Analysis
-
max time kernel
186s -
max time network
254s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-09-2022 00:26
Static task
static1
Behavioral task
behavioral1
Sample
socksupd.exe
Resource
win7-20220901-en
General
-
Target
socksupd.exe
-
Size
197KB
-
MD5
57eb1430903457db36a36023304f8a38
-
SHA1
831f481eebdf994a1cfacca5a9f53e1f6f93e0fd
-
SHA256
1962f91125c15839d9e18b7273f1831cae8a191c574577210dda1a424e9e7628
-
SHA512
a33af94ab2083e6beb5631ce4ff8c5340b4bf10e7a15727aef6817ec4dfd7c6771f90abc8bca397319d571cc8c165c7182528bab2e962f168530b7a496da683e
-
SSDEEP
3072:L6oyUN8LiJ4Ut3Fec85snm3HlR0zMgilHB9tEOzOGI8pJ/CB9XB/PkF4x:LXoLilt3FeKm1RgMrlHB92O+8pu
Malware Config
Extracted
systembc
109.107.187.226:4001
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
xeqx.exexeqx.exepid process 668 xeqx.exe 1148 xeqx.exe -
Drops file in Windows directory 2 IoCs
Processes:
socksupd.exedescription ioc process File created C:\Windows\Tasks\xeqx.job socksupd.exe File opened for modification C:\Windows\Tasks\xeqx.job socksupd.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
socksupd.exepid process 1900 socksupd.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
taskeng.exedescription pid process target process PID 944 wrote to memory of 668 944 taskeng.exe xeqx.exe PID 944 wrote to memory of 668 944 taskeng.exe xeqx.exe PID 944 wrote to memory of 668 944 taskeng.exe xeqx.exe PID 944 wrote to memory of 668 944 taskeng.exe xeqx.exe PID 944 wrote to memory of 1148 944 taskeng.exe xeqx.exe PID 944 wrote to memory of 1148 944 taskeng.exe xeqx.exe PID 944 wrote to memory of 1148 944 taskeng.exe xeqx.exe PID 944 wrote to memory of 1148 944 taskeng.exe xeqx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\socksupd.exe"C:\Users\Admin\AppData\Local\Temp\socksupd.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\taskeng.exetaskeng.exe {6BA5B8A4-ED58-4357-BB17-308408FF3003} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\wefnw\xeqx.exeC:\ProgramData\wefnw\xeqx.exe start22⤵
- Executes dropped EXE
-
C:\ProgramData\wefnw\xeqx.exeC:\ProgramData\wefnw\xeqx.exe start22⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\wefnw\xeqx.exeFilesize
197KB
MD557eb1430903457db36a36023304f8a38
SHA1831f481eebdf994a1cfacca5a9f53e1f6f93e0fd
SHA2561962f91125c15839d9e18b7273f1831cae8a191c574577210dda1a424e9e7628
SHA512a33af94ab2083e6beb5631ce4ff8c5340b4bf10e7a15727aef6817ec4dfd7c6771f90abc8bca397319d571cc8c165c7182528bab2e962f168530b7a496da683e
-
C:\ProgramData\wefnw\xeqx.exeFilesize
197KB
MD557eb1430903457db36a36023304f8a38
SHA1831f481eebdf994a1cfacca5a9f53e1f6f93e0fd
SHA2561962f91125c15839d9e18b7273f1831cae8a191c574577210dda1a424e9e7628
SHA512a33af94ab2083e6beb5631ce4ff8c5340b4bf10e7a15727aef6817ec4dfd7c6771f90abc8bca397319d571cc8c165c7182528bab2e962f168530b7a496da683e
-
C:\ProgramData\wefnw\xeqx.exeFilesize
197KB
MD557eb1430903457db36a36023304f8a38
SHA1831f481eebdf994a1cfacca5a9f53e1f6f93e0fd
SHA2561962f91125c15839d9e18b7273f1831cae8a191c574577210dda1a424e9e7628
SHA512a33af94ab2083e6beb5631ce4ff8c5340b4bf10e7a15727aef6817ec4dfd7c6771f90abc8bca397319d571cc8c165c7182528bab2e962f168530b7a496da683e
-
memory/668-63-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/668-59-0x0000000000000000-mapping.dmp
-
memory/668-62-0x00000000006BB000-0x00000000006CC000-memory.dmpFilesize
68KB
-
memory/668-66-0x00000000006BB000-0x00000000006CC000-memory.dmpFilesize
68KB
-
memory/1148-67-0x0000000000000000-mapping.dmp
-
memory/1148-70-0x0000000000A0B000-0x0000000000A1C000-memory.dmpFilesize
68KB
-
memory/1148-71-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1900-57-0x0000000000400000-0x000000000058B000-memory.dmpFilesize
1.5MB
-
memory/1900-55-0x000000000030B000-0x000000000031C000-memory.dmpFilesize
68KB
-
memory/1900-54-0x00000000759F1000-0x00000000759F3000-memory.dmpFilesize
8KB
-
memory/1900-64-0x000000000030B000-0x000000000031C000-memory.dmpFilesize
68KB
-
memory/1900-65-0x000000000030B000-0x000000000031C000-memory.dmpFilesize
68KB
-
memory/1900-56-0x00000000001B0000-0x00000000001B5000-memory.dmpFilesize
20KB