Analysis

  • max time kernel
    293s
  • max time network
    283s
  • platform
    windows7_x64
  • resource
    win7-20240220-en
  • resource tags

    arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system
  • submitted
    30-05-2024 22:45

General

  • Target

    35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe

  • Size

    4.9MB

  • MD5

    f4b5d051aea0deaf9998e8184a1471af

  • SHA1

    81bc40ffa12f61dc7159a10031c561498a33fc00

  • SHA256

    35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39

  • SHA512

    72dd247c94a8bb54bc1e9a7878a3876e53f412187e13faae5ae2e1d8ab8f5a86021c260272d36249c6893f00051963bc58022e2f186b1101da677e67a7d970bf

  • SSDEEP

    98304:ms9tu8i+w3siN50S3jdSOQAFzQRvp/QXdABCyNttlb:vtud/3s4GUdSOQAFY4X8hTb

Malware Config

Signatures

  • Detect Socks5Systemz Payload 1 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 5 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe
    "C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:3036
    • C:\Users\Admin\AppData\Local\Temp\is-JCNB0.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-JCNB0.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp" /SL5="$30156,4870623,54272,C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2888
      • C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe
        "C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -i
        3⤵
        • Executes dropped EXE
        PID:2432
      • C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe
        "C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -s
        3⤵
        • Executes dropped EXE
        PID:2808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Users\Admin\AppData\Local\Temp\is-3VSF6.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • \Users\Admin\AppData\Local\Temp\is-3VSF6.tmp\_isetup\_shfoldr.dll

    Filesize

    22KB

    MD5

    92dc6ef532fbb4a5c3201469a5b5eb63

    SHA1

    3e89ff837147c16b4e41c30d6c796374e0b8e62c

    SHA256

    9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

    SHA512

    9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

  • \Users\Admin\AppData\Local\Temp\is-JCNB0.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp

    Filesize

    680KB

    MD5

    72c363a7eba0caa099ef3e305c78f6c8

    SHA1

    c64ad54cf6142c8415aac2fe41a88c9feded028c

    SHA256

    f5307b1d5bdbf0371916d0ba3bf21f46c7aecf740e50889ceeb4dcd0e1e565a7

    SHA512

    a62839a8288edc8bcbf3bb9df48a26c10139e664f14d15b0b7c6ae262d446b15ede3149b6cb092a430ae761e049c8f0a8a40e469e2bdb0c0aa0c61d5b4c73709

  • \Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe

    Filesize

    3.1MB

    MD5

    077b2d2eb8c61d4e1ed963ce4bc8d4f9

    SHA1

    38e4fce399b13806b7110baf6581dc43462afd3a

    SHA256

    0e735eba0a7bc438adfff5ae72ab8a8d3bcf80473e4f13b007cbd9f991863c8a

    SHA512

    902e9fc9137dd08a9ee82ac65a6807a463820596b1af7ec4f9f97701f998bde759f3eaa6c9f8d493cdb1ef8036278130b3a682daa1cef2b6184e9c12c07e5197

  • memory/2432-65-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2432-70-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2432-66-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-80-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-92-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-136-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-133-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-72-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-130-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-127-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-76-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-123-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-120-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-83-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-86-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-89-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-117-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-93-0x0000000002670000-0x0000000002712000-memory.dmp

    Filesize

    648KB

  • memory/2808-99-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-102-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-105-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-108-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-111-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2808-114-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/2888-64-0x0000000003AD0000-0x0000000003DE3000-memory.dmp

    Filesize

    3.1MB

  • memory/2888-77-0x0000000003AD0000-0x0000000003DE3000-memory.dmp

    Filesize

    3.1MB

  • memory/2888-75-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/2888-12-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/3036-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/3036-74-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3036-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB