Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
-
submitted
21-05-2024 16:25
General
-
Target
13b637c127d365e67fb447ceb361e7b799319e20a2e31bc9daa09e9bc6039377.exe
-
Size
5.3MB
-
MD5
245262777cd555a8ab6042f5152e02c8
-
SHA1
61907ae5e7195d4848a589ae183e181969589fcf
-
SHA256
13b637c127d365e67fb447ceb361e7b799319e20a2e31bc9daa09e9bc6039377
-
SHA512
86392902336202f302b92bf0ddfb8459085676b572ee93a62eba9b1ba4e67df48ec5668cf30391fb7ebfc1cb80298de081f13a84a6e10c4f35b1cd05d3b0e817
-
SSDEEP
98304:mYiIk+DoDY9AbbrvPAIxD8JruGP39i/7krYLhG+cUDcuw9o0pq30Fy2:v5LGZr3x3GPNicK/cUTw9xpqkFy2
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
-
Loads dropped DLL 3 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\13b637c127d365e67fb447ceb361e7b799319e20a2e31bc9daa09e9bc6039377.exe"C:\Users\Admin\AppData\Local\Temp\13b637c127d365e67fb447ceb361e7b799319e20a2e31bc9daa09e9bc6039377.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-AD01Q.tmp\13b637c127d365e67fb447ceb361e7b799319e20a2e31bc9daa09e9bc6039377.tmp"C:\Users\Admin\AppData\Local\Temp\is-AD01Q.tmp\13b637c127d365e67fb447ceb361e7b799319e20a2e31bc9daa09e9bc6039377.tmp" /SL5="$40214,5252084,54272,C:\Users\Admin\AppData\Local\Temp\13b637c127d365e67fb447ceb361e7b799319e20a2e31bc9daa09e9bc6039377.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\MaxPad\maxpad32.exe"C:\Users\Admin\AppData\Local\MaxPad\maxpad32.exe" -i3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\MaxPad\maxpad32.exe"C:\Users\Admin\AppData\Local\MaxPad\maxpad32.exe" -s3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.3MB
MD516ec6a4c44717d2b310feba95516b0a1
SHA1bdd109d5b50965c33d51a442adcc532da9dae925
SHA25676dbaeb0db85d38e15b0982a3e0413c9ddefd6264743b8e968eb727a89fcd8ed
SHA512e3f8ca8632cb1a98763cb56bf32a4aba4e47d20585eabc01f71323a679f69f35cde151ec4ab818032c1809c4969eb0dbce55fbfc17dd4551a51c35f9e3ace7f5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
Filesize
680KB
MD53c22f4ba1a54bd7c893cda0d06a453a0
SHA1a7e446f9a63c244326ce97be963e07fe2937c456
SHA256c6bc0aff8501f57e2a6c1e3b297a39a4949cf52f7a167f804145745dbeb63f8c
SHA512387c8babf5557569dab2830332f2bf961477a1aa6e918600f94d02fa2c37ae79000b02cf16eaa073288f42fec8378043f1d3163159d36f82ccc319468a56e21f
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
648KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
744KB
-
Filesize
744KB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB
-
Filesize
2.3MB