Analysis
-
max time kernel
296s -
max time network
301s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
30-05-2024 22:42
Static task
static1
Behavioral task
behavioral1
Sample
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe
Resource
win10-20240404-en
General
-
Target
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe
-
Size
5.2MB
-
MD5
bcaf00e45da5ce8c107e3ba7c03c2d1b
-
SHA1
8cbd6097725e59668f7b9705d3c11666ca295619
-
SHA256
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028
-
SHA512
5f5a7626d8ce57a644a534f1cf19af814fb8aef96d9d87c1d8fd58954921ff6142f992abf0d7069451a117f139c89ba9fe93e26db0412eaa7e740baff62e3965
-
SSDEEP
98304:maTF6ZNDcnTcBRTNg8UhAgNXUJslK18312VK4eRcjLOWTeR4ZDzJoO:7UZNDcTcXTNg8+EiU18312CcjbymZDWO
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/236-89-0x0000000000960000-0x0000000000A02000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmpfgaudioconverter.exefgaudioconverter.exepid process 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp 4360 fgaudioconverter.exe 236 fgaudioconverter.exe -
Loads dropped DLL 3 IoCs
Processes:
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmppid process 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.211.247.248 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmppid process 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmpdescription pid process target process PID 1428 wrote to memory of 2796 1428 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 1428 wrote to memory of 2796 1428 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 1428 wrote to memory of 2796 1428 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp PID 2796 wrote to memory of 4360 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 2796 wrote to memory of 4360 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 2796 wrote to memory of 4360 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 2796 wrote to memory of 236 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 2796 wrote to memory of 236 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe PID 2796 wrote to memory of 236 2796 2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp fgaudioconverter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe"C:\Users\Admin\AppData\Local\Temp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1428 -
C:\Users\Admin\AppData\Local\Temp\is-5BART.tmp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp"C:\Users\Admin\AppData\Local\Temp\is-5BART.tmp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp" /SL5="$801FC,5198955,54272,C:\Users\Admin\AppData\Local\Temp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Users\Admin\AppData\Local\FGaudioConverter\fgaudioconverter.exe"C:\Users\Admin\AppData\Local\FGaudioConverter\fgaudioconverter.exe" -i3⤵
- Executes dropped EXE
PID:4360
-
-
C:\Users\Admin\AppData\Local\FGaudioConverter\fgaudioconverter.exe"C:\Users\Admin\AppData\Local\FGaudioConverter\fgaudioconverter.exe" -s3⤵
- Executes dropped EXE
PID:236
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5f00f6f0a718899b137b2358b1eff047d
SHA115abd856b6d3f4f86efe114f1a08bd8031df644f
SHA25699920c80b838de911c052c137e3114bc692630ae93c083ab9ee95e5df645b45c
SHA512a62b2fbfa0bc374b2e09be498a56cd005012097d307ca64ea9fd4ed909dbd773a00b0eba4125041f84fa043b7cecd95c245c9a4df6469d78f2a8c7bb83144c54
-
C:\Users\Admin\AppData\Local\Temp\is-5BART.tmp\2a173d2d67ed59e4cbe866521194379b951aa81cefa2001de4b8d0b123cb9028.tmp
Filesize680KB
MD55ef939251fce500d0beee76878ed49ad
SHA19f0f5ee03030f94ec1448d720bc373535d4b67be
SHA256139eaafd7a7370ef918bac28b50f0648cc5aad063f66183dd16e65600cc5d425
SHA512a9b8e6e873f6f24375815f959c330be40652c56593cb1a52532ef0447dfaf82f7751fc4f1a4c3f5af88eb688e85e6058e967f5b77276fbcc5877955efffd768d
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
32KB
MD5b6f11a0ab7715f570f45900a1fe84732
SHA177b1201e535445af5ea94c1b03c0a1c34d67a77b
SHA256e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67
SHA51278a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771