Analysis
-
max time kernel
292s -
max time network
298s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 22:54
Static task
static1
Behavioral task
behavioral1
Sample
54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe
Resource
win10-20240611-en
General
-
Target
54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe
-
Size
4.8MB
-
MD5
470cba8e9ff7f2979c8c3021bfd11067
-
SHA1
b8654d5cad23413541e31b8d5c38229f8833407c
-
SHA256
54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e
-
SHA512
5425e9991207a9476cfe389d6c714b06e82c64bd6f4bdd1b3f482b46f284e61ac5925a2339b0af5aa3575adda8310affb76f8bc2032485cc9d99e7c451e4593f
-
SSDEEP
98304:mcKTJUwrhDaSgqX/mNRt0s9I+9U2JL9kMB8+g2DYf4ATH+ENT2:6Uwtvvmd9lxJwccTeENT2
Malware Config
Extracted
socks5systemz
buctmkb.com
gdpaebk.com
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2952-92-0x0000000002680000-0x0000000002722000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmpfreeaudioconverter.exefreeaudioconverter.exepid process 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp 2516 freeaudioconverter.exe 2952 freeaudioconverter.exe -
Loads dropped DLL 5 IoCs
Processes:
54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmppid process 620 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 141.98.234.31 Destination IP 81.31.197.38 Destination IP 45.155.250.90 Destination IP 91.211.247.248 Destination IP 152.89.198.214 Destination IP 45.155.250.90 Destination IP 81.31.197.38 Destination IP 152.89.198.214 Destination IP 152.89.198.214 Destination IP 141.98.234.31 Destination IP 91.211.247.248 Destination IP 45.155.250.90 Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmppid process 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmpdescription pid process target process PID 620 wrote to memory of 1896 620 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp PID 620 wrote to memory of 1896 620 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp PID 620 wrote to memory of 1896 620 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp PID 620 wrote to memory of 1896 620 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp PID 620 wrote to memory of 1896 620 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp PID 620 wrote to memory of 1896 620 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp PID 620 wrote to memory of 1896 620 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp PID 1896 wrote to memory of 2516 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp freeaudioconverter.exe PID 1896 wrote to memory of 2516 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp freeaudioconverter.exe PID 1896 wrote to memory of 2516 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp freeaudioconverter.exe PID 1896 wrote to memory of 2516 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp freeaudioconverter.exe PID 1896 wrote to memory of 2952 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp freeaudioconverter.exe PID 1896 wrote to memory of 2952 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp freeaudioconverter.exe PID 1896 wrote to memory of 2952 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp freeaudioconverter.exe PID 1896 wrote to memory of 2952 1896 54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp freeaudioconverter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe"C:\Users\Admin\AppData\Local\Temp\54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OAH82.tmp\54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp"C:\Users\Admin\AppData\Local\Temp\is-OAH82.tmp\54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmp" /SL5="$400F4,4749985,54272,C:\Users\Admin\AppData\Local\Temp\54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Free Audio Converter\freeaudioconverter.exe"C:\Users\Admin\AppData\Local\Free Audio Converter\freeaudioconverter.exe" -i3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Free Audio Converter\freeaudioconverter.exe"C:\Users\Admin\AppData\Local\Free Audio Converter\freeaudioconverter.exe" -s3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Free Audio Converter\freeaudioconverter.exeFilesize
3.0MB
MD5578cb9964772cf18127e86ec45e5cfa0
SHA10ebf42134b760e54441f2c6e5f63ad8fc38a94ff
SHA256ba7cbb47023462fdae507354f56b93c0d437eb395e085a83148a188ee8764387
SHA512a131e7ee03a44b92e94d0f95d27f6f6e1da7ed20cd2342c4de7ccdb8537e43e774e9066c464d822b7ea97eda74f2a2f92108053674f7b7f706fc90878f83746b
-
\Users\Admin\AppData\Local\Temp\is-8TMC8.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-8TMC8.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-OAH82.tmp\54da8547a7cab8d0e75cf10526da2d7a8423bd67bbb0932a35f305090e341d7e.tmpFilesize
680KB
MD5f519683b3c418feee49361b3411d8c3d
SHA1f981468acbf6b3e1d081a52203f7e3f017fcafe7
SHA2564fc60883a82f58b3a798be19bd6a25592631ac3ccb23af3b1a95c41dab65af4a
SHA512db0e3a2363bb9433cc57d3da42bfb901f0ed128aad2297a88cca1dae650f69a438ef4f7634b945568bb99f59bc587eb698f08cf8dc8162808ac8575fa280c805
-
memory/620-73-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/620-3-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/620-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1896-12-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1896-64-0x0000000003BB0000-0x0000000003EAB000-memory.dmpFilesize
3.0MB
-
memory/1896-79-0x0000000003BB0000-0x0000000003EAB000-memory.dmpFilesize
3.0MB
-
memory/1896-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2516-65-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2516-66-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2516-69-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-98-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-107-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-75-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-82-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-85-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-88-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-91-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-92-0x0000000002680000-0x0000000002722000-memory.dmpFilesize
648KB
-
memory/2952-71-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-101-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-104-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-78-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-110-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-113-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-116-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-119-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-122-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-125-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-128-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-131-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB
-
memory/2952-134-0x0000000000400000-0x00000000006FB000-memory.dmpFilesize
3.0MB