Analysis

  • max time kernel
    291s
  • max time network
    285s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30-05-2024 22:45

General

  • Target

    35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe

  • Size

    4.9MB

  • MD5

    f4b5d051aea0deaf9998e8184a1471af

  • SHA1

    81bc40ffa12f61dc7159a10031c561498a33fc00

  • SHA256

    35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39

  • SHA512

    72dd247c94a8bb54bc1e9a7878a3876e53f412187e13faae5ae2e1d8ab8f5a86021c260272d36249c6893f00051963bc58022e2f186b1101da677e67a7d970bf

  • SSDEEP

    98304:ms9tu8i+w3siN50S3jdSOQAFzQRvp/QXdABCyNttlb:vtud/3s4GUdSOQAFY4X8hTb

Malware Config

Signatures

  • Detect Socks5Systemz Payload 1 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe
    "C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2272
    • C:\Users\Admin\AppData\Local\Temp\is-8TQGH.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-8TQGH.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp" /SL5="$B0062,4870623,54272,C:\Users\Admin\AppData\Local\Temp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe
        "C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -i
        3⤵
        • Executes dropped EXE
        PID:4060
      • C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe
        "C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe" -s
        3⤵
        • Executes dropped EXE
        PID:3808

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\is-8TQGH.tmp\35864f87e20d5a0f7ee5b72d0fd9060228ec65f97d56c98af91d2be48e9d7f39.tmp

    Filesize

    680KB

    MD5

    72c363a7eba0caa099ef3e305c78f6c8

    SHA1

    c64ad54cf6142c8415aac2fe41a88c9feded028c

    SHA256

    f5307b1d5bdbf0371916d0ba3bf21f46c7aecf740e50889ceeb4dcd0e1e565a7

    SHA512

    a62839a8288edc8bcbf3bb9df48a26c10139e664f14d15b0b7c6ae262d446b15ede3149b6cb092a430ae761e049c8f0a8a40e469e2bdb0c0aa0c61d5b4c73709

  • C:\Users\Admin\AppData\Local\Turquoise CD Player\turquoisecdplayer.exe

    Filesize

    3.1MB

    MD5

    077b2d2eb8c61d4e1ed963ce4bc8d4f9

    SHA1

    38e4fce399b13806b7110baf6581dc43462afd3a

    SHA256

    0e735eba0a7bc438adfff5ae72ab8a8d3bcf80473e4f13b007cbd9f991863c8a

    SHA512

    902e9fc9137dd08a9ee82ac65a6807a463820596b1af7ec4f9f97701f998bde759f3eaa6c9f8d493cdb1ef8036278130b3a682daa1cef2b6184e9c12c07e5197

  • \Users\Admin\AppData\Local\Temp\is-5IINN.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • memory/2272-68-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2272-3-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/2272-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/3208-16-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/3208-69-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/3808-107-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-92-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-129-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-126-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-70-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-73-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-76-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-79-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-82-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-85-0x0000000000990000-0x0000000000A32000-memory.dmp

    Filesize

    648KB

  • memory/3808-87-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-67-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-95-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-98-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-101-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-104-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-123-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-110-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-113-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-116-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/3808-119-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/4060-59-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/4060-60-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB

  • memory/4060-64-0x0000000000400000-0x0000000000713000-memory.dmp

    Filesize

    3.1MB