Analysis
-
max time kernel
143s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07-01-2024 03:03
Static task
static1
Behavioral task
behavioral1
Sample
fd82388cccd686f54503bc41929b39b8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
fd82388cccd686f54503bc41929b39b8.exe
Resource
win10v2004-20231222-en
General
-
Target
fd82388cccd686f54503bc41929b39b8.exe
-
Size
4.5MB
-
MD5
fd82388cccd686f54503bc41929b39b8
-
SHA1
24fd01b0318aaf739b204a456e5f64a19c271e6d
-
SHA256
08e99c84eae02bcadf577873cf34b6f87b718d83b9c8721e849888425ed9450d
-
SHA512
ca5924175338b1741ff79135dbab883403ffd03012cd7914ac173f778159e99c11c115cdad3b085aa67eb9b9136ff9c76cd5a8775f9abc3c35524468a2242c59
-
SSDEEP
98304:QHfMnRjsJoLAX5/0LUlwSL/9gv+7AaIk4dm8:ts6MX5fwSSN24dD
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral1/memory/1756-156-0x0000000002490000-0x0000000002532000-memory.dmp family_socks5systemz behavioral1/memory/1756-158-0x0000000002490000-0x0000000002532000-memory.dmp family_socks5systemz behavioral1/memory/1756-167-0x0000000002490000-0x0000000002532000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 2092 fd82388cccd686f54503bc41929b39b8.tmp 2992 pip-master-std-lib.exe 1756 pip-master-std-lib.exe -
Loads dropped DLL 6 IoCs
pid Process 2912 fd82388cccd686f54503bc41929b39b8.exe 2092 fd82388cccd686f54503bc41929b39b8.tmp 2092 fd82388cccd686f54503bc41929b39b8.tmp 2092 fd82388cccd686f54503bc41929b39b8.tmp 2092 fd82388cccd686f54503bc41929b39b8.tmp 2092 fd82388cccd686f54503bc41929b39b8.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2092 fd82388cccd686f54503bc41929b39b8.tmp -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2912 wrote to memory of 2092 2912 fd82388cccd686f54503bc41929b39b8.exe 28 PID 2912 wrote to memory of 2092 2912 fd82388cccd686f54503bc41929b39b8.exe 28 PID 2912 wrote to memory of 2092 2912 fd82388cccd686f54503bc41929b39b8.exe 28 PID 2912 wrote to memory of 2092 2912 fd82388cccd686f54503bc41929b39b8.exe 28 PID 2912 wrote to memory of 2092 2912 fd82388cccd686f54503bc41929b39b8.exe 28 PID 2912 wrote to memory of 2092 2912 fd82388cccd686f54503bc41929b39b8.exe 28 PID 2912 wrote to memory of 2092 2912 fd82388cccd686f54503bc41929b39b8.exe 28 PID 2092 wrote to memory of 1640 2092 fd82388cccd686f54503bc41929b39b8.tmp 29 PID 2092 wrote to memory of 1640 2092 fd82388cccd686f54503bc41929b39b8.tmp 29 PID 2092 wrote to memory of 1640 2092 fd82388cccd686f54503bc41929b39b8.tmp 29 PID 2092 wrote to memory of 1640 2092 fd82388cccd686f54503bc41929b39b8.tmp 29 PID 2092 wrote to memory of 2992 2092 fd82388cccd686f54503bc41929b39b8.tmp 31 PID 2092 wrote to memory of 2992 2092 fd82388cccd686f54503bc41929b39b8.tmp 31 PID 2092 wrote to memory of 2992 2092 fd82388cccd686f54503bc41929b39b8.tmp 31 PID 2092 wrote to memory of 2992 2092 fd82388cccd686f54503bc41929b39b8.tmp 31 PID 1640 wrote to memory of 1208 1640 net.exe 32 PID 1640 wrote to memory of 1208 1640 net.exe 32 PID 1640 wrote to memory of 1208 1640 net.exe 