Analysis
-
max time kernel
591s -
max time network
601s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
03-03-2023 14:06
Static task
static1
Behavioral task
behavioral1
Sample
socks.exe
Resource
win7-20230220-en
General
-
Target
socks.exe
-
Size
420KB
-
MD5
e85fa08c1ed20440363e2e44eced6299
-
SHA1
e0867a371a5c6bfdf6bd84470b188f0817b4d23a
-
SHA256
c1f5b88413bef3bc89aacd544847d5690fe17247b10d5922e59e4cbc6c37707e
-
SHA512
73bc5a867c7b86f32257f43167c1816b9087a0fc6d70f1500194821abbdfcaddb4f79325e0b24837fabb9594284ff9bb7b180de5fc0264287a6345b146ffcfbf
-
SSDEEP
6144:g/v3nlCZp4WBAo8+zcJHZNIp4id9q/7ygt2k/BFi+Vrh+Z6QFn5EzMJ1:E/lppJHwp5e/viEg6z81
Malware Config
Extracted
systembc
31.222.238.58:4280
192.168.1.28:4280
Signatures
-
Drops startup file 1 IoCs
Processes:
socks.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pu5xtvhm.lnk socks.exe -
Executes dropped EXE 1 IoCs
Processes:
pu5xtvhm.exepid process 2640 pu5xtvhm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
pu5xtvhm.exedescription pid process target process PID 2640 set thread context of 4152 2640 pu5xtvhm.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
socks.exepid process 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe 4760 socks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
socks.exepu5xtvhm.exedescription pid process Token: SeDebugPrivilege 4760 socks.exe Token: SeDebugPrivilege 2640 pu5xtvhm.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
socks.execmd.exepu5xtvhm.exedescription pid process target process PID 4760 wrote to memory of 824 4760 socks.exe cmd.exe PID 4760 wrote to memory of 824 4760 socks.exe cmd.exe PID 4760 wrote to memory of 824 4760 socks.exe cmd.exe PID 824 wrote to memory of 2736 824 cmd.exe PING.EXE PID 824 wrote to memory of 2736 824 cmd.exe PING.EXE PID 824 wrote to memory of 2736 824 cmd.exe PING.EXE PID 824 wrote to memory of 2416 824 cmd.exe PING.EXE PID 824 wrote to memory of 2416 824 cmd.exe PING.EXE PID 824 wrote to memory of 2416 824 cmd.exe PING.EXE PID 824 wrote to memory of 2640 824 cmd.exe pu5xtvhm.exe PID 824 wrote to memory of 2640 824 cmd.exe pu5xtvhm.exe PID 824 wrote to memory of 2640 824 cmd.exe pu5xtvhm.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 2540 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 1808 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe PID 2640 wrote to memory of 4152 2640 pu5xtvhm.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\socks.exe"C:\Users\Admin\AppData\Local\Temp\socks.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 44 > nul && copy "C:\Users\Admin\AppData\Local\Temp\socks.exe" "C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exe" && ping 127.0.0.1 -n 44 > nul && "C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 443⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 443⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exe"C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exeFilesize
420KB
MD5e85fa08c1ed20440363e2e44eced6299
SHA1e0867a371a5c6bfdf6bd84470b188f0817b4d23a
SHA256c1f5b88413bef3bc89aacd544847d5690fe17247b10d5922e59e4cbc6c37707e
SHA51273bc5a867c7b86f32257f43167c1816b9087a0fc6d70f1500194821abbdfcaddb4f79325e0b24837fabb9594284ff9bb7b180de5fc0264287a6345b146ffcfbf
-
C:\Users\Admin\AppData\Roaming\ncache\pu5xtvhm.exeFilesize
420KB
MD5e85fa08c1ed20440363e2e44eced6299
SHA1e0867a371a5c6bfdf6bd84470b188f0817b4d23a
SHA256c1f5b88413bef3bc89aacd544847d5690fe17247b10d5922e59e4cbc6c37707e
SHA51273bc5a867c7b86f32257f43167c1816b9087a0fc6d70f1500194821abbdfcaddb4f79325e0b24837fabb9594284ff9bb7b180de5fc0264287a6345b146ffcfbf
-
memory/2640-156-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/2640-153-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/2640-151-0x0000000000400000-0x000000000046E000-memory.dmpFilesize
440KB
-
memory/2640-159-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/2640-158-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/2640-157-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/2640-155-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/2640-152-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/2640-154-0x00000000028F0000-0x0000000002900000-memory.dmpFilesize
64KB
-
memory/4152-162-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/4152-160-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/4152-163-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/4760-142-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4760-135-0x0000000004C20000-0x0000000004CB2000-memory.dmpFilesize
584KB
-
memory/4760-137-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4760-144-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4760-133-0x0000000000850000-0x00000000008BE000-memory.dmpFilesize
440KB
-
memory/4760-143-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4760-136-0x0000000004CC0000-0x0000000004D5C000-memory.dmpFilesize
624KB
-
memory/4760-141-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4760-139-0x0000000004BA0000-0x0000000004BB0000-memory.dmpFilesize
64KB
-
memory/4760-138-0x0000000006020000-0x000000000602A000-memory.dmpFilesize
40KB
-
memory/4760-134-0x00000000051D0000-0x0000000005774000-memory.dmpFilesize
5.6MB