Analysis

  • max time kernel
    300s
  • max time network
    272s
  • platform
    windows10-1703_x64
  • resource
    win10-20231023-en
  • resource tags

    arch:x64arch:x86image:win10-20231023-enlocale:en-usos:windows10-1703-x64system
  • submitted
    11/12/2023, 05:02

General

  • Target

    7d661992e881431b0bfe2b95f44a509c790ae0330c1c0cc7446ab0a707ea7876.exe

  • Size

    8.0MB

  • MD5

    fd7f0fbf9e8e5fce5356d5751ef21d68

  • SHA1

    383ce87147caee8793ed6b923a8587d96682a06c

  • SHA256

    7d661992e881431b0bfe2b95f44a509c790ae0330c1c0cc7446ab0a707ea7876

  • SHA512

    e6688fcafd3c271319e2a6dac2c7523d9f497fe04e63c0710d45e10a9f94c74a867ac8d4af83b78348a5312b2f9eb3eb8a5729f099560cd33567c0375ca62636

  • SSDEEP

    196608:G4lBu+BpMBvbZVlSloOBs8Awr2wI2CqPb4oMvTwaqd:ChPvMVsDv0v

Malware Config

Extracted

Family

socks5systemz

Attributes
  • rc4_key

    i4hiea56#7b&dfw3

Signatures

  • Detect Socks5Systemz Payload 2 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in Program Files directory 63 IoCs
  • Runs net.exe
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7d661992e881431b0bfe2b95f44a509c790ae0330c1c0cc7446ab0a707ea7876.exe
    "C:\Users\Admin\AppData\Local\Temp\7d661992e881431b0bfe2b95f44a509c790ae0330c1c0cc7446ab0a707ea7876.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1832
    • C:\Users\Admin\AppData\Local\Temp\is-AU5E9.tmp\7d661992e881431b0bfe2b95f44a509c790ae0330c1c0cc7446ab0a707ea7876.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AU5E9.tmp\7d661992e881431b0bfe2b95f44a509c790ae0330c1c0cc7446ab0a707ea7876.tmp" /SL5="$5023A,8125485,54272,C:\Users\Admin\AppData\Local\Temp\7d661992e881431b0bfe2b95f44a509c790ae0330c1c0cc7446ab0a707ea7876.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in Program Files directory
      • Suspicious use of WriteProcessMemory
      PID:4124
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\system32\schtasks.exe" /Query
        3⤵
          PID:3960
        • C:\Program Files (x86)\LibsaxCRT\LibsaxCRT.exe
          "C:\Program Files (x86)\LibsaxCRT\LibsaxCRT.exe" -i
          3⤵
          • Executes dropped EXE
          PID:3212
        • C:\Program Files (x86)\LibsaxCRT\LibsaxCRT.exe
          "C:\Program Files (x86)\LibsaxCRT\LibsaxCRT.exe" -s
          3⤵
          • Executes dropped EXE
          PID:4444
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\system32\net.exe" helpmsg 6
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:3764
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 helpmsg 6
            4⤵
              PID:3924

      Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Program Files (x86)\LibsaxCRT\LibsaxCRT.exe

              Filesize

              3.9MB

              MD5

              4b3fb9de0070d2123130d32764119eea

              SHA1

              3d9fcfe6df9e43432e96fd068eb4ab73e34d38c8

              SHA256

              15bb10f1a2464955a58ffd7b846a51e7c286197b9eb2dbf18272ea65fab9d805

              SHA512

              aefa7c94ababf99bc6c9309c2037b6a7ce8a339784a6496087786856dd487943f8bc6a2af292d6f36f5294588cacf2f761802a0b61c4a94aa23f2452444f5047

            • C:\Users\Admin\AppData\Local\Temp\is-AU5E9.tmp\7d661992e881431b0bfe2b95f44a509c790ae0330c1c0cc7446ab0a707ea7876.tmp

              Filesize

              694KB

              MD5

              5525670a9e72d77b368a9aa4b8c814c1

              SHA1

              3fdad952ea00175f3a6e549b5dca4f568e394612

              SHA256

              1180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978

              SHA512

              757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a

            • \Users\Admin\AppData\Local\Temp\is-L5M0S.tmp\_isetup\_iscrypt.dll

              Filesize

              2KB

              MD5

              a69559718ab506675e907fe49deb71e9

              SHA1

              bc8f404ffdb1960b50c12ff9413c893b56f2e36f

              SHA256

              2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

              SHA512

              e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

            • \Users\Admin\AppData\Local\Temp\is-L5M0S.tmp\_isetup\_isdecmp.dll

              Filesize

              13KB

              MD5

              a813d18268affd4763dde940246dc7e5

              SHA1

              c7366e1fd925c17cc6068001bd38eaef5b42852f

              SHA256

              e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

              SHA512

              b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

            • memory/1832-2-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

            • memory/1832-0-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

            • memory/1832-160-0x0000000000400000-0x0000000000414000-memory.dmp

              Filesize

              80KB

            • memory/3212-150-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/3212-154-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/3212-155-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/3212-151-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4124-161-0x0000000000400000-0x00000000004BD000-memory.dmp

              Filesize

              756KB

            • memory/4124-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

              Filesize

              4KB

            • memory/4124-163-0x00000000001F0000-0x00000000001F1000-memory.dmp

              Filesize

              4KB

            • memory/4444-167-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-188-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-159-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-166-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-157-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-170-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-173-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-176-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-179-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-180-0x0000000000990000-0x0000000000A3D000-memory.dmp

              Filesize

              692KB

            • memory/4444-185-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-162-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-189-0x0000000000990000-0x0000000000A3D000-memory.dmp

              Filesize

              692KB

            • memory/4444-192-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-195-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-198-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-201-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-205-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-208-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-211-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-214-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-217-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-222-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB

            • memory/4444-225-0x0000000000400000-0x00000000007EF000-memory.dmp

              Filesize

              3.9MB