32 PID 1640 wrote to memory of 1208 1640 net.exe 32 PID 2092 wrote to memory of 1756 2092 fd82388cccd686f54503bc41929b39b8.tmp 33 PID 2092 wrote to memory of 1756 2092 fd82388cccd686f54503bc41929b39b8.tmp 33 PID 2092 wrote to memory of 1756 2092 fd82388cccd686f54503bc41929b39b8.tmp 33 PID 2092 wrote to memory of 1756 2092 fd82388cccd686f54503bc41929b39b8.tmp 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd82388cccd686f54503bc41929b39b8.exe"C:\Users\Admin\AppData\Local\Temp\fd82388cccd686f54503bc41929b39b8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2912 -
C:\Users\Admin\AppData\Local\Temp\is-8TL0L.tmp\fd82388cccd686f54503bc41929b39b8.tmp"C:\Users\Admin\AppData\Local\Temp\is-8TL0L.tmp\fd82388cccd686f54503bc41929b39b8.tmp" /SL5="$40016,4463661,54272,C:\Users\Admin\AppData\Local\Temp\fd82388cccd686f54503bc41929b39b8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 1533⤵
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 1534⤵PID:1208
-
-
-
C:\Users\Admin\AppData\Local\PIP Master std lib\pip-master-std-lib.exe"C:\Users\Admin\AppData\Local\PIP Master std lib\pip-master-std-lib.exe" -i3⤵
- Executes dropped EXE
PID:2992
-
-
C:\Users\Admin\AppData\Local\PIP Master std lib\pip-master-std-lib.exe"C:\Users\Admin\AppData\Local\PIP Master std lib\pip-master-std-lib.exe" -s3⤵
- Executes dropped EXE
PID:1756
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
98KB
MD5e3c69554c98a0439e2716bbc189fc7a2
SHA14623be0e27a903298425f40b7fe41837e712f3f2
SHA2567f485448d8fb41452daf09439e2deb8dabd57026f10ac23c28c85a66ed97031e
SHA5122ed3aafe3586ec46ad4f31bc2b97f3bed57316606df198267d46ff4df78fa4be65447bda2603ab2d7a9a9a212b9ac1867c7eeead4f670625d40c26b1fdbe5542
-
Filesize
1.2MB
MD54ea306efb159e6c255d6a7af1e066e3d
SHA1f5210092ba273e38c3ed39d0bde5762d8d433dbf
SHA256c04fe51d2dd90c9b08665ea731c543cbf0a321fa8fffbd999afe4834221759b7
SHA5120eec3fb9c88f058e492ca18bdf2e15d6f407cf41bade3d231b54c0ea0302bfa1fc2cfed1cb5bea9d3cf155cc10b5fc723173abe28afeddb65a7661cc033b1e67
-
Filesize
833KB
MD55d7c9a3712e5ea742a9aa08db24a9701
SHA1285fc7f3b1151217e2c43e6450259e87086b0c6c
SHA2566c7892e9f976a09564439d59930b24f86beffc37f77a4a61bfb5df9d9d646475
SHA512cc7aa19e68f9a3cf18ef6df0d97d550b80c2c3b9c8d070a685cad489f606f76f473aa18a4e2cf15a402af620ffcfadc41f4f9f299633bedeed976b1c65b23073
-
Filesize
1.0MB
MD56746846b72e9d2407f3a464069d82f59
SHA1ea90f22ba5646c29181d9b12c031f0cfea438750
SHA25681e61e0b89425908a8829ee3e250326f6e511eed05e666bdc0ce7c80c6222acf
SHA51238bb028d7607b79ac768e00198f762aacfa271d9888fff8c5bc945b7b38009e79d2604f6cd68173eae0981e27b08c70c9666e2c254dfee0d075430fc099b9fee
-
Filesize
688KB
MD5a7662827ecaeb4fc68334f6b8791b917
SHA1f93151dd228d680aa2910280e51f0a84d0cad105
SHA25605f159722d6905719d2d6f340981a293f40ab8a0d2d4a282c948066809d4af6d
SHA512e9880b3f3ec9201e59114850e9c570d0ad6d3b0e04c60929a03cf983c62c505fcb6bb9dc3adeee88c78d43bd484159626b4a2f000a34b8883164c263f21e6f4a
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3