Analysis
-
max time kernel
293s -
max time network
302s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 22:46
Static task
static1
Behavioral task
behavioral1
Sample
469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe
Resource
win10-20240404-en
General
-
Target
469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe
-
Size
4.7MB
-
MD5
c8855278d55161d672abb34ec6d92630
-
SHA1
04c5b24475734348d5c98e541a4224ecf04e3b34
-
SHA256
469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7
-
SHA512
41effa7e2ad0177f0e926d30d41e9b4138be905416632416f0d989e7517532c361a5a112c698f71f0f82c7fcbeaeb559c06ccb21d9f2eee026f6d0321c331efe
-
SSDEEP
98304:mAFlzbMxXlj5h4ci0eftI7ajkFAhoEdV+POl5rKoJRqBjzPuDXFD:TM3rfGtUIkFAS4V+PO/rzJgP8h
Malware Config
Extracted
socks5systemz
csxuenm.net
gvwkmty.com
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2492-93-0x00000000024E0000-0x0000000002582000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmprecordpadsoundrecorder.exerecordpadsoundrecorder.exepid process 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp 2736 recordpadsoundrecorder.exe 2492 recordpadsoundrecorder.exe -
Loads dropped DLL 5 IoCs
Processes:
469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmppid process 2188 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.211.247.248 Destination IP 141.98.234.31 Destination IP 152.89.198.214 Destination IP 152.89.198.214 Destination IP 91.211.247.248 Destination IP 45.155.250.90 Destination IP 152.89.198.214 Destination IP 141.98.234.31 Destination IP 152.89.198.214 Destination IP 45.155.250.90 Destination IP 81.31.197.38 Destination IP 152.89.198.214 Destination IP 81.31.197.38 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmppid process 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmpdescription pid process target process PID 2188 wrote to memory of 2176 2188 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp PID 2188 wrote to memory of 2176 2188 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp PID 2188 wrote to memory of 2176 2188 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp PID 2188 wrote to memory of 2176 2188 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp PID 2188 wrote to memory of 2176 2188 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp PID 2188 wrote to memory of 2176 2188 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp PID 2188 wrote to memory of 2176 2188 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp PID 2176 wrote to memory of 2736 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp recordpadsoundrecorder.exe PID 2176 wrote to memory of 2736 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp recordpadsoundrecorder.exe PID 2176 wrote to memory of 2736 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp recordpadsoundrecorder.exe PID 2176 wrote to memory of 2736 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp recordpadsoundrecorder.exe PID 2176 wrote to memory of 2492 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp recordpadsoundrecorder.exe PID 2176 wrote to memory of 2492 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp recordpadsoundrecorder.exe PID 2176 wrote to memory of 2492 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp recordpadsoundrecorder.exe PID 2176 wrote to memory of 2492 2176 469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp recordpadsoundrecorder.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe"C:\Users\Admin\AppData\Local\Temp\469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Users\Admin\AppData\Local\Temp\is-G95UI.tmp\469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp"C:\Users\Admin\AppData\Local\Temp\is-G95UI.tmp\469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmp" /SL5="$70122,4695466,54272,C:\Users\Admin\AppData\Local\Temp\469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Users\Admin\AppData\Local\Record Pad Sound Recorder\recordpadsoundrecorder.exe"C:\Users\Admin\AppData\Local\Record Pad Sound Recorder\recordpadsoundrecorder.exe" -i3⤵
- Executes dropped EXE
PID:2736 -
C:\Users\Admin\AppData\Local\Record Pad Sound Recorder\recordpadsoundrecorder.exe"C:\Users\Admin\AppData\Local\Record Pad Sound Recorder\recordpadsoundrecorder.exe" -s3⤵
- Executes dropped EXE
PID:2492
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Record Pad Sound Recorder\recordpadsoundrecorder.exeFilesize
2.9MB
MD591a016e8a3201be5cf9a5cd81a03a122
SHA1e8d4b753db4c17cca75a4ead031261b4ae474a2a
SHA25672a22d3d682a68ff6ebeecfd8b958da886c0993f18b47904b37bd21a69957d64
SHA51270fa11875311a608d22b11eb6044e5ae0ab013a66e617d663f9769efc93764bb81b48a6441d62e67fdc274a817f34e7f046d0c3d40c8fc9ef887160a9cccfd3c
-
\Users\Admin\AppData\Local\Temp\is-9P94U.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-9P94U.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-G95UI.tmp\469e003fd44b06c4e95484d23ab64fed9f675cacdc9c5b0d8ab164e18d747ad7.tmpFilesize
680KB
MD5eabdae80639a516543383b6191c9cbe8
SHA1344b8f00314aceb6e3b717ac4d165ea1d2006fde
SHA256407d4abf630f46eb9db3d576438afcf6cd5fd7ed7d509e4ab74a7dc867ade159
SHA5123d1b18034ce87a23d6e434bd6eaa69f17d1d7747d66b319bf25e85eb91c1d32dbd9b84b83bb744d32d977b46779ced07bd1bd980295088e0ce5962a103c545a5
-
memory/2176-9-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2176-64-0x0000000003460000-0x0000000003740000-memory.dmpFilesize
2.9MB
-
memory/2176-77-0x0000000003460000-0x0000000003740000-memory.dmpFilesize
2.9MB
-
memory/2176-75-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2188-74-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2188-2-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/2188-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2492-80-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-99-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-135-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-76-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-132-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-129-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-83-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-86-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-89-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-92-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-93-0x00000000024E0000-0x0000000002582000-memory.dmpFilesize
648KB
-
memory/2492-72-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-102-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-105-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-108-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-111-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-114-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-117-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-120-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-123-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2492-126-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2736-65-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2736-66-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB
-
memory/2736-70-0x0000000000400000-0x00000000006E0000-memory.dmpFilesize
2.9MB