Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
300s -
max time network
255s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system -
submitted
17/06/2024, 05:07
Static task
static1
Behavioral task
behavioral1
Sample
945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe
Resource
win10-20240404-en
General
-
Target
945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe
-
Size
5.8MB
-
MD5
875191f204d65fba87578811a903b55c
-
SHA1
f5f246da6aa53095f3fd1cc5b798af0f626464f6
-
SHA256
945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673
-
SHA512
18319a7dac083bbacaff0d23e6d04c2f45d1af1655830e063102b70789c8ef065e824dfbc2d5073edb7884326faefdda813cb0bd7135e57722d9b383f65ef84b
-
SSDEEP
98304:mat5MY7lL4fOoffsRGRS2PJrHKLQ/wAzRQwLn368K3BVKQI+fkrYtg91qSe/fC:n5MqBeO+SwJWAza1RVw+fGv1unC
Malware Config
Extracted
socks5systemz
bxeungo.com
http://bxeungo.com/search/?q=67e28dd8685af379125bfd4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978f271ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff717c0ef9c9e3e
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
resource yara_rule behavioral2/memory/4320-90-0x0000000000910000-0x00000000009B2000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
pid Process 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 876 svomediaplayer.exe 4320 svomediaplayer.exe -
Loads dropped DLL 3 IoCs
pid Process 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 91.211.247.248 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2520 wrote to memory of 2536 2520 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe 73 PID 2520 wrote to memory of 2536 2520 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe 73 PID 2520 wrote to memory of 2536 2520 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe 73 PID 2536 wrote to memory of 876 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 74 PID 2536 wrote to memory of 876 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 74 PID 2536 wrote to memory of 876 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 74 PID 2536 wrote to memory of 4320 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 75 PID 2536 wrote to memory of 4320 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 75 PID 2536 wrote to memory of 4320 2536 945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp 75
Processes
-
C:\Users\Admin\AppData\Local\Temp\945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe"C:\Users\Admin\AppData\Local\Temp\945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Users\Admin\AppData\Local\Temp\is-8D5V2.tmp\945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp"C:\Users\Admin\AppData\Local\Temp\is-8D5V2.tmp\945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp" /SL5="$5023A,5810257,54272,C:\Users\Admin\AppData\Local\Temp\945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer.exe"C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer.exe" -i3⤵
- Executes dropped EXE
PID:876
-
-
C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer.exe"C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer.exe" -s3⤵
- Executes dropped EXE
PID:4320
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.2MB
MD572a10f0b2eb694fddafc4e2b1206baed
SHA13fc309312cbb308c717ad5d8b2cc09a9a181ca8b
SHA2564d2e77d5a228541339b64312154a611389ca39851ebd77194cfdf2336e15bcee
SHA5126cee2fdbe2e3f21707921eb7fea58652253be49375260a203a2d0015fbc08427d0cd7e17be671f6c3601e1f2965b90bd863e80ffc4a11c2fdfb3fb47bd250443
-
C:\Users\Admin\AppData\Local\Temp\is-8D5V2.tmp\945103d43a3b4db2fdded297ec9625e54f4d7f494aeb27280e133bac22389673.tmp
Filesize680KB
MD5e6d2fc7b9b3ceccedcf57875330a8ff1
SHA17bc2a4e40e24b2c0d130883b7255a97cdd4e1e6f
SHA256001f671b1a90209f7133c55c809be8fe96797c89bebcce04aab5e846d9c91cc3
SHA5120d5809e67459ce5eae974f11428fe5fc124f52d7532528d5952dca17b29d6941a7b1f31e04fbcdc62e86f6186586efb559cfeaca054a7d05c77461d31455ac7f
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
13KB
MD5a813d18268affd4763dde940246dc7e5
SHA1c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA256e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
SHA512b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4