Analysis
-
max time kernel
293s -
max time network
283s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
30-05-2024 22:45
Static task
static1
Behavioral task
behavioral1
Sample
35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe
Resource
win10-20240404-en
General
-
Target
35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe
-
Size
4.9MB
-
MD5
f4b5d051aea0deaf9998e8184a1471af
-
SHA1
81bc40ffa12f61dc7159a10031c561498a33fc00
-
SHA256
35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39
-
SHA512
72dd247c94a8bb54bc1e9a7878a3876e53f412187e13faae5ae2e1d8ab8f5a86021c260272d36249c6893f00051963bc58022e2f186b1101da677e67a7d970bf
-
SSDEEP
98304:ms9tu8i+w3siN50S3jdSOQAFzQRvp/QXdABCyNttlb:vtud/3s4GUdSOQAFY4X8hTb
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2808-93-0x0000000002670000-0x0000000002712000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmpturquoisecdplayer.exeturquoisecdplayer.exepid process 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp 2432 turquoisecdplayer.exe 2808 turquoisecdplayer.exe -
Loads dropped DLL 5 IoCs
Processes:
35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmppid process 3036 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp -
Unexpected DNS network traffic destination 2 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 152.89.198.214 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmppid process 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmpdescription pid process target process PID 3036 wrote to memory of 2888 3036 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp PID 3036 wrote to memory of 2888 3036 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp PID 3036 wrote to memory of 2888 3036 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp PID 3036 wrote to memory of 2888 3036 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp PID 3036 wrote to memory of 2888 3036 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp PID 3036 wrote to memory of 2888 3036 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp PID 3036 wrote to memory of 2888 3036 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp PID 2888 wrote to memory of 2432 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp turquoisecdplayer.exe PID 2888 wrote to memory of 2432 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp turquoisecdplayer.exe PID 2888 wrote to memory of 2432 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp turquoisecdplayer.exe PID 2888 wrote to memory of 2432 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp turquoisecdplayer.exe PID 2888 wrote to memory of 2808 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp turquoisecdplayer.exe PID 2888 wrote to memory of 2808 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp turquoisecdplayer.exe PID 2888 wrote to memory of 2808 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp turquoisecdplayer.exe PID 2888 wrote to memory of 2808 2888 35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp turquoisecdplayer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe"C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Users\Admin\AppData\Local\Temp\is-JCNB0.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp"C:\Users\Admin\AppData\Local\Temp\is-JCNB0.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp" /SL5="$30156,4870623,54272,C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe"C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -i3⤵
- Executes dropped EXE
PID:2432
-
-
C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe"C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -s3⤵
- Executes dropped EXE
PID:2808
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-JCNB0.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp
Filesize680KB
MD572c363a7eba0caa099ef3e305c78f6c8
SHA1c64ad54cf6142c8415aac2fe41a88c9feded028c
SHA256f5307b1d5bdbf0371916d0ba3bf21f46c7aecf740e50889ceeb4dcd0e1e565a7
SHA512a62839a8288edc8bcbf3bb9df48a26c10139e664f14d15b0b7c6ae262d446b15ede3149b6cb092a430ae761e049c8f0a8a40e469e2bdb0c0aa0c61d5b4c73709
-
Filesize
3.1MB
MD5077b2d2eb8c61d4e1ed963ce4bc8d4f9
SHA138e4fce399b13806b7110baf6581dc43462afd3a
SHA2560e735eba0a7bc438adfff5ae72ab8a8d3bcf80473e4f13b007cbd9f991863c8a
SHA512902e9fc9137dd08a9ee82ac65a6807a463820596b1af7ec4f9f97701f998bde759f3eaa6c9f8d493cdb1ef8036278130b3a682daa1cef2b6184e9c12c07e5197