General
-
Target
8695cb31a2a9c33abe6865a8ac17d6850e7f1b26c002ce27cae268cfb7141088
-
Size
5.1MB
-
Sample
240627-bg4m5sthmh
-
MD5
537e02c3cb450055eb389e8e1064c4d8
-
SHA1
9f8d688fd10c5ea0b51775c08a32978db7af803e
-
SHA256
8695cb31a2a9c33abe6865a8ac17d6850e7f1b26c002ce27cae268cfb7141088
-
SHA512
ea2e1ce2dbbafe747986b9252482b5c86cf5215cfa91a3a778d8189de00e921241790ae50c09615fc38b5e4d968f7d067006694978002c31d8de12260e89de19
-
SSDEEP
98304:mqIxk/nj0UU7+08l6g5DffQL9jod8nUcfYlzw0ll8ramD6J5wmEoOlEMCfcS:fISnj0n7al6g1f8MEDfGzw0llYI7OByH
Static task
static1
Behavioral task
behavioral1
Sample
8695cb31a2a9c33abe6865a8ac17d6850e7f1b26c002ce27cae268cfb7141088.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral2
Sample
8695cb31a2a9c33abe6865a8ac17d6850e7f1b26c002ce27cae268cfb7141088.exe
Resource
win11-20240611-en
Malware Config
Extracted
socks5systemz
ddeedah.info
http://ddeedah.info/search/?q=67e28dd83e0bfb2e455aa5187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f171ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff615c5ef90993d
http://ddeedah.info/search/?q=67e28dd83e0bfb2e455aa5187c27d78406abdd88be4b12eab517aa5c96bd86ef9c814e855a8bbc896c58e713bc90c91f36b5281fc235a925ed3e52d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee9c9e3ecd6a9510
ckowqif.net
http://ckowqif.net/search/?q=67e28dd83d0ea428165baf167c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a371ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ff615c5ef909933
http://ckowqif.net/search/?q=67e28dd83d0ea428165baf167c27d78406abdd88be4b12eab517aa5c96bd86e9978044815a8bbc896c58e713bc90c91936b5281fc235a925ed3e00d6bd974a95129070b616e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee9c9e3ecd6a951e
Targets
-
-
Target
8695cb31a2a9c33abe6865a8ac17d6850e7f1b26c002ce27cae268cfb7141088
-
Size
5.1MB
-
MD5
537e02c3cb450055eb389e8e1064c4d8
-
SHA1
9f8d688fd10c5ea0b51775c08a32978db7af803e
-
SHA256
8695cb31a2a9c33abe6865a8ac17d6850e7f1b26c002ce27cae268cfb7141088
-
SHA512
ea2e1ce2dbbafe747986b9252482b5c86cf5215cfa91a3a778d8189de00e921241790ae50c09615fc38b5e4d968f7d067006694978002c31d8de12260e89de19
-
SSDEEP
98304:mqIxk/nj0UU7+08l6g5DffQL9jod8nUcfYlzw0ll8ramD6J5wmEoOlEMCfcS:fISnj0n7al6g1f8MEDfGzw0llYI7OByH
Score10/10-
Detect Socks5Systemz Payload
-
Executes dropped EXE
-
Loads dropped DLL
-
Unexpected DNS network traffic destination
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system
Looks up Uninstall key entries in the registry to enumerate software on the system.
-