Overview
overview
10Static
static
10068428a4ac...26.exe
windows11-21h2-x64
80c4791a6b4...ea.elf
windows11-21h2-x64
30d9bd2ae2e...ea.exe
windows11-21h2-x64
70fa00d4f4f...70.dll
windows11-21h2-x64
110de02fec8...d1.bat
windows11-21h2-x64
81157191701...32.exe
windows11-21h2-x64
716e81343ec...a5.exe
windows11-21h2-x64
717691f0962...b7.elf
windows11-21h2-x64
317c24104e8...12.exe
windows11-21h2-x64
31816cd993d...28.exe
windows11-21h2-x64
71b8cda768b...8a.elf
windows11-21h2-x64
31df6acbc11...b7.elf
windows11-21h2-x64
31e7706ed04...b0.elf
windows11-21h2-x64
31f580428fa...2c.elf
windows11-21h2-x64
3257fc477b9...cc.elf
windows11-21h2-x64
3262a10ee37...50.elf
windows11-21h2-x64
3267909cf4a...e7.bat
windows11-21h2-x64
102796760675...13.elf
windows11-21h2-x64
327e181c699...8c.elf
windows11-21h2-x64
32b4b073178...74.elf
windows11-21h2-x64
32b5bf75c0a...35.exe
windows11-21h2-x64
72bac99f5be...ec.elf
windows11-21h2-x64
32cfeefaa13...50.elf
windows11-21h2-x64
32e48ee0fb3...66.exe
windows11-21h2-x64
102e4d872360...5b.exe
windows11-21h2-x64
1031b6a60839...1b.exe
windows11-21h2-x64
3320ccae2e9...0d.exe
windows11-21h2-x64
103476006a8f...16.apk
windows11-21h2-x64
33545082c16...2e.elf
windows11-21h2-x64
3377c3c3679...05.elf
windows11-21h2-x64
33c40413f93...f5.exe
windows11-21h2-x64
10cbe27936a3...8b.iso
windows11-21h2-x64
3Resubmissions
22-04-2024 22:02
240422-1xtwbagh68 1022-04-2024 19:25
240422-x42b7afa68 1019-04-2024 03:02
240419-djmthsfh8w 10Analysis
-
max time kernel
1792s -
max time network
1782s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
22-04-2024 19:25
Static task
static1
Behavioral task
behavioral1
Sample
068428a4acb65807251b3b4c0aee2101519fdaebf6db5376863da5add3471f26.exe
Resource
win11-20240412-en
Behavioral task
behavioral2
Sample
0c4791a6b47491a0c43cea0ba54357e391a3c8b23aa28025489bbe43bb9ea6ea.elf
Resource
win11-20240412-en
Behavioral task
behavioral3
Sample
0d9bd2ae2e4b023047b6c08684e9e5daae76e31cced4c3fdf4640136245f7eea.exe
Resource
win11-20240412-en
Behavioral task
behavioral4
Sample
0fa00d4f4f8e8449883aef7f0459a0fb754d57d55af2b41f5e445f867000fa70.dll
Resource
win11-20240412-en
Behavioral task
behavioral5
Sample
10de02fec8ac3edbf1398e6dd43ddec95a89e0499e1e865a7d9e5289fb2b31d1.bat
Resource
win11-20240412-en
Behavioral task
behavioral6
Sample
11571917015adbf3b5196509e1082c8d415f011cce88bd8b16e9d9c5a39ac432.exe
Resource
win11-20240412-en
Behavioral task
behavioral7
Sample
16e81343ecea6082d76bf1ab26818c3bf56929c92468fae8837c6384b62d05a5.exe
Resource
win11-20240412-en
Behavioral task
behavioral8
Sample
17691f0962027e7110f727ae997f8af5885dd783674d1db023d467ec478515b7.elf
Resource
win11-20240412-en
Behavioral task
behavioral9
Sample
17c24104e8e5350eeb7e2a162dec3f6a4d6c70f3f0849e6346fd383d998dcc12.exe
Resource
win11-20240412-en
Behavioral task
behavioral10
Sample
1816cd993ddda970b791b090e6ecb501ef923bdcc0cc5f4a99e18dcdb7093228.exe
Resource
win11-20240412-en
Behavioral task
behavioral11
Sample
1b8cda768ba75d723b2b0b34cf955f7ec9469b4e33c6fde6494eefd60a139d8a.elf
Resource
win11-20240412-en
Behavioral task
behavioral12
Sample
1df6acbc1106e17265fde3ab54b2a83fa8f6f39656d7c55481b2dbd66f1114b7.elf
Resource
win11-20240412-en
Behavioral task
behavioral13
Sample
1e7706ed0492572474cd866f13778cc66c42b614b3d0b1d9af35727c051a50b0.elf
Resource
win11-20240412-en
Behavioral task
behavioral14
Sample
