Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09-10-2024 22:54
Static task
static1
Behavioral task
behavioral1
Sample
2ec886d8770da09928682590d15d7404.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
2ec886d8770da09928682590d15d7404.exe
Resource
win10v2004-20241007-en
General
-
Target
2ec886d8770da09928682590d15d7404.exe
-
Size
3.8MB
-
MD5
2ec886d8770da09928682590d15d7404
-
SHA1
56e22d3d0272c3cbc4abb8ed2e5c2507f70eac5c
-
SHA256
17c98b33f87befc913c8d67314190cd05597717c49090b50d8c8a04f6ad22e2f
-
SHA512
454570cab426425c0ef8804e8b27cb9aebac490c6c087aff116a690430b2e12e0f74b7ac9573fed6e0ad9d4a2ba7d07b802843728102735000a99095a585b103
-
SSDEEP
98304:xdogpKn3xqbthT3457Gj822hIY/h77nnxan4PiJ9xx9bpmBeE:DogpS3EhUwwh/Bg8o9dbpmBeE
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
resource yara_rule behavioral1/memory/2844-108-0x0000000002E90000-0x0000000002F32000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 2 IoCs
pid Process 2088 is-9Q5E8.tmp 2844 superplay3_3264.exe -
Loads dropped DLL 5 IoCs
pid Process 2248 2ec886d8770da09928682590d15d7404.exe 2088 is-9Q5E8.tmp 2088 is-9Q5E8.tmp 2088 is-9Q5E8.tmp 2088 is-9Q5E8.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2ec886d8770da09928682590d15d7404.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language is-9Q5E8.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language superplay3_3264.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2248 wrote to memory of 2088 2248 2ec886d8770da09928682590d15d7404.exe 31 PID 2248 wrote to memory of 2088 2248 2ec886d8770da09928682590d15d7404.exe 31 PID 2248 wrote to memory of 2088 2248 2ec886d8770da09928682590d15d7404.exe 31 PID 2248 wrote to memory of 2088 2248 2ec886d8770da09928682590d15d7404.exe 31 PID 2248 wrote to memory of 2088 2248 2ec886d8770da09928682590d15d7404.exe 31 PID 2248 wrote to memory of 2088 2248 2ec886d8770da09928682590d15d7404.exe 31 PID 2248 wrote to memory of 2088 2248 2ec886d8770da09928682590d15d7404.exe 31 PID 2088 wrote to memory of 2844 2088 is-9Q5E8.tmp 32 PID 2088 wrote to memory of 2844 2088 is-9Q5E8.tmp 32 PID 2088 wrote to memory of 2844 2088 is-9Q5E8.tmp 32 PID 2088 wrote to memory of 2844 2088 is-9Q5E8.tmp 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ec886d8770da09928682590d15d7404.exe"C:\Users\Admin\AppData\Local\Temp\2ec886d8770da09928682590d15d7404.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248 -
C:\Users\Admin\AppData\Local\Temp\is-AT1NQ.tmp\is-9Q5E8.tmp"C:\Users\Admin\AppData\Local\Temp\is-AT1NQ.tmp\is-9Q5E8.tmp" /SL4 $400F4 "C:\Users\Admin\AppData\Local\Temp\2ec886d8770da09928682590d15d7404.exe" 3756095 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Users\Admin\AppData\Local\Super Play 3\superplay3_3264.exe"C:\Users\Admin\AppData\Local\Super Play 3\superplay3_3264.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2844
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.4MB
MD51b46202194d6a15fd291e373466c9988
SHA183350a463d48844070ac5bdffb8869f7da951a30
SHA256a0f318d0200872b4d54fd56ad7baab9ed2b11cf0a1a4cd3034874e5d9c086cf0
SHA5126cb37a56cf15d5b67b5983e296c0f83318f1bf06a37409860472ee87094991e96a35601fd2560d66121fe59310c0c34f09c051535845e219c8248bb40ee13e69
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
Filesize
647KB
MD55ec1c51da61b4f15b2f40339d7d1df7c
SHA1bab46af9f3d1d78130d73951022b163720bc040f
SHA256ae8d36e1edc71bcb37c4636e2c8b364698f0238039cb7e12571022a94fb66897
SHA512b2b208e0b9d3508bf958dda89d16286921664833de9d237ec61cc9402f36ce380cc361dcf4b1373505af6e56254515c74f49d58a099c5da90f9052697342825e