socelars | bc6d9c4157defbc1fe360d04e8651b093cef14e2b0f93eb95558411a0c69f53b

Analysis

max time kernel
41s
max time network
154s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
30-12-2024 21:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Size

1.5MB
MD5

2c24f1c8aeaf0ac1553338dc406e5f49
SHA1

4d24a34c18e19975b831d5cb8e842b32402f5ee2
SHA256

c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc
SHA512

98a6f5d5d473e4e9f7ac9ef5d6dd805ad53480ec7a4ef35894e62dddb4f6c1b2c055c4eb79be804e66e33f9acff75fecfaa00e533c05ce8e5e698fee9590df70
SSDEEP

24576:fLvpteBrVtMLwQe1Qog2SoWXaJSwXjrLAmPbHMvVco/vChoV9d:jvpm0MXdh8mPbHMvGo3WoXd

Score

10^/10

socelars discovery spyware stealer

Malware Config

Signatures

Socelars
Socelars is an infostealer targeting browser cookies and credit card credentials.
stealer socelars
Socelars family
socelars
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
9	iplogger.org
10	iplogger.org

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File opened for modification	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
File created	C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2652	taskkill.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2344	chrome.exe
2344	chrome.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeCreateTokenPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeAssignPrimaryTokenPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeLockMemoryPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeIncreaseQuotaPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeMachineAccountPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeTcbPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeSecurityPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeTakeOwnershipPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeLoadDriverPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeSystemProfilePrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeSystemtimePrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeProfSingleProcessPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeIncBasePriorityPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeCreatePagefilePrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeCreatePermanentPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeBackupPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeRestorePrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeShutdownPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeDebugPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeAuditPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeSystemEnvironmentPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeChangeNotifyPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeRemoteShutdownPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeUndockPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeSyncAgentPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeEnableDelegationPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeManageVolumePrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeImpersonatePrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeCreateGlobalPrivilege	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: 31	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: 32	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: 33	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: 34	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: 35	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
Token: SeDebugPrivilege	2652	taskkill.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe
Token: SeShutdownPrivilege	2344	chrome.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe
2344	chrome.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2808	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe	30
PID 2872 wrote to memory of 2808	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe	30
PID 2872 wrote to memory of 2808	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe	30
PID 2872 wrote to memory of 2808	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe	30
PID 2808 wrote to memory of 2652	2808	cmd.exe	33
PID 2808 wrote to memory of 2652	2808	cmd.exe	33
PID 2808 wrote to memory of 2652	2808	cmd.exe	33
PID 2808 wrote to memory of 2652	2808	cmd.exe	33
PID 2872 wrote to memory of 2344	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe	35
PID 2872 wrote to memory of 2344	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe	35
PID 2872 wrote to memory of 2344	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe	35
PID 2872 wrote to memory of 2344	2872	c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe	35
PID 2344 wrote to memory of 1600	2344	chrome.exe	36
PID 2344 wrote to memory of 1600	2344	chrome.exe	36
PID 2344 wrote to memory of 1600	2344	chrome.exe	36
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 1616	2344	chrome.exe	37
PID 2344 wrote to memory of 2032	2344	chrome.exe	38
PID 2344 wrote to memory of 2032	2344	chrome.exe	38
PID 2344 wrote to memory of 2032	2344	chrome.exe	38
PID 2344 wrote to memory of 436	2344	chrome.exe	39
PID 2344 wrote to memory of 436	2344	chrome.exe	39
PID 2344 wrote to memory of 436	2344	chrome.exe	39
PID 2344 wrote to memory of 436	2344	chrome.exe	39
PID 2344 wrote to memory of 436	2344	chrome.exe	39
PID 2344 wrote to memory of 436	2344	chrome.exe	39
PID 2344 wrote to memory of 436	2344	chrome.exe	39

C:\Users\Admin\AppData\Local\Temp\c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe
"C:\Users\Admin\AppData\Local\Temp\c05ebed9e8445ecec6ce2334d6d6543644379ed6584d56e6839fb4a168abe6dc.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c taskkill /f /im chrome.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2808
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im chrome.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2652
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe"
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2344
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef7469758,0x7fef7469768,0x7fef7469778
    3⤵
    PID:1600
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:2
    3⤵
    PID:1616
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1504 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:8
    3⤵
    PID:2032
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1572 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:8
    3⤵
    PID:436
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=2296 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:1
    3⤵
    PID:320
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=2316 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:1
    3⤵
    PID:2384
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --extension-process --display-capture-permissions-policy-allowed --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=2548 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --use-gl=angle --use-angle=swiftshader-webgl --mojo-platform-channel-handle=1560 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:2
    3⤵
    PID:2564
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --mojo-platform-channel-handle=3688 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files\Google\Chrome\Application\chrome.exe
    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1436 --field-trial-handle=1380,i,4214412252470322937,8155391668857725372,131072 /prefetch:8
    3⤵
    PID:1264

