Analysis
-
max time kernel
292s -
max time network
253s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
04-05-2024 22:48
Static task
static1
Behavioral task
behavioral1
Sample
f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe
Resource
win10-20240404-en
General
-
Target
f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe
-
Size
4.8MB
-
MD5
1d7d3477c7968ecc9e9bbe0f0bf9acff
-
SHA1
d4fcda77873baeef4b870dde9fa74cf49a6fb833
-
SHA256
f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1
-
SHA512
e7c90163aca05a530f982c002fbac1ca2da126b8aea2177fcec303952ad06b681fde5899945d40f5e54d7df14a2aafd4a045d256328c71bb46cb6966ce71f14b
-
SSDEEP
98304:+pmDGs/wmVFG+IoW2GZbyDCyxaSBUdPOJ8CYVSPsaNZC3FtlAd1Zcs:i0LRGxynaS1LY6TNSKXcs
Malware Config
Extracted
socks5systemz
http://erloskp.ua/search/?q=67e28dd86554fa2a495aa4197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a071ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6386f913c9e895
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
resource yara_rule behavioral1/memory/2944-97-0x00000000023C0000-0x0000000002462000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 2456 jenimmusicconverter.exe 2944 jenimmusicconverter.exe -
Loads dropped DLL 6 IoCs
pid Process 2092 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2804 2092 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe 28 PID 2092 wrote to memory of 2804 2092 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe 28 PID 2092 wrote to memory of 2804 2092 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe 28 PID 2092 wrote to memory of 2804 2092 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe 28 PID 2092 wrote to memory of 2804 2092 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe 28 PID 2092 wrote to memory of 2804 2092 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe 28 PID 2092 wrote to memory of 2804 2092 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe 28 PID 2804 wrote to memory of 2456 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 29 PID 2804 wrote to memory of 2456 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 29 PID 2804 wrote to memory of 2456 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 29 PID 2804 wrote to memory of 2456 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 29 PID 2804 wrote to memory of 2944 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 30 PID 2804 wrote to memory of 2944 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 30 PID 2804 wrote to memory of 2944 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 30 PID 2804 wrote to memory of 2944 2804 f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe"C:\Users\Admin\AppData\Local\Temp\f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Users\Admin\AppData\Local\Temp\is-FORGS.tmp\f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp"C:\Users\Admin\AppData\Local\Temp\is-FORGS.tmp\f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp" /SL5="$400F4,4784545,54272,C:\Users\Admin\AppData\Local\Temp\f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2804 -
C:\Users\Admin\AppData\Local\Jenim Music Converter\jenimmusicconverter.exe"C:\Users\Admin\AppData\Local\Jenim Music Converter\jenimmusicconverter.exe" -i3⤵
- Executes dropped EXE
PID:2456
-
-
C:\Users\Admin\AppData\Local\Jenim Music Converter\jenimmusicconverter.exe"C:\Users\Admin\AppData\Local\Jenim Music Converter\jenimmusicconverter.exe" -s3⤵
- Executes dropped EXE
PID:2944
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.0MB
MD51176a2fcbc3cfb77207db7575dd6a522
SHA1e0a854c77a65e542712c9fe3feae2331fcddb7f4
SHA256553200e21658e7976d496c52cc1aeb50446b877ccda4f0b073a553ec3fb48560
SHA512bb00340e4931342c4db499d68e98542f401a985c062810225ee661a7a289a885dab8c64f37fb231212ad2a5d703f3fd0528e8402fc1033cf4128d075714e3f34
-
Filesize
1.7MB
MD5391e900afebd2e25bacaff7b5b65b469
SHA1d98cac1c105fbaf4cbf1291082816ffefd9ee825
SHA256e15288b4c1b02ee97302f126470f1466f3d8bab3927e5961acf424f28eb003cc
SHA512b86771a466405ecf65e037197cebd77b5c441b89d2c7f0f955a1dfab12d4c4bd2efc63d1d71a72849b4e852271df702821265dbef91719eacea050f93967a1ce
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
32KB
MD5b6f11a0ab7715f570f45900a1fe84732
SHA177b1201e535445af5ea94c1b03c0a1c34d67a77b
SHA256e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67
SHA51278a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-FORGS.tmp\f638a2ac9768a9b9820a0953cd4fef41b58b8c0545fddd0b2a634b5fd1f6e6a1.tmp
Filesize695KB
MD5c20681cc4555e94fa86e37fd93665ee3
SHA11b10057bf7788b5af83f9cc96065fffcc214423e
SHA25696f0e6fdfee29ad7897c969a579a6ffea353ef558bb1d9cb7ca941eb2c71ab03
SHA51288895e93665098f00ec4f8c0a44a6b8d4c0209f80b508a2944a77ca54722ec05440d825202af246344d7e1942b8ccef63dfc7db36bbbbce49a52d1f85d126c5f