Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 04:41
Static task
static1
Behavioral task
behavioral1
Sample
ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe
Resource
win11-20240611-en
General
-
Target
ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe
-
Size
5.6MB
-
MD5
edd8fbb38dbf23b5f903b9a50fa35feb
-
SHA1
ccc6c7191e44c5887b8f1a2d13ae93f751afbb11
-
SHA256
ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a
-
SHA512
1a9c66b0e792f44dcab93544149ce9715863e8b4355062d66fa40e42378a0494569748c01d06cdc3ca6db4d1f6f41ab35fbb0062c07569b8e5dcccdaea9fe945
-
SSDEEP
98304:my7M1IRkFVWvEM+xoPsMIGojBxpOf5/p60nANJGY7zfytFrKR:yIGUEMGhFCf5/kVzfyPKR
Malware Config
Extracted
socks5systemz
cstucpo.net
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3096-95-0x0000000000A40000-0x0000000000AE2000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmplampungsoundstage.exelampungsoundstage.exepid process 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp 2100 lampungsoundstage.exe 3096 lampungsoundstage.exe -
Loads dropped DLL 3 IoCs
Processes:
ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmppid process 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp -
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.211.247.248 Destination IP 152.89.198.214 Destination IP 91.211.247.248 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmppid process 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exeed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmpdescription pid process target process PID 1300 wrote to memory of 348 1300 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp PID 1300 wrote to memory of 348 1300 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp PID 1300 wrote to memory of 348 1300 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp PID 348 wrote to memory of 2100 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp lampungsoundstage.exe PID 348 wrote to memory of 2100 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp lampungsoundstage.exe PID 348 wrote to memory of 2100 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp lampungsoundstage.exe PID 348 wrote to memory of 3096 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp lampungsoundstage.exe PID 348 wrote to memory of 3096 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp lampungsoundstage.exe PID 348 wrote to memory of 3096 348 ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp lampungsoundstage.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe"C:\Users\Admin\AppData\Local\Temp\ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1300 -
C:\Users\Admin\AppData\Local\Temp\is-LMCIB.tmp\ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp"C:\Users\Admin\AppData\Local\Temp\is-LMCIB.tmp\ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmp" /SL5="$80178,5634076,54272,C:\Users\Admin\AppData\Local\Temp\ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:348 -
C:\Users\Admin\AppData\Local\Lampung Soundstage\lampungsoundstage.exe"C:\Users\Admin\AppData\Local\Lampung Soundstage\lampungsoundstage.exe" -i3⤵
- Executes dropped EXE
PID:2100 -
C:\Users\Admin\AppData\Local\Lampung Soundstage\lampungsoundstage.exe"C:\Users\Admin\AppData\Local\Lampung Soundstage\lampungsoundstage.exe" -s3⤵
- Executes dropped EXE
PID:3096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Lampung Soundstage\lampungsoundstage.exeFilesize
3.2MB
MD556ceaa1ba076530f2682803533cbce9c
SHA1bf2078e25213a9e5fd7509f3871f0e02cc0cd252
SHA2567904d62c179160ff754f1f1e862e0cc9c21d6610bee1515aa1fe4c85639f9eb3
SHA512869f088b6b786972b9e75da058d5f1d13c3cf6287cbe5a146d24e284a0934b1ed814aea0144b8c94e70ad12ab5993989ba8110ab460a93eba15dc995ae90eb07
-
C:\Users\Admin\AppData\Local\Temp\is-IJL9J.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-IJL9J.tmp\_isetup\_isdecmp.dllFilesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
-
C:\Users\Admin\AppData\Local\Temp\is-LMCIB.tmp\ed893f9526bcacb73f703e799946d0ab8274e3c74d38d1ab21dff1018b171f1a.tmpFilesize
680KB
MD5a53cd7f9f154eefaf6ff191bb4d65be5
SHA1f9f4f828e214a3f0b086dd4c96a23c0b45d3b4ff
SHA2564b70003d8cca9ebf285e0eaa03e24dd7cfd43370452dda6047654cca899dfb35
SHA512327c5dbb5a3971d578aba98e76ac176a7afe3cb6f6767b6791b67e7a37ed558c0e8d31e20f17721766a3de83896b01681f1564ce55a020c70543359b75f1e88d
-
memory/348-7-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/348-77-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1300-76-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1300-2-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/1300-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2100-65-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/2100-69-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/2100-71-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/2100-66-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-91-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-96-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-78-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-82-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-81-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-85-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-88-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-73-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-95-0x0000000000A40000-0x0000000000AE2000-memory.dmpFilesize
648KB
-
memory/3096-75-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-102-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-105-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-108-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-111-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-114-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-117-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-120-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB
-
memory/3096-123-0x0000000000400000-0x0000000000742000-memory.dmpFilesize
3.3MB