1f580428fa8afd15832fcd04f5d6832be9f7a7144ff17e19c89d2b07e7f51f2c.elf
Resource
win11-20240412-en
Behavioral task
behavioral15
Sample
257fc477b9684863e0822cbad3606d76c039be8dd51cdc13b73e74e93d7b04cc.elf
Resource
win11-20240412-en
Behavioral task
behavioral16
Sample
262a10ee377a4945ce30e115e2ab1bf9ff2fc0f35741bbb72e40f145de24bd50.elf
Resource
win11-20240412-en
Behavioral task
behavioral17
Sample
267909cf4a62955a35b0fe013afbfd62d7ae1a1eef6d7a24d7ce50db52d48ce7.bat
Resource
win11-20240412-en
Behavioral task
behavioral18
Sample
2796760675e5efbef0319f0285c2e1d07c11b038311c02e16c2407ba57c38413.elf
Resource
win11-20240412-en
Behavioral task
behavioral19
Sample
27e181c699f14c3e53cabc89941ac40917165cc4be34d2c7f9d6eca0e16b508c.elf
Resource
win11-20240412-en
Behavioral task
behavioral20
Sample
2b4b073178b573aa181fdc6e8063c778c90f76235d640c186b99278186509e74.elf
Resource
win11-20240412-en
Behavioral task
behavioral21
Sample
2b5bf75c0aede1169e7aa2b4c760b1852f34990d5b8ce27ca2fa21efa35e0635.exe
Resource
win11-20240412-en
Behavioral task
behavioral22
Sample
2bac99f5be34b649749a4ce8ab7c8103f9dce863cbc490f273c27297b2c465ec.elf
Resource
win11-20240412-en
Behavioral task
behavioral23
Sample
2cfeefaa133519defee56f4253c7c7f2396d784ed8e09d2212ab5bee6cf52b50.elf
Resource
win11-20240412-en
Behavioral task
behavioral24
Sample
2e48ee0fb3ddd63efeecd900a9d2bde365e2fe1fcbb3c43c882362ae935c5066.exe
Resource
win11-20240412-en
Behavioral task
behavioral25
Sample
2e4d8723602c5ffc6409dceb0cb4ced2e749e374a0fcd41fe92e0fd50f817c5b.exe
Resource
win11-20240412-en
Behavioral task
behavioral26
Sample
31b6a608393ad6cadd7eadf286795aef37260c9b99e837f1d7a1aa4e9a7f901b.exe
Resource
win11-20240412-en
Behavioral task
behavioral27
Sample
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe
Resource
win11-20240412-en
Behavioral task
behavioral28
Sample
3476006a8f64bfe72a8b04477f6005293b5854cfbc58bee2ea28e59b58f0e316.apk
Resource
win11-20240412-en
Behavioral task
behavioral29
Sample
3545082c16d0e05faad342c614b27793ab0ec940a174ab5162dce1787ea8472e.elf
Resource
win11-20240412-en
Behavioral task
behavioral30
Sample
377c3c3679e44acbc13388ca7ec69f2346b321aa42110fc6ee44a44c54d67105.elf
Resource
win11-20240412-en
Behavioral task
behavioral31
Sample
3c40413f9340d25dc7f2c4358583706b1eb19962cb74669bf8276597e871faf5.exe
Resource
win11-20240412-en
Behavioral task
behavioral32
Sample
cbe27936a3beb1902517906f7da1d6d3f6ef8d1a0eda5e033f4da436df7cd88b.iso
Resource
win11-20240412-en
General
-
Target
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe
-
Size
2.0MB
-
MD5
7c75ba2571e91dca0ebb1319aa20da5f
-
SHA1
ccef5b75906891ca1e3870ee25b04b1217fab8d7
-
SHA256
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d
-
SHA512
88231259a4f6ad9502c6ade78d8c6c6f53653b6c122894c1217fe67baf2c880522ffd855c4f5478a0b104f4ef3d00ee39cf209abb749f9ea40026179dab37a4c
-
SSDEEP
49152:32lHrEP4oHhGa6yGE4jz7WCp4VpO5STuxDNtS9W1Cf:mlLoHhzxGEGX2DWBxD/S9nf
Malware Config
Extracted
socks5systemz
http://erzwnet.ua/search/?q=67e28dd8395df37a1507f81b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffc19c1eb9c9e3f
http://erzwnet.ua/search/?q=67e28dd8395df37a1507f81b7c27d78406abdd88be4b12eab517aa5c96bd86ec908e44885a8bbc896c58e713bc90c91936b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee96923ac9669212
Signatures
-
Detect Socks5Systemz Payload 5 IoCs
Processes:
