Analysis
-
max time kernel
63s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 05:22
Static task
static1
Behavioral task
behavioral1
Sample
socks.exe
Resource
win7-20220715-en
windows7-x64
3 signatures
150 seconds
General
-
Target
socks.exe
-
Size
283KB
-
MD5
373949447dfd88ce94f0d04cba6ea505
-
SHA1
b30b0268fa57ca3117957f99fa7372b244153306
-
SHA256
4246b1740af95e953c8010a6d99c0ab72622b892bc1dbb955eec4067d90d7763
-
SHA512
dfcdbf640ac89ae4c9efba10fe8260a4fa8354d1fd6d62f6625d0bec192dd21bb238d770d00c35a2b62d46d84f8445ffb415dd48a93023d70bac453bc50c8c88
Malware Config
Extracted
Family
systembc
C2
185.215.113.105:4001
Signatures
-
Drops file in Windows directory 2 IoCs
Processes:
socks.exedescription ioc process File created C:\Windows\Tasks\wow64.job socks.exe File opened for modification C:\Windows\Tasks\wow64.job socks.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
taskeng.exedescription pid process target process PID 1108 wrote to memory of 1020 1108 taskeng.exe socks.exe PID 1108 wrote to memory of 1020 1108 taskeng.exe socks.exe PID 1108 wrote to memory of 1020 1108 taskeng.exe socks.exe PID 1108 wrote to memory of 1020 1108 taskeng.exe socks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\socks.exe"C:\Users\Admin\AppData\Local\Temp\socks.exe"1⤵
- Drops file in Windows directory
-
C:\Windows\system32\taskeng.exetaskeng.exe {9828EBEC-50DD-49B9-82DD-4570368E8359} S-1-5-18:NT AUTHORITY\System:Service:1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\socks.exeC:\Users\Admin\AppData\Local\Temp\socks.exe start2⤵
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/856-54-0x0000000075321000-0x0000000075323000-memory.dmpFilesize
8KB
-
memory/856-56-0x0000000000230000-0x0000000000235000-memory.dmpFilesize
20KB
-
memory/856-55-0x0000000000C3B000-0x0000000000C4C000-memory.dmpFilesize
68KB
-
memory/856-57-0x0000000000400000-0x0000000000B3A000-memory.dmpFilesize
7.2MB
-
memory/1020-58-0x0000000000000000-mapping.dmp
-
memory/1020-60-0x0000000000CFB000-0x0000000000D0C000-memory.dmpFilesize
68KB
-
memory/1020-61-0x0000000000400000-0x0000000000B3A000-memory.dmpFilesize
7.2MB
-
memory/1020-62-0x0000000000CFB000-0x0000000000D0C000-memory.dmpFilesize
68KB