Analysis

  • max time kernel
    145s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/03/2024, 18:44

General

  • Target

    835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe

  • Size

    2.0MB

  • MD5

    18cd6d6cbd528a40637527c4ad877ec2

  • SHA1

    6c7c7924c4d3302e9bc216d631f2834ad304a64e

  • SHA256

    835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2

  • SHA512

    c2cd03eb3e894464ee9474c25053165327fa8a4389897259eee02f4446b77bab2bdabe35ea338176fb88df4c625bcb3e00d0d8fab61c7876ca5c5986171303ce

  • SSDEEP

    49152:32uzUgsg/9ncv65k7C/FONspKiFiY83sMp5JtHtI:mOUkncv4kZiMeMpTxtI

Malware Config

Extracted

Family

socks5systemz

C2

http://bpjvziz.com/search/?q=67e28dd86f5af1211209a81b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe12c0ea9c9939

Signatures

  • Detect Socks5Systemz Payload 2 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe
    "C:\Users\Admin\AppData\Local\Temp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1432
    • C:\Users\Admin\AppData\Local\Temp\is-MUMUG.tmp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-MUMUG.tmp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp" /SL5="$80180,1724921,54272,C:\Users\Admin\AppData\Local\Temp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe
        "C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe" -i
        3⤵
        • Executes dropped EXE
        PID:452
      • C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe
        "C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe" -s
        3⤵
        • Executes dropped EXE
        PID:5056

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe

          Filesize

          512KB

          MD5

          1d1eee3de29080bdf305724dae8a27ec

          SHA1

          7753fd1577137747a881e875e907206aa92431a7

          SHA256

          47e6ff8e52b54d878e7f81815ce8db913a028a5b23f9277780a9e512ee4c7637

          SHA512

          f518e6a0ff48ad32f17f98853352e918f309aaa8d531fc8cde7c4a55a9b17f85dffbfbc8536449877f80919b77b73c149eeabacf256dd33c5bd12241d7c78b71

        • C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe

          Filesize

          180KB

          MD5

          dbf1fb0f80672c5eb5877bff3822a795

          SHA1

          f9ce47f3b85bb2471e746a57574cec0c67a14dd8

          SHA256

          d7eb892a96758751929ac31f2b0495bcf2a2d10d5fb5620bb11a16e9a4952db5

          SHA512

          ef5775b3675c974b9cc75c5338fce6b39712de0ca39d9202e1997a3fc7953d66768092779dae3512ab3fcdfcb125527fef042c24ee1f644916287d3240148132

        • C:\Users\Admin\AppData\Local\Site Free Edition\sitefreeedition.exe

          Filesize

          58KB

          MD5

          02fe0806b7c4dc48ea6195ffbeedf987

          SHA1

          abc97cc27774b764c4b8a1a541d850b91ebeec99

          SHA256

          b795ea825b068e85e4a00f2cb47c43d56bfe77f33c4999860b4e9083293631b5

          SHA512

          f306d7eb6298ea42a7d05002f96e05d1d3a4c2f9727b62f03f1fc3e1dede59385e8ffbc19b15a3c4c23276b19d5dc28710e5bab53104cab51b805f4e3ffedba9

        • C:\Users\Admin\AppData\Local\Temp\is-MUMUG.tmp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp

          Filesize

          173KB

          MD5

          f902aec117bb06062f373845d78cc15d

          SHA1

          935a4de4d11dfcc5402aeb494c2ce087f539e59d

          SHA256

          0320f1524759121fde9b6e6ba18d4640939bd1a2cbcf9a633ebfbc98c015a124

          SHA512

          b5822731c589d87e6107b0a87b57314946368de8b696d2d57bebf99f6d290582fc9a6117f185087c112be9186847eb5295798a53b5b8d3aebfa481a4247535e2

        • C:\Users\Admin\AppData\Local\Temp\is-MUMUG.tmp\835ee3b9df1576b84615cc0bf06a533e34f1ea431b2ac3d600bef751e68c34d2.tmp

          Filesize

          168KB

          MD5

          8727b59836df080f8ce131b421bd3f8e

          SHA1

          ec34e9c6710e825ef28d1150a55be425ffef86ff

          SHA256

          badd22f44bcfec3efed95ac9dc3961b1a9398d813d5ebaee4c7dfdf62fcb6db0

          SHA512

          c278dde1d15c5290a5ede757070007f9ac1f188230e238adf8edcc1d832c5d82b5bc533cf00f3d108fbb6845905a70099c1ef6802ad8252177911f0b7400d5e2

        • C:\Users\Admin\AppData\Local\Temp\is-QK07H.tmp\_isetup\_iscrypt.dll

          Filesize

          2KB

          MD5

          a69559718ab506675e907fe49deb71e9

          SHA1

          bc8f404ffdb1960b50c12ff9413c893b56f2e36f

          SHA256

          2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

          SHA512

          e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

        • memory/452-37-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/452-41-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/452-38-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/452-42-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/1432-46-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/1432-0-0x0000000000400000-0x0000000000414000-memory.dmp

          Filesize

          80KB

        • memory/2356-49-0x0000000000660000-0x0000000000661000-memory.dmp

          Filesize

          4KB

        • memory/2356-6-0x0000000000660000-0x0000000000661000-memory.dmp

          Filesize

          4KB

        • memory/2356-47-0x0000000000400000-0x00000000004B8000-memory.dmp

          Filesize

          736KB

        • memory/5056-66-0x00000000008C0000-0x0000000000962000-memory.dmp

          Filesize

          648KB

        • memory/5056-72-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-52-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-53-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-56-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-59-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-62-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-65-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-45-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-48-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-75-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-76-0x00000000008C0000-0x0000000000962000-memory.dmp

          Filesize

          648KB

        • memory/5056-79-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-82-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-85-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-88-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-92-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB

        • memory/5056-95-0x0000000000400000-0x0000000000601000-memory.dmp

          Filesize

          2.0MB