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files\aieoplapobidheellikiicjfpamacpfd\background.html

Filesize
786B

MD5
9ffe618d587a0685d80e9f8bb7d89d39

SHA1
8e9cae42c911027aafae56f9b1a16eb8dd7a739c

SHA256
a1064146f622fe68b94cd65a0e8f273b583449fbacfd6fd75fec1eaaf2ec8d6e

SHA512
a4e1f53d1e3bf0ff6893f188a510c6b3da37b99b52ddd560d4c90226cb14de6c9e311ee0a93192b1a26db2d76382eb2350dc30ab9db7cbd9ca0a80a507ea1a12

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\icon.png

Filesize
6KB

MD5
c8d8c174df68910527edabe6b5278f06

SHA1
8ac53b3605fea693b59027b9b471202d150f266f

SHA256
9434dd7008059a60d6d5ced8c8a63ab5cae407e7152da98ca4dda408510f08f5

SHA512
d439e5124399d1901934319535b7156c0ca8d76b5aa4ddf1dd0b598d43582f6d23c16f96be74d3cd5fe764396da55ca51811d08695f356f12f7a8a71bcc7e45c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\aes.js

Filesize
13KB

MD5
4ff108e4584780dce15d610c142c3e62

SHA1
77e4519962e2f6a9fc93342137dbb31c33b76b04

SHA256
fc7e184beeda61bf6427938a84560f52348976bb55e807b224eb53930e97ef6a

SHA512
d6eee0fc02205a3422c16ad120cad8d871563d8fcd4bde924654eac5a37026726328f9a47240cf89ed6c9e93ba5f89c833e84e65eee7db2b4d7d1b4240deaef2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\background.js

Filesize
19KB

MD5
9f88fd035ed1c76686d69baaa41bcec5

SHA1
17476ca2bd3eb0bf23729fcedc489ed3b1a0fafd

SHA256
f14db597f27b94e64400acd592a0ab8552d394fbc407309ad160ef82e44665d1

SHA512
5578754f20d911622925a9da89e03d731f70281c3f460569ec35bb62fd9406d324ffcf6fdf0334b2c5e4ce2fd2fe4efbecfc57f9b6081874f34e30208c503f5c

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\content.js

Filesize
3KB

MD5
368dbd669e86a3e5d6f38cf0025a31fd

SHA1
93c6f457d876646713913f3fa59f44a9a373ff03

SHA256
40d6653a91bd77ecbd6e59151febb0d8b157b66706aab53d4c281bb1f2fe0cd6

SHA512
24881d53e334510748f51ce814c6e41c4de2094fd3acc1f250f8a73e26c64d5a74430b6c891fc03b28fb7bddfcf8b540edcf86498d2bb597e70c2b80b172ee7e

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\jquery-3.3.1.min.js

Filesize
84KB

MD5
a09e13ee94d51c524b7e2a728c7d4039

SHA1
0dc32db4aa9c5f03f3b38c47d883dbd4fed13aae

SHA256
160a426ff2894252cd7cebbdd6d6b7da8fcd319c65b70468f10b6690c45d02ef

SHA512
f8da8f95b6ed33542a88af19028e18ae3d9ce25350a06bfc3fbf433ed2b38fefa5e639cddfdac703fc6caa7f3313d974b92a3168276b3a016ceb28f27db0714a

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\mode-ecb.js

Filesize
604B

MD5
23231681d1c6f85fa32e725d6d63b19b

SHA1
f69315530b49ac743b0e012652a3a5efaed94f17

SHA256
03164b1ac43853fecdbf988ce900016fb174cf65b03e41c0a9a7bf3a95e8c26a

SHA512
36860113871707a08401f29ab2828545932e57a4ae99e727d8ca2a9f85518d3db3a4e5e4d46ac2b6ba09494fa9727c033d77c36c4bdc376ae048541222724bc2

