Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
11/01/2024, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
5f4371e9fcc21652c9fb3867f64d4941.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5f4371e9fcc21652c9fb3867f64d4941.exe
Resource
win10v2004-20231222-en
General
-
Target
5f4371e9fcc21652c9fb3867f64d4941.exe
-
Size
4.5MB
-
MD5
5f4371e9fcc21652c9fb3867f64d4941
-
SHA1
a19d69302a3993f2aca91d73bdc128e47b6ce174
-
SHA256
9397e1a3bd7e94ae5213d8dc4edef5e73fe8c6f0306196a1ffae832a3976e9ac
-
SHA512
3c736528fd01383b6fb37a30b306ccd0cfa6b2129cea650263d0a5488e1052c6348acac115ad394c7c70b647d42dc55f4811bd2321b11c3c4c6a37f9c8d21536
-
SSDEEP
98304:QDC5jNxoKkMBuu/KJmiuK3gqLkWSTGHVs49M4dm8:YCj6KPBuh8XUgqLXHLM4dD
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral2/memory/4848-154-0x0000000000880000-0x0000000000922000-memory.dmp family_socks5systemz behavioral2/memory/4848-148-0x0000000000880000-0x0000000000922000-memory.dmp family_socks5systemz behavioral2/memory/4848-161-0x0000000000880000-0x0000000000922000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 2672 dvdreportviewer.exe 4848 dvdreportviewer.exe -
Loads dropped DLL 3 IoCs
pid Process 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 4312 wrote to memory of 1928 4312 5f4371e9fcc21652c9fb3867f64d4941.exe 89 PID 4312 wrote to memory of 1928 4312 5f4371e9fcc21652c9fb3867f64d4941.exe 89 PID 4312 wrote to memory of 1928 4312 5f4371e9fcc21652c9fb3867f64d4941.exe 89 PID 1928 wrote to memory of 1704 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 94 PID 1928 wrote to memory of 1704 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 94 PID 1928 wrote to memory of 1704 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 94 PID 1928 wrote to memory of 2672 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 92 PID 1928 wrote to memory of 2672 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 92 PID 1928 wrote to memory of 2672 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 92 PID 1704 wrote to memory of 3536 1704 net.exe 91 PID 1704 wrote to memory of 3536 1704 net.exe 91 PID 1704 wrote to memory of 3536 1704 net.exe 91 PID 1928 wrote to memory of 4848 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 95 PID 1928 wrote to memory of 4848 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 95 PID 1928 wrote to memory of 4848 1928 5f4371e9fcc21652c9fb3867f64d4941.tmp 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\5f4371e9fcc21652c9fb3867f64d4941.exe"C:\Users\Admin\AppData\Local\Temp\5f4371e9fcc21652c9fb3867f64d4941.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Local\Temp\is-SSR65.tmp\5f4371e9fcc21652c9fb3867f64d4941.tmp"C:\Users\Admin\AppData\Local\Temp\is-SSR65.tmp\5f4371e9fcc21652c9fb3867f64d4941.tmp" /SL5="$8022C,4446766,54272,C:\Users\Admin\AppData\Local\Temp\5f4371e9fcc21652c9fb3867f64d4941.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe"C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe" -i3⤵
- Executes dropped EXE
PID:2672
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 11033⤵
- Suspicious use of WriteProcessMemory
PID:1704
-
-
C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe"C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe" -s3⤵
- Executes dropped EXE
PID:4848
-
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 11031⤵PID:3536
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
MD56dd32bf998ded90dbb75fd9adc21e861
SHA1d9ee6ca1688fe0e563ddc6a945798d8a04c50f77
SHA256bb95d78447bb10869a3cad272392b42ea83b7d78d903fe00d81c0ac9ae2e2fb6
SHA512c12a76f26301111503e78ce2c9daf80d66cbf8e61905200bc0b0b29905028bfd6111e2c16c69fff3762096ba752a317ca30603eb05e2c0b3ebb10650de5c8951
-
Filesize
832KB
MD57b5c1a7d9fc6b0fef2be24cc0990f8b1
SHA145932467c4ec8617d41a86d76e5d7d931f96ccea
SHA256059bd0590b1b6e0497d342c2f64a0f0348e492a5cf7e02190301ab0bbbe94cce
SHA51238c6baf40629beb564943ce680dd5d2136d5352b3d65fd6aff823b235ca28cfc851ee092ea378cf019c631efc276f1feb4ae4278efc71d1392af79a6b7af26b1
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
111KB
MD5809465a767988f3342e7028154fb1589
SHA185abaa8c4e80931562dc9b93f2c63b05e9c76970
SHA2563c57cdd6f778e883f220be4483a9971970c9e7a3519bb7fdad219d8669e4fc2b
SHA51251cb9c7d83c9ea18a02da6178ca3fc3e738985289b700e5d3677d307c378bc7638ad5b87df382503fede706e892dfa3d70a62751003d082e1c278c6c5a5195d0
-
Filesize
688KB
MD5a7662827ecaeb4fc68334f6b8791b917
SHA1f93151dd228d680aa2910280e51f0a84d0cad105
SHA25605f159722d6905719d2d6f340981a293f40ab8a0d2d4a282c948066809d4af6d
SHA512e9880b3f3ec9201e59114850e9c570d0ad6d3b0e04c60929a03cf983c62c505fcb6bb9dc3adeee88c78d43bd484159626b4a2f000a34b8883164c263f21e6f4a