Analysis

  • max time kernel
    142s
  • max time network
    133s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    19-04-2024 07:17

General

  • Target

    3242de97969e4b2826659a84e3c2b8be771ab96e7881d6574da016159f58494a.exe

  • Size

    3.8MB

  • MD5

    89232588779cca7da57df81d46458e64

  • SHA1

    106a9a4a84cb422023e9ebce0c055c92ed36db1c

  • SHA256

    3242de97969e4b2826659a84e3c2b8be771ab96e7881d6574da016159f58494a

  • SHA512

    16fa01b529450533b88d73b3d76c2a3c21f500e66ab445ca5a76e8fbb20a14979ccf181ebea240d6d89c54f76934344a6f05ab5e75ff86d6be8ff294ab4583da

  • SSDEEP

    98304:7amjv3FMzNsloeiVpQwL/W4etOvM+2XZAoFvbjnQm8vtev9AE:TN+Nsment+p2PDjQPlC9z

Malware Config

Extracted

Family

socks5systemz

C2

http://bubzozu.com/search/?q=67e28dd8395df37a1507f81b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978ff71ea771795af8e05c644db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffc14c1ee94993d

http://bubzozu.com/search/?q=67e28dd8395df37a1507f81b7c27d78406abdd88be4b12eab517aa5c96bd86eb978144835a8bbc896c58e713bc90c91936b5281fc235a925ed3e5cd6bd974a95129070b617e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee969f3acc6e9510

Signatures

  • Detect Socks5Systemz Payload 5 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3242de97969e4b2826659a84e3c2b8be771ab96e7881d6574da016159f58494a.exe
    "C:\Users\Admin\AppData\Local\Temp\3242de97969e4b2826659a84e3c2b8be771ab96e7881d6574da016159f58494a.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2204
    • C:\Users\Admin\AppData\Local\Temp\is-THGG7.tmp\is-BGDLV.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-THGG7.tmp\is-BGDLV.tmp" /SL4 $40230 "C:\Users\Admin\AppData\Local\Temp\3242de97969e4b2826659a84e3c2b8be771ab96e7881d6574da016159f58494a.exe" 3675463 52224
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:5372
      • C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe
        "C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe" -i
        3⤵
        • Executes dropped EXE
        PID:2248
      • C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe
        "C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe" -s
        3⤵
        • Executes dropped EXE
        PID:3364

Network

MITRE ATT&CK Matrix ATT&CK v13

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe
    Filesize

    3.8MB

    MD5

    6e326254a53217de937ac9a4b0eed097

    SHA1

    55327dcd1821140aae9e05b2c370bdda841f3d15

    SHA256

    8216168ffe2d1d220186328677604bdec3f8d2ec70f5b1a1e1340700976b0803

    SHA512

    5c3467db72e198a8a5480374bbf9b9a54b563dc6ed579fc4fcfdca4991c5ec2427e5d26505dd31071b5c008cad190eb5af27481f87e00c5d25e7fe4f29833d3e

  • C:\Users\Admin\AppData\Local\Temp\is-R24NK.tmp\_isetup\_iscrypt.dll
    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • C:\Users\Admin\AppData\Local\Temp\is-R24NK.tmp\_isetup\_isdecmp.dll
    Filesize

    13KB

    MD5

    a813d18268affd4763dde940246dc7e5

    SHA1

    c7366e1fd925c17cc6068001bd38eaef5b42852f

    SHA256

    e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

    SHA512

    b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

  • C:\Users\Admin\AppData\Local\Temp\is-THGG7.tmp\is-BGDLV.tmp
    Filesize

    648KB

    MD5

    7c8240e466c74b0e0c80bfbccb9f3c39

    SHA1

    43a580359f41e067aa77d153532d0073cc17c4db

    SHA256

    63295dcd59e424cdf29a4bc5500054f24317a349af48f970fe14ab85439a1a4d

    SHA512

    3c956b8f7c881873356abf62eed5e04ee9ae84a54ad0f9cc497eb05ba0a35f8ed32e03b54e7fb47293b2f83201822b5d866f1258db5e36336b650bb3584b2283

  • memory/2204-51-0x0000000000400000-0x0000000000413000-memory.dmp
    Filesize

    76KB

  • memory/2204-2-0x0000000000400000-0x0000000000413000-memory.dmp
    Filesize

    76KB

  • memory/2204-0-0x0000000000400000-0x0000000000413000-memory.dmp
    Filesize

    76KB

  • memory/2248-43-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/2248-44-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/2248-47-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/2248-55-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-58-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-72-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-53-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-104-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-50-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-101-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-59-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-62-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-65-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-68-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-71-0x0000000000BC0000-0x0000000000C62000-memory.dmp
    Filesize

    648KB

  • memory/3364-97-0x0000000000BC0000-0x0000000000C62000-memory.dmp
    Filesize

    648KB

  • memory/3364-73-0x0000000000BC0000-0x0000000000C62000-memory.dmp
    Filesize

    648KB

  • memory/3364-79-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-82-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-83-0x0000000000BC0000-0x0000000000C62000-memory.dmp
    Filesize

    648KB

  • memory/3364-86-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-89-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-92-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-95-0x0000000000400000-0x00000000007D2000-memory.dmp
    Filesize

    3.8MB

  • memory/3364-96-0x0000000000BC0000-0x0000000000C62000-memory.dmp
    Filesize

    648KB

  • memory/5372-52-0x0000000000400000-0x00000000004B1000-memory.dmp
    Filesize

    708KB

  • memory/5372-7-0x0000000002450000-0x0000000002451000-memory.dmp
    Filesize

    4KB

  • memory/5372-54-0x0000000002450000-0x0000000002451000-memory.dmp
    Filesize

    4KB