Analysis
-
max time kernel
141s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
30-10-2024 10:52
General
-
Target
d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe
-
Size
4.5MB
-
MD5
309f1a7dd94f69097297bf997578ee96
-
SHA1
3e031317d5e5408e3f9bebc55edf56e76af5b386
-
SHA256
d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c
-
SHA512
4219a80f3db0d30bc63c8f23e77d97b931a2303b11068a58ef1ea90ac9b07cd1f5b0ab14200a74b8678b0b0b99ff368c3dd277728a50b3422619d8a6425f5c8e
-
SSDEEP
98304:IU5dKRQjk0ZWvBpVR0k3v5l4oBQwvmOBLLEsEJl7OA8ijuhmgDjKu4Rxz:/5kRQjpWvz9fVruOpEsEJl7JNjM6dRV
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe"C:\Users\Admin\AppData\Local\Temp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-DVQSP.tmp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp"C:\Users\Admin\AppData\Local\Temp\is-DVQSP.tmp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.tmp" /SL5="$801E6,4443113,54272,C:\Users\Admin\AppData\Local\Temp\d7722e3dc9ed3da33cb9b69854bd30ca527eff89f95ba988678d15fca3563f2c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder32.exe"C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder32.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD5551a95d6d8458a580dc0b5a8cd3e3b45
SHA184731b5f59f835eb993e38931d0dcac0890df5d5
SHA25640fc3cd56fbf9312138bdaab4212fde480662b780bf6956493b0e648b35f0bab
SHA512db770627e5462469341136268cecde5c6d94de9c61cb320f86f7ab70ea5a185c73d1be698af171f585c878dc121e57677b66c22a828b30522af6b0ec636b5938
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
689KB
MD5deb81fa5ce36730b9984e68d0631bbe9
SHA14fdaf40d4ac800071355308305222799a9109f86
SHA2565622e1aed3d14c495ea8622acbecda69355e681282f47f8c3cf4be34c5ce9e26
SHA512f3e9d22d97668a6053d33be1774a6f3f8a35b8e17f872289fca90d4b271d2e5f59a1986e441ec2ab81c4f1d3eddae3255d13b9d6264281c97891856518d21c64
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
2.9MB
-
Filesize
648KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
648KB
-
Filesize
648KB
-
Filesize
752KB
-
Filesize
752KB