Analysis

  • max time kernel
    292s
  • max time network
    298s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    30-05-2024 22:53

General

  • Target

    49a7280796a55d75b6ad053d36d02e7738b0b350d1cce0bd23bf6ba26c99ce85.exe

  • Size

    4.6MB

  • MD5

    89ebbd2dbefec5f60077d77dfeac71e9

  • SHA1

    37c6a15c2f2ef00f6a38f80172467d5ae0c02269

  • SHA256

    49a7280796a55d75b6ad053d36d02e7738b0b350d1cce0bd23bf6ba26c99ce85

  • SHA512

    aaaaa5c136ae503f7363649d10ea1e88500c22f529920ef1f589a91d21f6d88447f78b08224d45807467998ef134883d7bec2a3f6d36859f51b45f622afadbd5

  • SSDEEP

    98304:mJf+D9ZpQaVYv5QRTC+HEYBBvBKKO5yLgKjbro4UBIctG/Gd5d:qKYv52EYrBKnyTjbrDzi++

Malware Config

Signatures

  • Detect Socks5Systemz Payload 1 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Unexpected DNS network traffic destination 2 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\49a7280796a55d75b6ad053d36d02e7738b0b350d1cce0bd23bf6ba26c99ce85.exe
    "C:\Users\Admin\AppData\Local\Temp\49a7280796a55d75b6ad053d36d02e7738b0b350d1cce0bd23bf6ba26c99ce85.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:420
    • C:\Users\Admin\AppData\Local\Temp\is-M43BB.tmp\49a7280796a55d75b6ad053d36d02e7738b0b350d1cce0bd23bf6ba26c99ce85.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-M43BB.tmp\49a7280796a55d75b6ad053d36d02e7738b0b350d1cce0bd23bf6ba26c99ce85.tmp" /SL5="$801F8,4573217,54272,C:\Users\Admin\AppData\Local\Temp\49a7280796a55d75b6ad053d36d02e7738b0b350d1cce0bd23bf6ba26c99ce85.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:2992
      • C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe
        "C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe" -i
        3⤵
        • Executes dropped EXE
        PID:1128
      • C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe
        "C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe" -s
        3⤵
        • Executes dropped EXE
        PID:1672

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe

    Filesize

    2.9MB

    MD5

    84c3490570425bf21483727633133851

    SHA1

    79e01d2c58ad2209550763a076f3bd050b4bf531

    SHA256

    f17474117dddab6eacf0e3dda7634ac5bb647e886c6564da4597d30d97cee217

    SHA512

    c1cae70892968c0b8d52e0e3615c92c4ed05ca83aa8dd8701fb95101311e46951665ef406bbd53a2677327bf87870676873ff83f867b05d19761669eb1c53f30

  • C:\Users\Admin\AppData\Local\Temp\is-M43BB.tmp\49a7280796a55d75b6ad053d36d02e7738b0b350d1cce0bd23bf6ba26c99ce85.tmp

    Filesize

    680KB

    MD5

    fc38d5561cb12e0d573c043f2a02587c

    SHA1

    85881a5502366649652ef68aa644af8eb81baf1b

    SHA256

    1affeed602ac019e9274932be152257f6b4dde1fee65c4d4f9b5f64bf1d758b9

    SHA512

    de6dc4bca4c3a6d1d178e62349d00b74cb02ab308fca25b772a1a47c669657fa5b70fe6adb971a5221da853a009822b70f0dfc64527abe3b4a13acb1f652cf31

  • \Users\Admin\AppData\Local\Temp\is-2MNEH.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • memory/420-68-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/420-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/420-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/1128-59-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1128-60-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1128-64-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-82-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-95-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-129-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-70-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-73-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-76-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-79-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-126-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-84-0x0000000000A30000-0x0000000000AD2000-memory.dmp

    Filesize

    648KB

  • memory/1672-87-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-92-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-67-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-98-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-101-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-104-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-107-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-110-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-113-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-116-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-119-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/1672-123-0x0000000000400000-0x00000000006F5000-memory.dmp

    Filesize

    3.0MB

  • memory/2992-13-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB

  • memory/2992-69-0x0000000000400000-0x00000000004BA000-memory.dmp

    Filesize

    744KB