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\js\pad-nopadding.js

Filesize
268B

MD5
0f26002ee3b4b4440e5949a969ea7503

SHA1
31fc518828fe4894e8077ec5686dce7b1ed281d7

SHA256
282308ebc3702c44129438f8299839ca4d392a0a09fdf0737f08ef1e4aff937d

SHA512
4290a1aee5601fcbf1eb2beec9b4924c30cd218e94ae099b87ba72c9a4fa077e39d218fc723b8465d259028a6961cc07c0cd6896aa2f67e83f833ca023a80b11

Download Submit
C:\Program Files\aieoplapobidheellikiicjfpamacpfd\manifest.json

Filesize
1KB

MD5
6da6b303170ccfdca9d9e75abbfb59f3

SHA1
1a8070080f50a303f73eba253ba49c1e6d400df6

SHA256
66f5620e3bfe4692b14f62baad60e3269327327565ff8b2438e98ce8ed021333

SHA512
872957b63e8a0d10791877e5d204022c08c8e8101807d7ebe6fd537d812ad09e14d8555ccf53dc00525a22c02773aa45b8fa643c05247fb0ce6012382855a89a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

Filesize
1KB

MD5
55540a230bdab55187a841cfe1aa1545

SHA1
363e4734f757bdeb89868efe94907774a327695e

SHA256
d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

SHA512
c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

Filesize
230B

MD5
9c7a1816d5492920df12720ca4285a01

SHA1
10bff7bd3a7643086fc3abc827b0f00113aa50f1

SHA256
7d452d17cf02f308737b7e53bc10dd290d28160a584275732e2c03fca5613be2

SHA512
ba615e28abdef4b7ac0f418a11fa247640849392c64060b25df4991ac80a52033cad38067121d1092ec2418485b5b9e8225a1a436e7fdf4f375702c8778a44f2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
de440e292a0cadef5148ee6291c77a22

SHA1
e07534a0cedc5b7869e4f6340c3e304ed9e9f25e

SHA256
a007dfaf5f3a43f0c34d6e773ef389e7b58205fbb5f72ddebc3701da75b004f4

SHA512
c9b122e50e406fa765cf1795f137c18e14dd6cf82c346516f891d220d82476c81aac3acf76c77021b13d0aba2e70cbffc6c7c8da51ba08c07ba1a23f6c080d5c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
15d36b6c3423421a014015acac0c0b6e

SHA1
8150f0055da7f41780ea583dd01e5847769a120b

SHA256
e77a42dc33c2dd7a3d65477bd64d1f392bff25884890c23984c67e183c82549d

SHA512
f80af86f6f3bf6266fe67199b0023cf4b9fb2dbba25f57074d322bab421eb4ecbff4ef6236367081777b5d90960a6ab4e8bea20a43b2148dcb131e09d99f66dd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
a3662bf257e51d262c87a0ca54ec331d

SHA1
2c514a2539ea92099e6d73956c7d3477c829f1f2

SHA256
d1cd15b7be737bfa47c97d195eefea14c50d884977ae3d2103df6c1ce5d8011e

SHA512
1d4366472e109188d11ce6aa2a71e5c1f41e265f407768ac4dd751e72fa554d375cc295c72c68b12f16e4e36331d48d61a07ddb0ced2dbb0a0a2216285ba1981

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
b609a14cc63ed5001c5660b515689557

SHA1
6152bed1ed9abdfe08c0bb9b49561fe5c463cd46

SHA256
c80fd058eda3f610e71e44dad30550ff27ba1fee29832c18ae490cb6864eec46

SHA512
9adb7379b8e12da86065a74f99383e1343e0ce7458ce64655d901fe1dfe6a371284f21ba84786a079f792631a604f8871c46cc3fd23c799ce3bba9c0aeb9fdbe

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5692ae1778b577c349da1bb59af87654

SHA1
a664c879730bd51133ed4e007cde7b5e11ae635d

SHA256
cc8c0ced4d5c431ceb94af152a900256cf40779aac5ad772c6f0bdb083b3dc3d

SHA512
935e1969e5bc8f717d842615f07a8dd0091b2e30cf204fe1be2ee1a78efbf7f25a9bb09a11701d190acd52f9b32cb3632c6b3ca3ec998f552ed55383bcc05d41

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
2449ae4d616b1a834364f1d3ec6b15a2

