Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
152s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
25/03/2024, 12:17
Static task
static1
Behavioral task
behavioral1
Sample
ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe
Resource
win10v2004-20240226-en
General
-
Target
ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe
-
Size
6.7MB
-
MD5
1db2a35c4d921cd6bb7a2fb3e090c6d0
-
SHA1
65f0b48e931cdec3b4682781771b33a57bdcb6c3
-
SHA256
ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d
-
SHA512
ed208da1ab29ba9883a91483f92cf5a322ee2637bfb5efea0c415a7df9af342290e2d19ed08b4589a13d49d54b5f0348f011d872d5daa0607b3724e9b5d7ec85
-
SSDEEP
196608:iALDrbajVlKIMFEuvgGD4sfovnvdn3A9UvudDoiC4dD:dDqJKEGWk+lAkirdD
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral2/memory/4692-170-0x0000000000750000-0x00000000007F2000-memory.dmp family_socks5systemz behavioral2/memory/4692-171-0x0000000000750000-0x00000000007F2000-memory.dmp family_socks5systemz behavioral2/memory/4692-181-0x0000000000750000-0x00000000007F2000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 3580 dbsmartref.exe 4692 dbsmartref.exe -
Loads dropped DLL 3 IoCs
pid Process 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 91.211.247.248 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 59 IoCs
description ioc Process File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-R50O0.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-EPBS5.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File opened for modification C:\Program Files (x86)\DB Smart Refer\unins000.dat ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-9A95E.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-IP9S6.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-IE0PL.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-9AEJO.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-2UMG8.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-DB6KU.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\stuff\is-331IC.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-HB5BB.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-LJ8F2.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-PLTA4.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-Q1T9A.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\lessmsi\is-FFLLB.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-C1HH5.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-8TL2P.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-4HMIP.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-LK367.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\stuff\is-A45J8.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-6AC5E.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-8B7SV.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-SH6VV.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-9MQCV.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\plugins\internal\is-A5I6O.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File opened for modification C:\Program Files (x86)\DB Smart Refer\dbsmartref.exe ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-I77C7.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-2OTDL.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\plugins\internal\is-OETDG.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\is-VERFP.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-KPKPP.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-PE2Q5.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\unins000.dat ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\is-8V69R.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-IP3RJ.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-9V2RI.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-TC33J.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-JKVI0.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-5PM8I.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-A4EBV.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-MMQQS.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-PBPDO.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-PMFHK.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\stuff\is-M24TS.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-HGMV4.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-9KOJN.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-R0243.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-DQF2M.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-IUQHK.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-CNF76.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-M94BO.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-068P6.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-10ISG.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-20RJ3.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-10704.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-CNR3B.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-3JECN.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\bin\x86\is-4OKTA.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp File created C:\Program Files (x86)\DB Smart Refer\stuff\is-E5OL2.tmp ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp -
Runs net.exe
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 232 wrote to memory of 3520 232 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe 96 PID 232 wrote to memory of 3520 232 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe 96 PID 232 wrote to memory of 3520 232 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe 96 PID 3520 wrote to memory of 3980 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 100 PID 3520 wrote to memory of 3980 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 100 PID 3520 wrote to memory of 3980 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 100 PID 3520 wrote to memory of 3580 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 102 PID 3520 wrote to memory of 3580 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 102 PID 3520 wrote to memory of 3580 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 102 PID 3980 wrote to memory of 3788 3980 net.exe 103 PID 3980 wrote to memory of 3788 3980 net.exe 103 PID 3980 wrote to memory of 3788 3980 net.exe 103 PID 3520 wrote to memory of 4692 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 105 PID 3520 wrote to memory of 4692 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 105 PID 3520 wrote to memory of 4692 3520 ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe"C:\Users\Admin\AppData\Local\Temp\ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:232 -
C:\Users\Admin\AppData\Local\Temp\is-SRVQV.tmp\ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp"C:\Users\Admin\AppData\Local\Temp\is-SRVQV.tmp\ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp" /SL5="$801DC,6794025,328192,C:\Users\Admin\AppData\Local\Temp\ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" helpmsg 243⤵
- Suspicious use of WriteProcessMemory
PID:3980 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 helpmsg 244⤵PID:3788
-
-
-
C:\Program Files (x86)\DB Smart Refer\dbsmartref.exe"C:\Program Files (x86)\DB Smart Refer\dbsmartref.exe" -i3⤵
- Executes dropped EXE
PID:3580
-
-
C:\Program Files (x86)\DB Smart Refer\dbsmartref.exe"C:\Program Files (x86)\DB Smart Refer\dbsmartref.exe" -s3⤵
- Executes dropped EXE
PID:4692
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5164 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:884
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.7MB
MD54cb3e39998474774364ee9e0dfc9d7b3
SHA14098ff5f8545d0457822adfa35d6850117e60dc1
SHA256eab9ace81611f33c7d3eafb88252719cd99ac12c561462334489bf520f1397b5
SHA512c74f6125922a1fbfec9c67ace66ffc22bd45268913af5cecce35526868b17ef6a650654218b93bb32f4dd53dc5c37d79c39ab4eb97e4ed446d8f8e5b2e04a4ed
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
19KB
MD53adaa386b671c2df3bae5b39dc093008
SHA1067cf95fbdb922d81db58432c46930f86d23dded
SHA25671cd2f5bc6e13b8349a7c98697c6d2e3fcdeea92699cedd591875bea869fae38
SHA512bbe4187758d1a69f75a8cca6b3184e0c20cf8701b16531b55ed4987497934b3c9ef66ecd5e6b83c7357f69734f1c8301b9f82f0a024bb693b732a2d5760fd303
-
C:\Users\Admin\AppData\Local\Temp\is-SRVQV.tmp\ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp
Filesize399KB
MD55a91cbdc1ee81e4b59d5a137e45e6cae
SHA196e04ea789c3568b4e8a6b274af161dbfae7fcec
SHA256bd885664b3ca2304968255a850a4df126f0899a40b7772e2db98c53cfafb40c5
SHA512050a5a78f3d1d5dcc0d29e486ff3917eda39115b2039a60ee49fff4d2c4063772dd284954a6663385b4d11d143ca6835e0bcdbfac229b453c668a95f6e8562b7
-
C:\Users\Admin\AppData\Local\Temp\is-SRVQV.tmp\ddfdcd1867cf1462a6b507d71eb15dd91703c06f55def388c81277c406c3f76d.tmp
Filesize17KB
MD558e733d2bb75b37d7446a4c77d077def
SHA14791cf849e934c3415ccf7e4020298f3220a1c68
SHA2567a7cc20636635e974e12b75e9a0ce602065ebeee9f2f1b36f6f8f4fe2a0bef2b
SHA512b797ae4ed2669b20affb21d6bc01d542785f0ea372f924880b963eb15158e565f83dcf3a5131f44b1c65a79c4380e377323a5523b1fa2457c2858668d7eea81e