Analysis
-
max time kernel
293s -
max time network
298s -
platform
windows7_x64 -
resource
win7-20240419-en -
resource tags
arch:x64arch:x86image:win7-20240419-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 23:51
Static task
static1
Behavioral task
behavioral1
Sample
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe
Resource
win10-20240404-en
General
-
Target
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe
-
Size
4.6MB
-
MD5
4173debbc3d407dca3905c212ab537f2
-
SHA1
807cd0f7e7337545ecde2a1dec4fd9ad6b31ad7a
-
SHA256
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693
-
SHA512
884581348592d891c95e916481d5e2b2fe1aeef7fd55b25acf2010bf542c7f3e6f15e7be6ec1f2813e9a4dc0cbc853c9c0beca2c13b0d6bc5d1e8a2a6827d57d
-
SSDEEP
98304:mTMDgLaCF/V6GoPhbZQ0sdYJi4LXyrk/BAqZ0pyrXFtbrKeDYSLdCu9zlp:kMDEaG/V6PPhb5sGJDLCrkCXSFlrKUYy
Malware Config
Extracted
socks5systemz
bwdfprf.com
itaddss.info
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2544-92-0x00000000024F0000-0x0000000002592000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmpvirtualsoundcard.exevirtualsoundcard.exepid process 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp 2628 virtualsoundcard.exe 2544 virtualsoundcard.exe -
Loads dropped DLL 5 IoCs
Processes:
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exea408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmppid process 2220 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.211.247.248 Destination IP 141.98.234.31 Destination IP 152.89.198.214 Destination IP 91.211.247.248 Destination IP 152.89.198.214 Destination IP 152.89.198.214 Destination IP 141.98.234.31 Destination IP 141.98.234.31 Destination IP 45.155.250.90 Destination IP 81.31.197.38 Destination IP 152.89.198.214 Destination IP 45.155.250.90 Destination IP 81.31.197.38 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmppid process 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exea408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmpdescription pid process target process PID 2220 wrote to memory of 2392 2220 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp PID 2220 wrote to memory of 2392 2220 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp PID 2220 wrote to memory of 2392 2220 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp PID 2220 wrote to memory of 2392 2220 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp PID 2220 wrote to memory of 2392 2220 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp PID 2220 wrote to memory of 2392 2220 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp PID 2220 wrote to memory of 2392 2220 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp PID 2392 wrote to memory of 2628 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp virtualsoundcard.exe PID 2392 wrote to memory of 2628 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp virtualsoundcard.exe PID 2392 wrote to memory of 2628 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp virtualsoundcard.exe PID 2392 wrote to memory of 2628 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp virtualsoundcard.exe PID 2392 wrote to memory of 2544 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp virtualsoundcard.exe PID 2392 wrote to memory of 2544 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp virtualsoundcard.exe PID 2392 wrote to memory of 2544 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp virtualsoundcard.exe PID 2392 wrote to memory of 2544 2392 a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp virtualsoundcard.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe"C:\Users\Admin\AppData\Local\Temp\a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Users\Admin\AppData\Local\Temp\is-7TJ0T.tmp\a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp"C:\Users\Admin\AppData\Local\Temp\is-7TJ0T.tmp\a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmp" /SL5="$400F8,4585671,54272,C:\Users\Admin\AppData\Local\Temp\a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard.exe"C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard.exe" -i3⤵
- Executes dropped EXE
PID:2628 -
C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard.exe"C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard.exe" -s3⤵
- Executes dropped EXE
PID:2544
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\is-7TJ0T.tmp\a408e2bfa6521362525065c4170d314d83ffddc4ed68514ac01999e61a1dd693.tmpFilesize
680KB
MD553a94211658a6bbf3d3a695470f940a6
SHA1a9909ddfc97dee691e9d60b1257d61a3c1ef4e07
SHA256d4928c3cacf826943bb44385aac5fb52e6ac69054f31a463df266baf9aa26d01
SHA512d9c916961abcce8f05089df9cb6310c930aaa29266bfaf378a4dd0c9180ba9186a81393c662ba2a3b1a4da587379d68d532250c1a8d216d44dd532aaf178b402
-
\Users\Admin\AppData\Local\Temp\is-CF523.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-CF523.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard.exeFilesize
2.6MB
MD5a0ac562bedc60906db18a7457c4a3e33
SHA1f9e83a91e0c8609a355bafa25c88a0ae30107fed
SHA256728d3595972daf3b92bd052193a13a079d0862604c6a88fb3acd739cf08ec38a
SHA512ccaa43278a250cc6ce03d04344ebd57e928d99e93b83a938eeba65c25a7255de5cadd51bc4d593214a2232c214a47a7c1a0e0ca56cb398e0d74c886470650414
-
memory/2220-73-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2220-3-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/2220-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2392-12-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2392-64-0x0000000003280000-0x0000000003524000-memory.dmpFilesize
2.6MB
-
memory/2392-79-0x0000000003280000-0x0000000003524000-memory.dmpFilesize
2.6MB
-
memory/2392-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2544-104-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-98-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-134-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-75-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-78-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-131-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-82-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-85-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-88-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-91-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-92-0x00000000024F0000-0x0000000002592000-memory.dmpFilesize
648KB
-
memory/2544-71-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-101-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-128-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-107-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-110-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-113-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-116-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-119-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-122-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2544-125-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2628-65-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2628-66-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB
-
memory/2628-69-0x0000000000400000-0x00000000006A4000-memory.dmpFilesize
2.6MB