Analysis
-
max time kernel
141s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
12/02/2024, 04:37
General
-
Target
fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe
-
Size
7.5MB
-
MD5
42f5eb399ee94ad2bb7809e600abebf7
-
SHA1
3a2c7d6b63ce50367c9c27a08a164ac037663919
-
SHA256
fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22
-
SHA512
0e39437fb30e47817e4b86d77d83037f6962df69996cb0cb343714bd641705403a24850f2a4d9760bbd0c19cfd75fb9d4e4aa67612682b203429300152d61cfa
-
SSDEEP
196608:iCKQKmhnguWQkn9sl7pQ//XYenYQs9bOBKhOcq3RW:DmmVuQkn9sl7KX2QswBKhnyE
Malware Config
Signatures
-
Detect Socks5Systemz Payload 5 IoCs
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Detects executables packed with VMProtect. 19 IoCs
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe"C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DSNN0.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp"C:\Users\Admin\AppData\Local\Temp\is-DSNN0.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp" /SL5="$7006E,7652121,54272,C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe"C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe" -i3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe"C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe" -s3⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
73KB
MD51492297527f8aca8e595234a6fe0da78
SHA1563ed6a8187b5938c6c50b633848f21b1e2cbeb5
SHA2563debd93869c9ffea1aef669f3240b899a5e1497fa75c346688044c58696deb80
SHA5123692eaa034e51a051f3103e877d8f5f4ea6da5c95200038f8b69f93e14cee589c0c2d3b01b55934dd29e14c4e91e11891ee69682dc153a8767fd0b2cb61cd139
-
Filesize
14KB
MD5d03d5f46af85455fd48ca4cef2606676
SHA1ecae406bdcd7994bcc152631c4d30b7f063661c2
SHA2569f41a2f036374878a40d35c35993971454664838cb5c676424379f1f21ef3c29
SHA51223a6891f65ca5eb12aa005b8e2f1df911d6fc36131b2a6d2aabe6897bc286a3f6d404ecd2490a2da1cb0bb0f5c0ba8a0dea270524907f6befb723740ade2637e
-
Filesize
57KB
MD5f883f56cb248230e95d7c1cd733d6991
SHA163a1d3fef368f8055f3a8e78ba60a5fe9a26349a
SHA2565b2b016f49e28da866d7602f698fddbbed9c83c510ecd769caba4ab374d54f1b
SHA512ce4ea5e4c68de92156df3c3a4b85e32f2cff5370ca1ca6ef8bf4357406d17568af7e0956ee649ae8d054e19dbcfbdd2b769cd08f72db3aec82136179e6970c08
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
1KB
MD553e91ee215f171e5337de9eadf2b7918
SHA1e67d6bb06741306f964bdf21cb0426915e866488
SHA256b765ef42a83ab9ec273f6a6aada2f5ab995ccbce40e7757fab35d77133da00a7
SHA512fe24ad561525254de67cc62dd5e328242cd4cd1bbf943ac14736a5933974b153e413eca3d352af3eea8a8e3afc7dbc20795177e5d286f994e85bb8f594a3dae8
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
27KB
MD50cfcd49361e58af0d6c167d4d8df9b46
SHA15315c42f865fdc3a192a5388bb1fca89f1e1228e
SHA256a398da50eca92db2677d92027a40cf85b4833a0d82b1817394a0e9463602fad1
SHA5124554dc22016f9dba618d621e95b719dbc392fc3d42439a1c504da125fbd9c2db5dd29cdac868c66884f6618b07db83cb53aa129852b15a33857174a6cf391df0
-
Filesize
38KB
MD5a3c14e8bf6292ae56cae78b3c271ba7b
SHA191357f69990e9f8ffd835ad2ce1992a7509496d8
SHA256b7520ab95ae1b20f621845d915dd7247cb30f398ef24b0724293a1d9e4bf9154
SHA512daaf935b0509bd6bb449a062d622c5b1ed0bcd43d5a3c295b18bd3665ca912e2db69240ed9109e3b28f0c7c056c6ace9d254b67414a4a92e812727e5de88b1ba
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
752KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
648KB
-
Filesize
3.8MB
-
Filesize
648KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
648KB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
3.8MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
3.8MB
-
Filesize
3.8MB