Resubmissions

22-04-2024 22:02

240422-1xtwbagh68 10

22-04-2024 19:25

240422-x42b7afa68 10

19-04-2024 03:02

240419-djmthsfh8w 10

Analysis

  • max time kernel
    1792s
  • max time network
    1782s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240412-en
  • resource tags

    arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    22-04-2024 19:25

General

  • Target

    320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe

  • Size

    2.0MB

  • MD5

    7c75ba2571e91dca0ebb1319aa20da5f

  • SHA1

    ccef5b75906891ca1e3870ee25b04b1217fab8d7

  • SHA256

    320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d

  • SHA512

    88231259a4f6ad9502c6ade78d8c6c6f53653b6c122894c1217fe67baf2c880522ffd855c4f5478a0b104f4ef3d00ee39cf209abb749f9ea40026179dab37a4c

  • SSDEEP

    49152:32lHrEP4oHhGa6yGE4jz7WCp4VpO5STuxDNtS9W1Cf:mlLoHhzxGEGX2DWBxD/S9nf

Malware Config

Extracted

Family

socks5systemz

C2

http://erzwnet.ua/search/?q=67e28dd8395df37a1507f81b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffc19c1eb9c9e3f

http://erzwnet.ua/search/?q=67e28dd8395df37a1507f81b7c27d78406abdd88be4b12eab517aa5c96bd86ec908e44885a8bbc896c58e713bc90c91936b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee96923ac9669212

Signatures

  • Detect Socks5Systemz Payload 5 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe
    "C:\Users\Admin\AppData\Local\Temp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:440
    • C:\Users\Admin\AppData\Local\Temp\is-8OLLF.tmp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8OLLF.tmp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp" /SL5="$A0064,1725873,54272,C:\Users\Admin\AppData\Local\Temp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1016
      • C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe
        "C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -i
        3⤵
        • Executes dropped EXE
        PID:4488
      • C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe
        "C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -s
        3⤵
        • Executes dropped EXE
        PID:4520

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe

    Filesize

    2.1MB

    MD5

    aa46c30ea175016297fd9c134db7c69e

    SHA1

    1512b9287dfe11f525c305ed76e1b70fec06ece3

    SHA256

    58ea457a93b5638ece48151ab1d7dac75bf15ba3be90b27fe2b0d1eb489e4854

    SHA512

    5afd62eab0f4f89d8865d3dbdc03999c99386fe35259a0116f2e451f4879cbf49ad0f74b0a3b558dcefdcf4cf18178626bc872847af3843cb731f26168911f58

  • C:\Users\Admin\AppData\Local\Temp\is-8OLLF.tmp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp

    Filesize

    677KB

    MD5

    2d1bfe3d315b8ea8191a690428416698

    SHA1

    8150716622169b6945e1420649716dc70fce50c7

    SHA256

    9b13f7be0e6d0cdf794650a7caaf1b516f2748d3d05a351a5f366210fcff8048

    SHA512

    8963da6dfa9a7fbb146c323e0fb993a618b0a57254c71c7e4a5257d7c4335dde90ee4d31c1b6f38c1b62eb22c2bf8595b1e48132686787584b2d1269c2ae44c8

  • C:\Users\Admin\AppData\Local\Temp\is-LFI0M.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • memory/440-2-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/440-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/440-48-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1016-49-0x0000000000400000-0x00000000004B8000-memory.dmp

    Filesize

    736KB

  • memory/1016-7-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/1016-51-0x0000000000650000-0x0000000000651000-memory.dmp

    Filesize

    4KB

  • memory/4488-38-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4488-42-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4488-39-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-61-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-79-0x0000000000990000-0x0000000000A32000-memory.dmp

    Filesize

    648KB

  • memory/4520-47-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-53-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-55-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-58-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-46-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-64-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-66-0x0000000000990000-0x0000000000A32000-memory.dmp

    Filesize

    648KB

  • memory/4520-69-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-70-0x0000000000990000-0x0000000000A32000-memory.dmp

    Filesize

    648KB

  • memory/4520-75-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-78-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-50-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-82-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-85-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-88-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-91-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-92-0x0000000000990000-0x0000000000A32000-memory.dmp

    Filesize

    648KB

  • memory/4520-93-0x0000000000990000-0x0000000000A32000-memory.dmp

    Filesize

    648KB

  • memory/4520-97-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-100-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-103-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-106-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-109-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB

  • memory/4520-112-0x0000000000400000-0x0000000000615000-memory.dmp

    Filesize

    2.1MB