Overview
overview
10Static
static
80d406f17fa...7d.exe
windows7-x64
100d406f17fa...7d.exe
windows10-2004-x64
101396699458...83.elf
debian-12-armhf
118753a0cb6...76.exe
windows7-x64
1018753a0cb6...76.exe
windows10-2004-x64
1030a973e75f...89.xls
windows7-x64
130a973e75f...89.xls
windows10-2004-x64
13214e308dc...fb.exe
windows7-x64
103214e308dc...fb.exe
windows10-2004-x64
10361cd32a75...b5.elf
debian-12-armhf
960be4a7179...3e.elf
debian-9-armhf
96559c81490...6c.exe
windows7-x64
106559c81490...6c.exe
windows10-2004-x64
106845e34952...cc.elf
debian-9-armhf
96fdf5b4b08...0b.elf
debian-12-mipsel
744daca400...ee.exe
windows7-x64
10744daca400...ee.exe
windows10-2004-x64
107dc25c4e1e...91.exe
windows7-x64
107dc25c4e1e...91.exe
windows10-2004-x64
10819e3765d5...4d.elf
ubuntu-24.04-amd64
9835e27dcd5...73.exe
windows7-x64
7835e27dcd5...73.exe
windows10-2004-x64
78ed5281c02...d4.elf
ubuntu-22.04-amd64
8fd73ae7fb...da.exe
windows7-x64
108fd73ae7fb...da.exe
windows10-2004-x64
10add0cec032...26.exe
windows7-x64
10add0cec032...26.exe
windows10-2004-x64
10ae7dfe0fe3...a6.exe
windows7-x64
10ae7dfe0fe3...a6.exe
windows10-2004-x64
10b218376076...26.exe
windows7-x64
10b218376076...26.exe
windows10-2004-x64
10c7305e86e9...38.exe
windows7-x64
8Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
19-06-2024 11:31
Behavioral task
behavioral1
Sample
0d406f17fa6d208a7c58e0907883c1a626ea38f4db206621fd241f8d62f8277d.exe
Resource
win7-20240611-en
Behavioral task
behavioral2
Sample
0d406f17fa6d208a7c58e0907883c1a626ea38f4db206621fd241f8d62f8277d.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
13966994581adf90c88d36fff75eb33c4a79557cf55fd616124a8c77f883e983.elf
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral4
Sample
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe
Resource
win7-20240221-en
Behavioral task
behavioral5
Sample
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral6
Sample
30a973e75f85a9ee9063fc4b17e5c6704f2e58ebfef7abe3e1d55c16f51b2e89.xls
Resource
win7-20240221-en
Behavioral task
behavioral7
Sample
30a973e75f85a9ee9063fc4b17e5c6704f2e58ebfef7abe3e1d55c16f51b2e89.xls
Resource
win10v2004-20240508-en
Behavioral task
behavioral8
Sample
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe
Resource
win7-20240611-en
Behavioral task
behavioral9
Sample
3214e308dc291ff3e86eefd6f1e36883e9ebe60aa92e8b3f55a0f7ae730790fb.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral10
Sample
361cd32a750b89857322f54b665f7f8849407ba09074e6303be0f26a351f39b5.elf
Resource
debian12-armhf-20240418-en
Behavioral task
behavioral11
Sample
60be4a7179ddc4d9f12fba876443b3d782508b26fd3a93f89c4d128396abcb3e.elf
Resource
debian9-armhf-20240418-en
Behavioral task
behavioral12
Sample
6559c8149044fde6c8d7ba12ef151a181a3635d0e5ea673cdbb65aaea3d4156c.exe
Resource
win7-20240611-en
Behavioral task
behavioral13
Sample
6559c8149044fde6c8d7ba12ef151a181a3635d0e5ea673cdbb65aaea3d4156c.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral14
Sample
6845e34952a416113dbc6fbffae8245d708c9bab6dc801c16f34a84744a3b7cc.elf
Resource
debian9-armhf-20240611-en
Behavioral task
behavioral15
Sample
6fdf5b4b08a5894339c26249e190ce627b9585af846573098bed2c050d0ae80b.elf
Resource
debian12-mipsel-20240221-en
Behavioral task
behavioral16
Sample
744daca400af1f5721eaa529ec3fe427e4837e17ff4766f6bb39643aa488bfee.exe
Resource
win7-20240221-en
Behavioral task
behavioral17
Sample
744daca400af1f5721eaa529ec3fe427e4837e17ff4766f6bb39643aa488bfee.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral18
Sample
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe
Resource
win7-20240508-en
Behavioral task
behavioral19
Sample
7dc25c4e1ebd89f13aa8ecc4fb141a9bf297851781c82d7cb630ce1802e52791.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral20
Sample
819e3765d5c40a66951c194f67cdb783e1a711cc3499dd44a43d1cfdec06af4d.elf
Resource
ubuntu2404-amd64-20240523-en
Behavioral task
behavioral21
Sample
835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral23
Sample
8ed5281c024dc7cf99273c32faa92e358392272a01898958399e324e666c4fd4.elf
Resource
ubuntu2204-amd64-20240522.1-en
Behavioral task
behavioral24
Sample
8fd73ae7fb9da6bf5d793b56d1cd12a0f2cd342236cca599fb92ecdc1ea700da.exe
Resource
win7-20240508-en
Behavioral task
behavioral25
Sample
8fd73ae7fb9da6bf5d793b56d1cd12a0f2cd342236cca599fb92ecdc1ea700da.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral26
Sample
add0cec032cff1069925f00734c1296bd4e305c4e07006b3b0fa3b9497d8e626.exe
Resource
win7-20240221-en
Behavioral task
behavioral27
Sample
add0cec032cff1069925f00734c1296bd4e305c4e07006b3b0fa3b9497d8e626.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral28
Sample
ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe
Resource
win7-20231129-en
Behavioral task
behavioral29
Sample
ae7dfe0fe3ea9ba1dae5221072a51896c9b6c8384eb6514fb9dacbf9d6c7fca6.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral30
Sample
b2183760768b6dffb3c3f4c28510c6e32cae125d46f5d4e046bbdfd860d46b26.exe
Resource
win7-20240611-en
Behavioral task
behavioral31
Sample
b2183760768b6dffb3c3f4c28510c6e32cae125d46f5d4e046bbdfd860d46b26.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral32
Sample
c7305e86e90093f34bae25efd97eb5a8fed3a6b985b1633ee99ffff608211838.exe
Resource
win7-20240611-en
General
-
Target
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe
-
Size
4.7MB
-
MD5
d30043dfaa42f25de126e50c5e9ed047
-
SHA1
c80d749438fe7d51b92c6fa6b3274681347419a5
