Analysis
-
max time kernel
145s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
24/03/2024, 18:44
Static task
static1
Behavioral task
behavioral1
Sample
835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral2
Sample
835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe
Resource
win11-20240221-en
General
-
Target
835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe
-
Size
2.0MB
-
MD5
18cd6d6cbd528a40637527c4ad877ec2
-
SHA1
6c7c7924c4d3302e9bc216d631f2834ad304a64e
-
SHA256
835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2
-
SHA512
c2cd03eb3e894464ee9474c25053165327fa8a4389897259eee02f4446b77bab2bdabe35ea338176fb88df4c625bcb3e00d0d8fab61c7876ca5c5986171303ce
-
SSDEEP
49152:32uzUgsg/9ncv65k7C/FONspKiFiY83sMp5JtHtI:mOUkncv4kZiMeMpTxtI
Malware Config
Extracted
socks5systemz
http://bpjvziz.com/search/?q=67e28dd86f5af1211209a81b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe12c0ea9c9939
Signatures
-
Detect Socks5Systemz Payload 2 IoCs
resource yara_rule behavioral1/memory/5056-66-0x00000000008C0000-0x0000000000962000-memory.dmp family_socks5systemz behavioral1/memory/5056-76-0x00000000008C0000-0x0000000000962000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 2356 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp 452 sitefreeedition.exe 5056 sitefreeedition.exe -
Loads dropped DLL 1 IoCs
pid Process 2356 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 91.211.247.248 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1432 wrote to memory of 2356 1432 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe 87 PID 1432 wrote to memory of 2356 1432 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe 87 PID 1432 wrote to memory of 2356 1432 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe 87 PID 2356 wrote to memory of 452 2356 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp 91 PID 2356 wrote to memory of 452 2356 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp 91 PID 2356 wrote to memory of 452 2356 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp 91 PID 2356 wrote to memory of 5056 2356 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp 92 PID 2356 wrote to memory of 5056 2356 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp 92 PID 2356 wrote to memory of 5056 2356 835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe"C:\Users\Admin\AppData\Local\Temp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1432 -
C:\Users\Admin\AppData\Local\Temp\is-MUMUG.tmp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp"C:\Users\Admin\AppData\Local\Temp\is-MUMUG.tmp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp" /SL5="$80180,1724921,54272,C:\Users\Admin\AppData\Local\Temp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2356 -
C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe"C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe" -i3⤵
- Executes dropped EXE
PID:452
-
-
C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe"C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe" -s3⤵
- Executes dropped EXE
PID:5056
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
512KB
MD51d1eee3de29080bdf305724dae8a27ec
SHA17753fd1577137747a881e875e907206aa92431a7
SHA25647e6ff8e52b54d878e7f81815ce8db913a028a5b23f9277780a9e512ee4c7637
SHA512f518e6a0ff48ad32f17f98853352e918f309aaa8d531fc8cde7c4a55a9b17f85dffbfbc8536449877f80919b77b73c149eeabacf256dd33c5bd12241d7c78b71
-
Filesize
180KB
MD5dbf1fb0f80672c5eb5877bff3822a795
SHA1f9ce47f3b85bb2471e746a57574cec0c67a14dd8
SHA256d7eb892a96758751929ac31f2b0495bcf2a2d10d5fb5620bb11a16e9a4952db5
SHA512ef5775b3675c974b9cc75c5338fce6b39712de0ca39d9202e1997a3fc7953d66768092779dae3512ab3fcdfcb125527fef042c24ee1f644916287d3240148132
-
Filesize
58KB
MD502fe0806b7c4dc48ea6195ffbeedf987
SHA1abc97cc27774b764c4b8a1a541d850b91ebeec99
SHA256b795ea825b068e85e4a00f2cb47c43d56bfe77f33c4999860b4e9083293631b5
SHA512f306d7eb6298ea42a7d05002f96e05d1d3a4c2f9727b62f03f1fc3e1dede59385e8ffbc19b15a3c4c23276b19d5dc28710e5bab53104cab51b805f4e3ffedba9
-
C:\Users\Admin\AppData\Local\Temp\is-MUMUG.tmp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp
Filesize173KB
MD5f902aec117bb06062f373845d78cc15d
SHA1935a4de4d11dfcc5402aeb494c2ce087f539e59d
SHA2560320f1524759121fde9b6e6ba18d4640939bd1a2cbcf9a633ebfbc98c015a124
SHA512b5822731c589d87e6107b0a87b57314946368de8b696d2d57bebf99f6d290582fc9a6117f185087c112be9186847eb5295798a53b5b8d3aebfa481a4247535e2
-
C:\Users\Admin\AppData\Local\Temp\is-MUMUG.tmp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp
Filesize168KB
MD58727b59836df080f8ce131b421bd3f8e
SHA1ec34e9c6710e825ef28d1150a55be425ffef86ff
SHA256badd22f44bcfec3efed95ac9dc3961b1a9398d813d5ebaee4c7dfdf62fcb6db0
SHA512c278dde1d15c5290a5ede757070007f9ac1f188230e238adf8edcc1d832c5d82b5bc533cf00f3d108fbb6845905a70099c1ef6802ad8252177911f0b7400d5e2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63