Analysis
-
max time kernel
300s -
max time network
250s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
04/02/2024, 03:37
Static task
static1
Behavioral task
behavioral1
Sample
3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe
Resource
win10-20231220-en
General
-
Target
3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe
-
Size
3.4MB
-
MD5
cecde978f0dcdc5b3f713282e6f2c2f8
-
SHA1
4d9cf78b1ad338bfd367cf4cb22555c44599d411
-
SHA256
3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399
-
SHA512
c3057c6a1f0c8d188f2e89ab1c14caff85acb91eb6a7e7231615141d241414dd6b4d7688889acae368721bf5613613ef7ffc875b95de25fbc8d40d5a4fe8aca2
-
SSDEEP
49152:a2r5FA7K1OopyYq0JunYOfFy0PzqIZG9p6zM7ikvPURaH3XE4hX86tGoWrrKUTdq:7r52zY40My0bAHvsAH//Wrf/kDd
Malware Config
Extracted
socks5systemz
-
rc4_key
i4hiea56#7b&dfw3
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral1/memory/2568-95-0x0000000002B70000-0x0000000002C1D000-memory.dmp family_socks5systemz behavioral1/memory/2568-94-0x0000000002B70000-0x0000000002C1D000-memory.dmp family_socks5systemz behavioral1/memory/2568-104-0x0000000002B70000-0x0000000002C1D000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 2696 VolumeUTIL.exe 2568 VolumeUTIL.exe -
Loads dropped DLL 6 IoCs
pid Process 1972 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 81.31.197.38 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 19 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-9IIM7.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-N6R3M.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-6QVOM.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-U02S8.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-CQIQ6.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-689IN.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-BR7IV.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-6SO36.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\unins000.dat 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-KKOC2.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-M3SR2.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-D2ESM.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\UIText\is-SDOQR.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-N0JVI.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-3H42T.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-C625E.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File opened for modification C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp File created C:\Program Files (x86)\Common Files\VolumeUTIL\is-D2V2I.tmp 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp -
Runs net.exe
-
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1972 wrote to memory of 948 1972 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe 28 PID 1972 wrote to memory of 948 1972 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe 28 PID 1972 wrote to memory of 948 1972 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe 28 PID 1972 wrote to memory of 948 1972 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe 28 PID 1972 wrote to memory of 948 1972 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe 28 PID 1972 wrote to memory of 948 1972 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe 28 PID 1972 wrote to memory of 948 1972 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe 28 PID 948 wrote to memory of 2584 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 29 PID 948 wrote to memory of 2584 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 29 PID 948 wrote to memory of 2584 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 29 PID 948 wrote to memory of 2584 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 29 PID 948 wrote to memory of 2696 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 30 PID 948 wrote to memory of 2696 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 30 PID 948 wrote to memory of 2696 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 30 PID 948 wrote to memory of 2696 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 30 PID 948 wrote to memory of 2472 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 34 PID 948 wrote to memory of 2472 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 34 PID 948 wrote to memory of 2472 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 34 PID 948 wrote to memory of 2472 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 34 PID 948 wrote to memory of 2568 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 32 PID 948 wrote to memory of 2568 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 32 PID 948 wrote to memory of 2568 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 32 PID 948 wrote to memory of 2568 948 3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp 32 PID 2472 wrote to memory of 2544 2472 net.exe 35 PID 2472 wrote to memory of 2544 2472 net.exe 35 PID 2472 wrote to memory of 2544 2472 net.exe 35 PID 2472 wrote to memory of 2544 2472 net.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe"C:\Users\Admin\AppData\Local\Temp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\is-U9SVK.tmp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp"C:\Users\Admin\AppData\Local\Temp\is-U9SVK.tmp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp" /SL5="$4014E,3304892,54272,C:\Users\Admin\AppData\Local\Temp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /Query3⤵PID:2584
-
-
C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -i3⤵
- Executes dropped EXE
PID:2696
-
-
C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe"C:\Program Files (x86)\Common Files\VolumeUTIL\VolumeUTIL.exe" -s3⤵
- Executes dropped EXE
PID:2568
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 293⤵
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 294⤵PID:2544
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.5MB
MD54853d3bd83f7a6ce511ad61d3e00218b
SHA16d13c8e11308db32acfab565407e043a46a424ef
SHA256c8c087eeb9a417bf8a88612f048d5d9ae6f55717713f5058252edf78faf17dda
SHA5121e0ef797f52cc867ffc19874494eeafca8511a83af3f6d337fd444f2a83a50799662a065d5b233bcf0db2b6b6a432250632102f1e55577e651ffddea7722af86
-
Filesize
541KB
MD5ef7cdf295df7d1f2daf5ccb6ece17fce
SHA1b2a7830cec0da6d88eafc11fcf36ae5466ce9e6c
SHA25675b812cb5a824254458789b17517f13df4d6855e198c31834bf94b7a26196364
SHA51270d0de2c270047ec26984397deff450b8edcc981ddb8aea319de15bedf694470851f963a5f82bff73676559878d2c465ac8129446ab1f857f43fbfafa9f65167
-
Filesize
703KB
MD5327a7a843d449af31d93c6b94063a7b5
SHA1edcabc6def5650c632e861de2b94a4543a793f4f
SHA256602cfb614d4aebfad307523bc68dd8740358e9223ca55a16804031e66416a404
SHA5127f1869644c365fd00cbcb60b22574d53ca807825db61ae5aa08da1a2e753e8e18e680e9b8d21c327120842d619fd927b3368abafd3e201bc36f6ce433696a770
-
C:\Users\Admin\AppData\Local\Temp\is-U9SVK.tmp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp
Filesize694KB
MD55525670a9e72d77b368a9aa4b8c814c1
SHA13fdad952ea00175f3a6e549b5dca4f568e394612
SHA2561180706added2a7899f08f25a9f88ecff5d003ba8964f918d00779565e4a6978
SHA512757249f7e67f82522a8e3079a22c5cf92111626446a32ad3ef876f23885f62d1bb5bf3238d564e23531d062fe18742568dfc00e33b049bb8eef05eb953ef981a
-
Filesize
1.3MB
MD56e15db36fd6339866fab14d4cb3e6dee
SHA1adad0dea33b3b2e28acffc0a105c1ff3a241fea0
SHA256430efb495841b82f4ee9f4d31508fc158f816ee029b8bf6142b8f922c51ca11f
SHA51256a3a0f5bc2d4f340df29e64e67753c9f972fa92b8f4d570f4f9df8e3cab30ec9782e1c427325bdb6a17ca1518bb1a2b05cda2cd26ac3e4e379cd3db5afb8ff9
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-U9SVK.tmp\3a6de4dba9cf77206041fcac9b530dda05586318599fcca28e621e0bc1855399.tmp
Filesize682KB
MD5dea35496a193249d0a4f2b71af5905af
SHA1fc5ac157bc80c7d2f47eb6861d71806d7856f216
SHA2564c891296c741e092c3cdf64caff3f889b1910683c6fa505a89fde4eb1545878c
SHA512e5f1cdc8c121c2315e602a38a389db5b9b6d3d4fce574d4b7818edc0c8502859415625374435c91a677342d26d8e19ec156ea62ecd0cd15281757c1fa86d6465