Analysis
-
max time kernel
141s -
max time network
153s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
30-05-2024 15:33
Static task
static1
Behavioral task
behavioral1
Sample
492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe
Resource
win11-20240508-en
General
-
Target
492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe
-
Size
4.7MB
-
MD5
053681e45afa30a7750155f0a6715321
-
SHA1
04166258a21e8ef70087e007dcc0394eac7a100e
-
SHA256
492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1
-
SHA512
9f5967d009f6fc235a9dd6aa1ed16ddb75a6f5c3c726d1157a1a760d9b77dd6b10994550ee1a5dbe606b5d9a43f11b8c225a6ff3eaab6f512a3bc17cfac2944c
-
SSDEEP
98304:mhS0vMui1idKgi67oiV5U4fzTvySm3xiczTOQUBMXsOe2ZzK97DO:ZrIdKqtViYHQyQ+O3xaW
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2580-86-0x0000000000940000-0x00000000009E2000-memory.dmp family_socks5systemz behavioral2/memory/2580-110-0x0000000000940000-0x00000000009E2000-memory.dmp family_socks5systemz behavioral2/memory/2580-111-0x0000000000940000-0x00000000009E2000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp5kplayer32.exe5kplayer32.exepid process 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp 4544 5kplayer32.exe 2580 5kplayer32.exe -
Loads dropped DLL 1 IoCs
Processes:
492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmppid process 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmppid process 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmpdescription pid process target process PID 2364 wrote to memory of 2432 2364 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp PID 2364 wrote to memory of 2432 2364 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp PID 2364 wrote to memory of 2432 2364 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp PID 2432 wrote to memory of 4544 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp 5kplayer32.exe PID 2432 wrote to memory of 4544 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp 5kplayer32.exe PID 2432 wrote to memory of 4544 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp 5kplayer32.exe PID 2432 wrote to memory of 2580 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp 5kplayer32.exe PID 2432 wrote to memory of 2580 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp 5kplayer32.exe PID 2432 wrote to memory of 2580 2432 492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp 5kplayer32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe"C:\Users\Admin\AppData\Local\Temp\492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Users\Admin\AppData\Local\Temp\is-84BIR.tmp\492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp"C:\Users\Admin\AppData\Local\Temp\is-84BIR.tmp\492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp" /SL5="$40242,4693505,54272,C:\Users\Admin\AppData\Local\Temp\492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe"C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe" -i3⤵
- Executes dropped EXE
PID:4544
-
-
C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe"C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe" -s3⤵
- Executes dropped EXE
PID:2580
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD5fb3f6cbae323b70b6e1e075b59f4d1d9
SHA1c446f8d464ce0cadd4e1c6e8db00b2eef69fa6a2
SHA256c93cd0bb3b4f8a8bfc9a056cffae6abbec2f8952026828e80569893a752ab43c
SHA51295e4132dbcfbd022df2c2a958f438c1afa167b3115ad9dbd20e77fbaa846b1e4de87a2885ce3bdf65f06958aa399f38ae05f5e7c0d9f6fd575d46249fd16ac5f
-
C:\Users\Admin\AppData\Local\Temp\is-84BIR.tmp\492173b2e7ac0be1ddc6550fa2540c68fdb2fd6739de1eea9c766510fb0322a1.tmp
Filesize680KB
MD5281b7192d7fae9f9f4f11ad30842bfaa
SHA135ca07cc4d95c2132eb31152974417ba96e51d43
SHA256fca779fea2596da2a6f434cc9df9e6b44d1c176668b5c80bd76c00e91e478a4c
SHA512a63c9a298974c93dc4eb02e360d45db077f16a6921ac42bedb59a9fe46156fb50f46cb109d97ded3039300d3e38f4370bda0665b1013b3e662c6aec927635ef2
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63