Analysis
-
max time kernel
293s -
max time network
298s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
13-06-2024 23:57
Static task
static1
Behavioral task
behavioral1
Sample
c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe
Resource
win10-20240404-en
General
-
Target
c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe
-
Size
4.7MB
-
MD5
5183d741aab2a36fdd34be7df5c971bc
-
SHA1
daf3d1764b4e59332f3d52680ad2ce104a56dd8e
-
SHA256
c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce
-
SHA512
1e6d648ccb221d7f94b4bdfcd8e2d326fbd5c19b60739ec1551cd923b50b27c24bb4911c382936d345401bf97a39af1d09ff8f3f8192c86e9c0987ca2617c6e4
-
SSDEEP
98304:mlDUGseE0MSflVR8qpZEugaGZvMqKK6C1OAJX90V6IIwNR7JTu6mWQiZx:iUGsebl8qpZDsEqV6CPJX9O6IIwTtTpj
Malware Config
Extracted
socks5systemz
ezzgagb.ua
kbihhpl.ua
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2552-92-0x0000000002490000-0x0000000002532000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmplinuxmultiMediastudio32.exelinuxmultiMediastudio32.exepid process 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp 2548 linuxmultiMediastudio32.exe 2552 linuxmultiMediastudio32.exe -
Loads dropped DLL 5 IoCs
Processes:
c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exec320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmppid process 1376 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 141.98.234.31 Destination IP 91.211.247.248 Destination IP 141.98.234.31 Destination IP 81.31.197.38 Destination IP 81.31.197.38 Destination IP 152.89.198.214 Destination IP 45.155.250.90 Destination IP 45.155.250.90 Destination IP 91.211.247.248 Destination IP 152.89.198.214 Destination IP 91.211.247.248 Destination IP 152.89.198.214 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmppid process 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exec320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmpdescription pid process target process PID 1376 wrote to memory of 2392 1376 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp PID 1376 wrote to memory of 2392 1376 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp PID 1376 wrote to memory of 2392 1376 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp PID 1376 wrote to memory of 2392 1376 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp PID 1376 wrote to memory of 2392 1376 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp PID 1376 wrote to memory of 2392 1376 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp PID 1376 wrote to memory of 2392 1376 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp PID 2392 wrote to memory of 2548 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp linuxmultiMediastudio32.exe PID 2392 wrote to memory of 2548 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp linuxmultiMediastudio32.exe PID 2392 wrote to memory of 2548 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp linuxmultiMediastudio32.exe PID 2392 wrote to memory of 2548 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp linuxmultiMediastudio32.exe PID 2392 wrote to memory of 2552 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp linuxmultiMediastudio32.exe PID 2392 wrote to memory of 2552 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp linuxmultiMediastudio32.exe PID 2392 wrote to memory of 2552 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp linuxmultiMediastudio32.exe PID 2392 wrote to memory of 2552 2392 c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp linuxmultiMediastudio32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe"C:\Users\Admin\AppData\Local\Temp\c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Users\Admin\AppData\Local\Temp\is-JUB68.tmp\c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp"C:\Users\Admin\AppData\Local\Temp\is-JUB68.tmp\c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmp" /SL5="$5014E,4673706,54272,C:\Users\Admin\AppData\Local\Temp\c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2392 -
C:\Users\Admin\AppData\Local\Linux MultiMedia Studio\linuxmultiMediastudio32.exe"C:\Users\Admin\AppData\Local\Linux MultiMedia Studio\linuxmultiMediastudio32.exe" -i3⤵
- Executes dropped EXE
PID:2548 -
C:\Users\Admin\AppData\Local\Linux MultiMedia Studio\linuxmultiMediastudio32.exe"C:\Users\Admin\AppData\Local\Linux MultiMedia Studio\linuxmultiMediastudio32.exe" -s3⤵
- Executes dropped EXE
PID:2552
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Linux MultiMedia Studio\linuxmultiMediastudio32.exeFilesize
2.9MB
MD51a49b62ffe4d7ee27245bfb59e963c34
SHA16c7467c8cda0c7ef1410f772494b985ae465f9ad
SHA2569fe0ddff1394f78f3c4e06dc68369240d6eae8032291ef310feee388de8dd52e
SHA5122b7c0f9b1e85faa5aa474849d2b636f2e83ac132e0cd805e0b3da9fd8e53b91f9aa020c1e9a53c3a59d63e32b871daa7c4ae8fae2f9743701528aa7c04bc942e
-
\Users\Admin\AppData\Local\Temp\is-9DTBL.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-9DTBL.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-JUB68.tmp\c320ecffda839d9a6e76c0035dcb20d75dc59e7827dce90d7c449294fba925ce.tmpFilesize
680KB
MD5da3e3293eadae0b9e8e0bb85b53bf263
SHA16fd7ba9a4f76f8500f7ec3d820f70ca0c869173f
SHA256ecf5f7145a55f9014f86014fd3d9a6048b8f29e653409604e4d12cb1bda2302d
SHA512c1b4a03f7f657f1db5bbf21f68ebce7373b90135698eb5fe4c432630e7066f0c89eeddd0f6cbb0af631ad62026992503df42e31e6999b166a541044c688a0fb8
-
memory/1376-73-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1376-2-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/1376-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2392-79-0x0000000004140000-0x000000000441D000-memory.dmpFilesize
2.9MB
-
memory/2392-16-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2392-64-0x0000000004140000-0x000000000441D000-memory.dmpFilesize
2.9MB
-
memory/2392-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2548-66-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2548-69-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2548-65-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-91-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-107-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-75-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-82-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-85-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-88-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-71-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-92-0x0000000002490000-0x0000000002532000-memory.dmpFilesize
648KB
-
memory/2552-98-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-101-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-104-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-78-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-110-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-113-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-116-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-119-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-122-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-125-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-128-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-131-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB
-
memory/2552-134-0x0000000000400000-0x00000000006DD000-memory.dmpFilesize
2.9MB