall50.exe"C:\Users\Admin\AppData\Local\Temp\askinstall50.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\cmd.execmd.exe /c taskkill /f /im chrome.exe2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im chrome.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2932