Analysis
-
max time kernel
292s -
max time network
298s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
14-06-2024 00:12
Static task
static1
Behavioral task
behavioral1
Sample
fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe
Resource
win10-20240404-en
General
-
Target
fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe
-
Size
4.6MB
-
MD5
07d160c10509d0857fd9dbd8442e46cb
-
SHA1
921f90d7516821880a84146983220910d9fc8205
-
SHA256
fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94
-
SHA512
f14cc0603c7ee9e8a3069121a8910618078b04c68090a91f71ee81c0593fd3d566eab4122904b92a0d818ebd88341050a8f2234d95029a8b50e7524804a0b0ce
-
SSDEEP
98304:mKKu/56DlW1uwHXNF5nGUQmviODRfmrM8MEvlnK+LI6HuybFtipw:eleuwHXN7GUfvdV8Ml8lnKKRMw
Malware Config
Extracted
socks5systemz
aisieim.ru
ilfduiz.info
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2568-92-0x0000000002590000-0x0000000002632000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmplesserextent.exelesserextent.exepid process 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp 2664 lesserextent.exe 2568 lesserextent.exe -
Loads dropped DLL 5 IoCs
Processes:
fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exefa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmppid process 2280 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 45.155.250.90 Destination IP 91.211.247.248 Destination IP 141.98.234.31 Destination IP 45.155.250.90 Destination IP 91.211.247.248 Destination IP 91.211.247.248 Destination IP 141.98.234.31 Destination IP 152.89.198.214 Destination IP 152.89.198.214 Destination IP 141.98.234.31 Destination IP 81.31.197.38 Destination IP 152.89.198.214 Destination IP 81.31.197.38 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmppid process 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exefa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmpdescription pid process target process PID 2280 wrote to memory of 2980 2280 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp PID 2280 wrote to memory of 2980 2280 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp PID 2280 wrote to memory of 2980 2280 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp PID 2280 wrote to memory of 2980 2280 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp PID 2280 wrote to memory of 2980 2280 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp PID 2280 wrote to memory of 2980 2280 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp PID 2280 wrote to memory of 2980 2280 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp PID 2980 wrote to memory of 2664 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp lesserextent.exe PID 2980 wrote to memory of 2664 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp lesserextent.exe PID 2980 wrote to memory of 2664 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp lesserextent.exe PID 2980 wrote to memory of 2664 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp lesserextent.exe PID 2980 wrote to memory of 2568 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp lesserextent.exe PID 2980 wrote to memory of 2568 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp lesserextent.exe PID 2980 wrote to memory of 2568 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp lesserextent.exe PID 2980 wrote to memory of 2568 2980 fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp lesserextent.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe"C:\Users\Admin\AppData\Local\Temp\fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2280 -
C:\Users\Admin\AppData\Local\Temp\is-UBNH6.tmp\fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp"C:\Users\Admin\AppData\Local\Temp\is-UBNH6.tmp\fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmp" /SL5="$5014E,4604216,54272,C:\Users\Admin\AppData\Local\Temp\fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2980 -
C:\Users\Admin\AppData\Local\Lesser Extent\lesserextent.exe"C:\Users\Admin\AppData\Local\Lesser Extent\lesserextent.exe" -i3⤵
- Executes dropped EXE
PID:2664 -
C:\Users\Admin\AppData\Local\Lesser Extent\lesserextent.exe"C:\Users\Admin\AppData\Local\Lesser Extent\lesserextent.exe" -s3⤵
- Executes dropped EXE
PID:2568
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Lesser Extent\lesserextent.exeFilesize
2.9MB
MD5ef6a40723e3b1f875321abf06ca68ac8
SHA153a7f3d4ae7a2b92d45d00035976d82da9e358a1
SHA2566c08ed0c0cf22702b59f5dcb21e085d0f0abec9d3be739d59d115d7333270012
SHA5123e5420590b09b4bece53fce0ff46452ad19de96129bf7922710f6ce036bac6367e69491b1418dca984232e6d27aa00e5dfdd1ee9947e84604a0e9c0185ad6ece
-
\Users\Admin\AppData\Local\Temp\is-6TQJB.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-6TQJB.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-UBNH6.tmp\fa3c9b491697abc525df5ce0086cc8ada6ad3c36a9ce51e7570011d2b8140c94.tmpFilesize
680KB
MD52e97fdffc91d2e4bd0f019d914d45d2e
SHA1c1f73313c67ae35c06af50550f8ec72210b1efd5
SHA2569cfabcb9cceb11708e60821bf405d0884cc91eebf9b393962c83caa6f541e15f
SHA5121a2bc77e185cc73ed8677da219d82bf5849933791ea6f677bb09a866ea54bd7c24fe9d17cef18efe9707ed700783d6629bc995d0004a05c0a24388d0af0062bf
-
memory/2280-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2280-2-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/2280-73-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2568-75-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-85-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-128-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-125-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-71-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-134-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-122-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-116-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-78-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-119-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-82-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-131-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-88-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-91-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-92-0x0000000002590000-0x0000000002632000-memory.dmpFilesize
648KB
-
memory/2568-98-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-101-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-104-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-107-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-110-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2568-113-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2664-65-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2664-69-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2664-66-0x0000000000400000-0x00000000006E5000-memory.dmpFilesize
2.9MB
-
memory/2980-79-0x0000000003A70000-0x0000000003D55000-memory.dmpFilesize
2.9MB
-
memory/2980-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2980-64-0x0000000003A70000-0x0000000003D55000-memory.dmpFilesize
2.9MB
-
memory/2980-12-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB