Analysis
-
max time kernel
293s -
max time network
284s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 22:42
Static task
static1
Behavioral task
behavioral1
Sample
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe
Resource
win10-20240404-en
General
-
Target
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe
-
Size
5.2MB
-
MD5
bcaf00e45da5ce8c107e3ba7c03c2d1b
-
SHA1
8cbd6097725e59668f7b9705d3c11666ca295619
-
SHA256
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028
-
SHA512
5f5a7626d8ce57a644a534f1cf19af814fb8aef96d9d87c1d8fd58954921ff6142f992abf0d7069451a117f139c89ba9fe93e26db0412eaa7e740baff62e3965
-
SSDEEP
98304:maTF6ZNDcnTcBRTNg8UhAgNXUJslK18312VK4eRcjLOWTeR4ZDzJoO:7UZNDcTcXTNg8+EiU18312CcjbymZDWO
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2460-96-0x0000000002230000-0x00000000022D2000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmpfgaudioconverter.exefgaudioconverter.exepid process 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp 2720 fgaudioconverter.exe 2460 fgaudioconverter.exe -
Loads dropped DLL 6 IoCs
Processes:
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmppid process 2216 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 141.98.234.31 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmppid process 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmpdescription pid process target process PID 2216 wrote to memory of 784 2216 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 2216 wrote to memory of 784 2216 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 2216 wrote to memory of 784 2216 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 2216 wrote to memory of 784 2216 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 2216 wrote to memory of 784 2216 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 2216 wrote to memory of 784 2216 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 2216 wrote to memory of 784 2216 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 784 wrote to memory of 2720 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 784 wrote to memory of 2720 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 784 wrote to memory of 2720 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 784 wrote to memory of 2720 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 784 wrote to memory of 2460 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 784 wrote to memory of 2460 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 784 wrote to memory of 2460 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 784 wrote to memory of 2460 784 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe"C:\Users\Admin\AppData\Local\Temp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\is-PEGNT.tmp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp"C:\Users\Admin\AppData\Local\Temp\is-PEGNT.tmp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp" /SL5="$4001C,5198955,54272,C:\Users\Admin\AppData\Local\Temp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:784 -
C:\Users\Admin\AppData\Local\FGaudioConverter\fgaudioconverter.exe"C:\Users\Admin\AppData\Local\FGaudioConverter\fgaudioconverter.exe" -i3⤵
- Executes dropped EXE
PID:2720
-
-
C:\Users\Admin\AppData\Local\FGaudioConverter\fgaudioconverter.exe"C:\Users\Admin\AppData\Local\FGaudioConverter\fgaudioconverter.exe" -s3⤵
- Executes dropped EXE
PID:2460
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5f00f6f0a718899b137b2358b1eff047d
SHA115abd856b6d3f4f86efe114f1a08bd8031df644f
SHA25699920c80b838de911c052c137e3114bc692630ae93c083ab9ee95e5df645b45c
SHA512a62b2fbfa0bc374b2e09be498a56cd005012097d307ca64ea9fd4ed909dbd773a00b0eba4125041f84fa043b7cecd95c245c9a4df6469d78f2a8c7bb83144c54
-
\Users\Admin\AppData\Local\Temp\is-PEGNT.tmp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp
Filesize680KB
MD55ef939251fce500d0beee76878ed49ad
SHA19f0f5ee03030f94ec1448d720bc373535d4b67be
SHA256139eaafd7a7370ef918bac28b50f0648cc5aad063f66183dd16e65600cc5d425
SHA512a9b8e6e873f6f24375815f959c330be40652c56593cb1a52532ef0447dfaf82f7751fc4f1a4c3f5af88eb688e85e6058e967f5b77276fbcc5877955efffd768d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
32KB
MD5b6f11a0ab7715f570f45900a1fe84732
SHA177b1201e535445af5ea94c1b03c0a1c34d67a77b
SHA256e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67
SHA51278a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3