-
SHA256
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076
-
SHA512
70a454e8dfa2ee462f4983c89a726ec8bf1d77a97546cc3f48392c6a31e7588cccab7eb591630443b12e5feb351a79cc682edc81e9ac481b530f426383bf11c1
-
SSDEEP
98304:mhV9nxxynoPMx+Us2wdqATwnwxZNjPp/nMe53rCkUmFail6IGx:FozdUnkbPp/bUm7l6P
Malware Config
Extracted
socks5systemz
erqrieg.ua
http://erqrieg.ua/search/?q=67e28dd83e0bfb2e455aa5187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f171ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff716c9e9929d32
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral5/memory/2352-88-0x0000000000960000-0x0000000000A02000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmpvirtualsoundcard32.exevirtualsoundcard32.exepid process 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp 1828 virtualsoundcard32.exe 2352 virtualsoundcard32.exe -
Loads dropped DLL 1 IoCs
Processes:
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmppid process 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmppid process 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmpdescription pid process target process PID 4532 wrote to memory of 4892 4532 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp PID 4532 wrote to memory of 4892 4532 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp PID 4532 wrote to memory of 4892 4532 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp PID 4892 wrote to memory of 1828 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp virtualsoundcard32.exe PID 4892 wrote to memory of 1828 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp virtualsoundcard32.exe PID 4892 wrote to memory of 1828 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp virtualsoundcard32.exe PID 4892 wrote to memory of 2352 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp virtualsoundcard32.exe PID 4892 wrote to memory of 2352 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp virtualsoundcard32.exe PID 4892 wrote to memory of 2352 4892 18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp virtualsoundcard32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe"C:\Users\Admin\AppData\Local\Temp\18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Users\Admin\AppData\Local\Temp\is-U1KI1.tmp\18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp"C:\Users\Admin\AppData\Local\Temp\is-U1KI1.tmp\18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmp" /SL5="$801DA,4643210,54272,C:\Users\Admin\AppData\Local\Temp\18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4892 -
C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard32.exe"C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard32.exe" -i3⤵
- Executes dropped EXE
PID:1828 -
C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard32.exe"C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard32.exe" -s3⤵
- Executes dropped EXE
PID:2352
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-3NJ3F.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-U1KI1.tmp\18753a0cb65d2b75bd60b82de5ac799c5bc39eab29014c5a57fc04685da72076.tmpFilesize
680KB
MD56d75c2498ef0af9a91b71d0d81d1b95e
SHA11476ec8e947af9a397658bec20b17854042cc0c3
SHA256468db6dd9e5c87c34d9cb7e56ddbfaf068bbe44436fa2cfc2ada8029051e4bee
SHA512bdc9b460a463da60c019eda9dd40929a61e77081b699d6c3a4c05309280252f7493015cf463243ff9dd3e20ddd324db39a8697f312fabfea64c78aed9ddb5027
-
C:\Users\Admin\AppData\Local\Virtual Sound Card\virtualsoundcard32.exeFilesize
2.7MB
MD5bc0c473b23c44af01cbb8ba970117f3e
SHA18ad4bc8affeb71150f173953d540d61e3d558bac
SHA256b42200048f2fd7ada339a47e6b5c27ba772ec4b72072a98aacb9b05997bd8786
SHA512d0067e036fa993bdd1a6d287215676c972db958165324a9ed7c8e325558530a4d2b979f0150d508f5fa671957101df023791d22f027ad38ab29e46e626b68d11
-
memory/1828-60-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/1828-63-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/1828-65-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/1828-59-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-72-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-99-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-67-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-118-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-69-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-115-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-111-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-108-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-75-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-76-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-79-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-82-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-85-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-88-0x0000000000960000-0x0000000000A02000-memory.dmpFilesize
648KB
-
memory/2352-91-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-96-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-105-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/2352-102-0x0000000000400000-0x00000000006BF000-memory.dmpFilesize
2.7MB
-
memory/4532-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4532-70-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/4532-2-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/4892-13-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/4892-71-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB