Analysis
-
max time kernel
292s -
max time network
298s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 05:12
Static task
static1
Behavioral task
behavioral1
Sample
ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe
Resource
win10-20240404-en
General
-
Target
ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe
-
Size
5.0MB
-
MD5
8b662840665474400b0b83a5ce5dfba9
-
SHA1
1b7ea182554a8728729cba9f02a8f7a9ac74795a
-
SHA256
ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6
-
SHA512
8226e2d86aa2a59319979c1a1b065544fd363452dd542e308cb3ea1fabeaa6858632f77d1bdb56cc31fe1a7c0b4db049a484b908f3d1e40acb7c526fd0b921c1
-
SSDEEP
98304:m1p3kTW+00NTnsnitaFYrjmyhOG8p8Xbc9CSKHjyqA25ioukkOd42:yua+00dsndFijFhObp8XbcQSWjy25yHC
Malware Config
Extracted
socks5systemz
dlkmukw.info
firttec.ru
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2552-92-0x00000000026D0000-0x0000000002772000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmpm4atomp3freeconverter.exem4atomp3freeconverter.exepid process 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp 2884 m4atomp3freeconverter.exe 2552 m4atomp3freeconverter.exe -
Loads dropped DLL 5 IoCs
Processes:
ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exeec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmppid process 1704 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 81.31.197.38 Destination IP 91.211.247.248 Destination IP 45.155.250.90 Destination IP 81.31.197.38 Destination IP 152.89.198.214 Destination IP 91.211.247.248 Destination IP 152.89.198.214 Destination IP 141.98.234.31 Destination IP 45.155.250.90 Destination IP 152.89.198.214 Destination IP 152.89.198.214 Destination IP 141.98.234.31 Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmppid process 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exeec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmpdescription pid process target process PID 1704 wrote to memory of 1688 1704 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp PID 1704 wrote to memory of 1688 1704 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp PID 1704 wrote to memory of 1688 1704 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp PID 1704 wrote to memory of 1688 1704 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp PID 1704 wrote to memory of 1688 1704 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp PID 1704 wrote to memory of 1688 1704 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp PID 1704 wrote to memory of 1688 1704 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp PID 1688 wrote to memory of 2884 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp m4atomp3freeconverter.exe PID 1688 wrote to memory of 2884 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp m4atomp3freeconverter.exe PID 1688 wrote to memory of 2884 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp m4atomp3freeconverter.exe PID 1688 wrote to memory of 2884 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp m4atomp3freeconverter.exe PID 1688 wrote to memory of 2552 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp m4atomp3freeconverter.exe PID 1688 wrote to memory of 2552 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp m4atomp3freeconverter.exe PID 1688 wrote to memory of 2552 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp m4atomp3freeconverter.exe PID 1688 wrote to memory of 2552 1688 ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp m4atomp3freeconverter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe"C:\Users\Admin\AppData\Local\Temp\ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-0FK4P.tmp\ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp"C:\Users\Admin\AppData\Local\Temp\is-0FK4P.tmp\ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmp" /SL5="$40016,4961019,54272,C:\Users\Admin\AppData\Local\Temp\ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\M4A to MP3 Free Converter\m4atomp3freeconverter.exe"C:\Users\Admin\AppData\Local\M4A to MP3 Free Converter\m4atomp3freeconverter.exe" -i3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\M4A to MP3 Free Converter\m4atomp3freeconverter.exe"C:\Users\Admin\AppData\Local\M4A to MP3 Free Converter\m4atomp3freeconverter.exe" -s3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\M4A to MP3 Free Converter\m4atomp3freeconverter.exeFilesize
3.1MB
MD5bfed44ebe92c462e7e223c957033ade9
SHA167b45883c76d4e9f65be9cbcc6aa5cf21f186172
SHA256db347de07a06c66497fbc9bfbc197a9538c8af52a15d4763a556296a5bd6fd94
SHA512bee0aaead7c043f2b45dc5a6cb086f71c7c9338ee4c466009eed46fe6001e5845b32a3b5e3ae8db6f633dae4f0251b44729c0b024f6f7e8764e258b0ac5e6a3c
-
\Users\Admin\AppData\Local\Temp\is-0FK4P.tmp\ec92fd535000437c1d7c6cf896ea3e9583ac656e5d2953da5cdcbb610dae6dd6.tmpFilesize
680KB
MD5dafff71ba13e58daac2c21ed0ed54458
SHA1ec169d6088ee3a539030ef630164dae1dd7d9a80
SHA256167c4af51c1b261fc6bc53d7e4eab5cc5408ac4953518f1dcd129dbe62aca9fb
SHA512ecd2f14d391892f82efea278949c0a20367bec0eefef159ad44915d008b462ba0ffb5b00175c5b7f9b9e1f2779f9ed562eb39cf143dd9f44b550f96a7c9bc719
-
\Users\Admin\AppData\Local\Temp\is-MVAID.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-MVAID.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
memory/1688-12-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1688-63-0x0000000004280000-0x000000000459B000-memory.dmpFilesize
3.1MB
-
memory/1688-76-0x0000000004280000-0x000000000459B000-memory.dmpFilesize
3.1MB
-
memory/1688-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/1704-73-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1704-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1704-3-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/2552-104-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-98-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-134-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-75-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-131-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-79-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-82-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-85-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-88-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-91-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-92-0x00000000026D0000-0x0000000002772000-memory.dmpFilesize
648KB
-
memory/2552-71-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-101-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-128-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-107-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-110-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-113-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-116-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-119-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-122-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2552-125-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2884-65-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2884-66-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB
-
memory/2884-69-0x0000000000400000-0x000000000071B000-memory.dmpFilesize
3.1MB