Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows11-21h2_x64 -
resource
win11-20240611-en -
resource tags
arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system -
submitted
25-06-2024 10:20
Static task
static1
Behavioral task
behavioral1
Sample
dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe
Resource
win11-20240611-en
General
-
Target
dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe
-
Size
4.8MB
-
MD5
9a7814ca4122cc8ca1c4554a0bc11c7b
-
SHA1
210492d1bf16507f03e1c3647a05fb9e0ae018d4
-
SHA256
dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8
-
SHA512
9f301aad602f9b158c6b7d717a2b7b1e3929736f980bedb74890bf29f19a106058996d2bf70d604cd1aae72835d56cace61d4157ed94f7c563b12db36a8c29c0
-
SSDEEP
98304:mTS0f8Lu0KG7UPFRN0OalsPmx0zgoPUG2DYd:qiLu0KOlSzDPPZ
Malware Config
Extracted
socks5systemz
bumlrvi.com
http://bumlrvi.com/search/?q=67e28dd86459a42c4009ab4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978f171ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ff612c1ef9c9b3a
http://bumlrvi.com/search/?q=67e28dd86459a42c4009ab4e7c27d78406abdd88be4b12eab517aa5c96bd86ea93834896148ab2865b77f80ebad9c50f7cb63037ed2ab423a4344383ba915d911ec07bb606a0708727e40ea678c751bbe34efb0e2807e12571c17f3e83fe16c1e6969b3bc46e97
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2496-88-0x00000000008C0000-0x0000000000962000-memory.dmp family_socks5systemz behavioral2/memory/2496-111-0x00000000008C0000-0x0000000000962000-memory.dmp family_socks5systemz behavioral2/memory/2496-112-0x00000000008C0000-0x0000000000962000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmpmp3ripfreeedition.exemp3ripfreeedition.exepid process 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp 1528 mp3ripfreeedition.exe 2496 mp3ripfreeedition.exe -
Loads dropped DLL 1 IoCs
Processes:
dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmppid process 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmppid process 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exedd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmpdescription pid process target process PID 1476 wrote to memory of 240 1476 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp PID 1476 wrote to memory of 240 1476 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp PID 1476 wrote to memory of 240 1476 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp PID 240 wrote to memory of 1528 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp mp3ripfreeedition.exe PID 240 wrote to memory of 1528 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp mp3ripfreeedition.exe PID 240 wrote to memory of 1528 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp mp3ripfreeedition.exe PID 240 wrote to memory of 2496 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp mp3ripfreeedition.exe PID 240 wrote to memory of 2496 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp mp3ripfreeedition.exe PID 240 wrote to memory of 2496 240 dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp mp3ripfreeedition.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe"C:\Users\Admin\AppData\Local\Temp\dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\is-9TKNL.tmp\dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp"C:\Users\Admin\AppData\Local\Temp\is-9TKNL.tmp\dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp" /SL5="$4022E,4749319,54272,C:\Users\Admin\AppData\Local\Temp\dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Users\Admin\AppData\Local\MP3 RIP Free Edition\mp3ripfreeedition.exe"C:\Users\Admin\AppData\Local\MP3 RIP Free Edition\mp3ripfreeedition.exe" -i3⤵
- Executes dropped EXE
PID:1528
-
-
C:\Users\Admin\AppData\Local\MP3 RIP Free Edition\mp3ripfreeedition.exe"C:\Users\Admin\AppData\Local\MP3 RIP Free Edition\mp3ripfreeedition.exe" -s3⤵
- Executes dropped EXE
PID:2496
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD5e8801950bdfbd7cfa93392db9d3790fe
SHA1f4be734379ed1ea38ebeb7e9e53d5b8a5288ca97
SHA2568251c64ca9eabd7b0ca51e97bb9e148d119f840e0792e389137e3da70a3c063c
SHA5129f6851c5d4a7caef4df38f2966b193fb45675208c2074499e04cdb2bbc22929c6566390da28073abc9e47a45b440ac7aba2c7c4837f74e3baac9aec02f42e323
-
C:\Users\Admin\AppData\Local\Temp\is-9TKNL.tmp\dd520bfd993f321fae25b86b9b0c05ee2bab51cdc4b4cb5c6dc6cd0dc80570a8.tmp
Filesize680KB
MD5e8f92ef4f6a6bd645173f2b208a1480a
SHA1598ad6a8f2f48a797157cd9a42a830bcb86685f5
SHA2563411c3185fee7fd0b74d0faa31af1ff2997ab916eed55f2ef3c99ccaf0e8b27e
SHA5126900f01866513efd5f00598269ef7493166821e6dcd3d435936bde4416e5dfac1335dd3156351e6f9b1520e23defbbe99ccb09380962afef3cdcbff3272887e1
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63