SHA1
81dea638b5ed50c6c91bc6ff8fb6ceb248135288

SHA256
33f4d8ce2db1921148e77ce103039892bb38cd7b4c5772388dead4b1c9e740dc

SHA512
e758f8781dd050686a6b2a5b799059b0c54a11bde0d409b885b7175d8eea266121bd5e9c47175b82ac2967b76a080bd8eb2bcb548935509820fbf169faaf7f1c

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
850B

MD5
5a02795a58656f102d56f7be134f7bca

SHA1
69b0a79d0da21914577677e6384f0927c2f40129

SHA256
90df4bfc7745b1dbdbf02950dfe05c0f54e159c1ab19ce54bf94526bd5a2459f

SHA512
cb0c2e982901151663548eff481f2e596b9e3e10a5537d1f193db63e5b76f7ad3b258afe4624fee9907abef95e9c87bf23f1bf9f1a53d8fcb83d03d20928fee4

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
5b34cb5922a4083a688a65f65c5bf982

SHA1
d81bed7554422b6c439a73ac4331aec96d0c8a68

SHA256
00b00170c93c382ec3d729b4937cfacc1d7d900b91c11ddfc6cb68381373f927

SHA512
f7762419f4c2c2157757fb295a6acb861975d37592b096199ec7f3c937a99e5f1f45a9fea89e70e2574c3a98c878f36f2aa244569ea2f62640e3352a9e2e8561

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
854B

MD5
34df669f628cb5c6ff9e6f6dee4c7e3d

SHA1
7aa8c5dd2b57419d37522121721697db0ee6018f

SHA256
d3a3155227c67e8d49635627fdf197a30947a9005a7dfe715bc9ccdadaaaeaf2

SHA512
54e5bdc7ba93f62ade275258f867f1bd87e5e3337bbabd108cd4f958169bacfe77bf58517a5b62a545a5dd5c7c6fc467f753b521f421da14def413c4a2094e70

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
5f062be375c280dac341983f70beaeb7

SHA1
b1e94be0ca7118f9937e21a43b0da4d4199e30fd

SHA256
64d859e6d16f4a8793533e4f24cbdcfcaa77eda56aeb078fcce583aa4a070b13

SHA512
cbbac209a2cf3151236e66e0815033018003e8f7fd1683df46c85f10c5d54a6e08dfd06793d82899a477ab7b028f6fac1466faeda7e518055ca0cd857058d7f8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
4KB

MD5
c08d53d553a4ce0a1209a667c9c92ffb

SHA1
586e0cf5181ebd7834d61e97afc47808e7d4c062

SHA256
32cd7e4b9ca05e25f7e20b96d9de38a856f5e62ee63b3cc17c33f27619db03c6

SHA512
5aa401b7464a63c13b651d04942928c06034a0f4e96b48297588143076f0ab18e57b7b64b6279f7b0abc9f2099b3df634f8da9d30447ac2cbcfb3cb16c395890

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

Filesize
11KB

MD5
7509662fbac37ca065e02f8827ce91c4

SHA1
3d68c0f55ea0005ade5091428a2533c9f2c1a2eb

SHA256
1a1884204b80a4f2201ac19eefe4da689c3a4a30ce5eb20d7b2f535724aad2c8

SHA512
d30c318e321a2de645e75d9ff20c52b1bc1aec5785d1c68ac69b09900bb3fa1dedf1e4bed1a4a16e5dde0f14d95785fa6a2aa6432f6c60b66f8733aa0f5de5b8

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000007.dbtmp

Filesize
16B

MD5
18e723571b00fb1694a3bad6c78e4054

SHA1
afcc0ef32d46fe59e0483f9a3c891d3034d12f32

SHA256
8af72f43857550b01eab1019335772b367a17a9884a7a759fdf4fe6f272b90aa

SHA512
43bb0af7d3984012d2d67ca6b71f0201e5b948e6fe26a899641c4c6f066c59906d468ddf7f1df5ea5fa33c2bc5ea8219c0f2c82e0a5c365ad7581b898a8859e2

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Sync Extension Settings\aieoplapobidheellikiicjfpamacpfd\CURRENT~RFf7766de.TMP

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab6529.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar6C7C.tmp

Filesize
181KB

MD5
4ea6026cf93ec6338144661bf1202cd1

SHA1
a1dec9044f750ad887935a01430bf49322fbdcb7

SHA256
8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8

SHA512
6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

Download Submit