Analysis
-
max time kernel
140s -
max time network
130s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
11/10/2024, 20:56
Static task
static1
Behavioral task
behavioral1
Sample
stail.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
stail.exe
Resource
win10-20240404-en
Behavioral task
behavioral3
Sample
stail.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral4
Sample
stail.exe
Resource
win11-20240802-en
General
-
Target
stail.exe
-
Size
4.0MB
-
MD5
882f0efe9d2215736da375b3542e1575
-
SHA1
b8f47bc05c2a0d7d336f7c201fc09e6af3b93a41
-
SHA256
1bda055af670cb8e8f37d4860197b58cea1464c16dfaa31fadf42a9eedee8b25
-
SHA512
e385accd0c6300c38abe7f8f55ef9fcb5938cbc5baf69f858a43eb36b36d892888ba6a388643dda1bc09cefffcdbda55549d95edf62dcd35b4b0420da109e888
-
SSDEEP
98304:xdFkdsb9FbCaPoEyB+U9j5bAANbIN8LwjleZvbpmBe:DOSBFpotj5XbW8eqvbpmBe
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral1/memory/2856-108-0x00000000029E0000-0x0000000002A82000-memory.dmp family_socks5systemz behavioral1/memory/2856-131-0x00000000029E0000-0x0000000002A82000-memory.dmp family_socks5systemz behavioral1/memory/2856-132-0x00000000029E0000-0x0000000002A82000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 2 IoCs
pid Process 2112 is-0NJ88.tmp 2856 middlemediaplayer.exe -
Loads dropped DLL 5 IoCs
pid Process 2560 stail.exe 2112 is-0NJ88.tmp 2112 is-0NJ88.tmp 2112 is-0NJ88.tmp 2112 is-0NJ88.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stail.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language is-0NJ88.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language middlemediaplayer.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2560 wrote to memory of 2112 2560 stail.exe 30 PID 2560 wrote to memory of 2112 2560 stail.exe 30 PID 2560 wrote to memory of 2112 2560 stail.exe 30 PID 2560 wrote to memory of 2112 2560 stail.exe 30 PID 2560 wrote to memory of 2112 2560 stail.exe 30 PID 2560 wrote to memory of 2112 2560 stail.exe 30 PID 2560 wrote to memory of 2112 2560 stail.exe 30 PID 2112 wrote to memory of 2856 2112 is-0NJ88.tmp 31 PID 2112 wrote to memory of 2856 2112 is-0NJ88.tmp 31 PID 2112 wrote to memory of 2856 2112 is-0NJ88.tmp 31 PID 2112 wrote to memory of 2856 2112 is-0NJ88.tmp 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\stail.exe"C:\Users\Admin\AppData\Local\Temp\stail.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\is-D16O2.tmp\is-0NJ88.tmp"C:\Users\Admin\AppData\Local\Temp\is-D16O2.tmp\is-0NJ88.tmp" /SL4 $400E0 "C:\Users\Admin\AppData\Local\Temp\stail.exe" 3960739 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112 -
C:\Users\Admin\AppData\Local\Middle Media Player\middlemediaplayer.exe"C:\Users\Admin\AppData\Local\Middle Media Player\middlemediaplayer.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2856
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
MD5b18bc890142dafafa5b2d6bd9f578af4
SHA12001995e693cedcf7c6ddbed64fcea2eec2bd6bc
SHA25687d1a53293dd226a27620cf479bc41d457f8bbc7da775a69c4426de7e22eead6
SHA512e398b96d6b1315dfa823f90ad6eb4fcaab825c83e0ea0c0c94974eedf235b0bd53bb1fd36b0e5f62a858313d30e0da62c306728d3a7c793692f450fe951cf106
-
Filesize
647KB
MD5321dc40b1028537e9da09d6cad16b524
SHA1419dc3963cfe7cdf66a1e23718c52d4dc1623d51
SHA25695acf4477c6c852bc972eb835ce3d99356c7c1298d9533bc7ab005566d89996f
SHA512d11dd58068937d67bb0cfca5ed3ab952c796d7579462a9090ec7c8fa7f5da66c30a9ed42d620b4e7be29eb1654a68aadb9a741e1542a6555297d537f7ee4d177
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3