General
-
Target
4755fee796f6ac1c16f175e143f9e8bb1e1dbbd9e9725aef7f37d2d798937b05
-
Size
5.6MB
-
Sample
240617-fqnqhavhrf
-
MD5
22421038cc9edadfba058173043f5421
-
SHA1
43d4fadd5d2d0184a09775685e1812982e7a8a63
-
SHA256
4755fee796f6ac1c16f175e143f9e8bb1e1dbbd9e9725aef7f37d2d798937b05
-
SHA512
3fe5f55264061ff4ef2e6b66b9c80ec9209183e1dd8877547b2daa596d71e27b45be7fbf358155aefbef2e731bc26dd4b6c27c3c4539b1672ab2d7ba9456bd98
-
SSDEEP
98304:mAJgAAgVw3giseKjNISco3ujkrJpB4/9Qh5qIGCnB5XUC/98g6Q9Db2fFx4MJRQn:BgA9w3vKBIS7uIBX7Hr6G0rPccx4
Static task
static1
Behavioral task
behavioral1
Sample
4755fee796f6ac1c16f175e143f9e8bb1e1dbbd9e9725aef7f37d2d798937b05.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
4755fee796f6ac1c16f175e143f9e8bb1e1dbbd9e9725aef7f37d2d798937b05.exe
Resource
win10-20240611-en
Malware Config
Extracted
socks5systemz
ezkttpv.ua
http://ezkttpv.ua/search/?q=67e28dd86f5ff42d4509ac187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f88ff11c7e99d
ddeotoe.info
http://ddeotoe.info/search/?q=67e28dd8690ba728400aae4c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff717c0ef929c3a
http://ddeotoe.info/search/?q=67e28dd8690ba728400aae4c7c27d78406abdd88be4b12eab517aa5c96bd86eb97804a865a8bbc896c58e713bc90c91936b5281fc235a925ed3e51d6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee9d9c3bcd689017
Targets
-
-
Target
4755fee796f6ac1c16f175e143f9e8bb1e1dbbd9e9725aef7f37d2d798937b05
-
Size
5.6MB
-
MD5
22421038cc9edadfba058173043f5421
-
SHA1
43d4fadd5d2d0184a09775685e1812982e7a8a63
-
SHA256
4755fee796f6ac1c16f175e143f9e8bb1e1dbbd9e9725aef7f37d2d798937b05
-
SHA512
3fe5f55264061ff4ef2e6b66b9c80ec9209183e1dd8877547b2daa596d71e27b45be7fbf358155aefbef2e731bc26dd4b6c27c3c4539b1672ab2d7ba9456bd98
-
SSDEEP
98304:mAJgAAgVw3giseKjNISco3ujkrJpB4/9Qh5qIGCnB5XUC/98g6Q9Db2fFx4MJRQn:BgA9w3vKBIS7uIBX7Hr6G0rPccx4
Score10/10-
Detect Socks5Systemz Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-