resource yara_rule behavioral27/memory/4520-66-0x0000000000990000-0x0000000000A32000-memory.dmp family_socks5systemz behavioral27/memory/4520-70-0x0000000000990000-0x0000000000A32000-memory.dmp family_socks5systemz behavioral27/memory/4520-79-0x0000000000990000-0x0000000000A32000-memory.dmp family_socks5systemz behavioral27/memory/4520-92-0x0000000000990000-0x0000000000A32000-memory.dmp family_socks5systemz behavioral27/memory/4520-93-0x0000000000990000-0x0000000000A32000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmpfsound32.exefsound32.exepid process 1016 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp 4488 fsound32.exe 4520 fsound32.exe -
Loads dropped DLL 1 IoCs
Processes:
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmppid process 1016 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.211.247.248 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmpdescription pid process target process PID 440 wrote to memory of 1016 440 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp PID 440 wrote to memory of 1016 440 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp PID 440 wrote to memory of 1016 440 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp PID 1016 wrote to memory of 4488 1016 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp fsound32.exe PID 1016 wrote to memory of 4488 1016 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp fsound32.exe PID 1016 wrote to memory of 4488 1016 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp fsound32.exe PID 1016 wrote to memory of 4520 1016 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp fsound32.exe PID 1016 wrote to memory of 4520 1016 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp fsound32.exe PID 1016 wrote to memory of 4520 1016 320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp fsound32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe"C:\Users\Admin\AppData\Local\Temp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Users\Admin\AppData\Local\Temp\is-8OLLF.tmp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp"C:\Users\Admin\AppData\Local\Temp\is-8OLLF.tmp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp" /SL5="$A0064,1725873,54272,C:\Users\Admin\AppData\Local\Temp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1016 -
C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe"C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -i3⤵
- Executes dropped EXE
PID:4488
-
-
C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe"C:\Users\Admin\AppData\Local\Focus Sound\fsound32.exe" -s3⤵
- Executes dropped EXE
PID:4520
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD5aa46c30ea175016297fd9c134db7c69e
SHA11512b9287dfe11f525c305ed76e1b70fec06ece3
SHA25658ea457a93b5638ece48151ab1d7dac75bf15ba3be90b27fe2b0d1eb489e4854
SHA5125afd62eab0f4f89d8865d3dbdc03999c99386fe35259a0116f2e451f4879cbf49ad0f74b0a3b558dcefdcf4cf18178626bc872847af3843cb731f26168911f58
-
C:\Users\Admin\AppData\Local\Temp\is-8OLLF.tmp\320ccae2e9ae546c56193c24cb12cc54f29a872c08856cc143294dd2cf8a170d.tmp
Filesize677KB
MD52d1bfe3d315b8ea8191a690428416698
SHA18150716622169b6945e1420649716dc70fce50c7
SHA2569b13f7be0e6d0cdf794650a7caaf1b516f2748d3d05a351a5f366210fcff8048
SHA5128963da6dfa9a7fbb146c323e0fb993a618b0a57254c71c7e4a5257d7c4335dde90ee4d31c1b6f38c1b62eb22c2bf8595b1e48132686787584b2d1269c2ae44c8
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63