Analysis
-
max time kernel
123s -
max time network
134s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
02-11-2024 05:58
General
-
Target
75e722495c157a05b557580863f90b856d6ec229c7cb4974a008c823377369f5.exe
-
Size
4.1MB
-
MD5
dc89c50e4c8399de48d3e16568d20c19
-
SHA1
b20e3f6df7af6d1bccd7377c04567e1895fb968f
-
SHA256
75e722495c157a05b557580863f90b856d6ec229c7cb4974a008c823377369f5
-
SHA512
12e2ce5f6526948c8a43858f54f133dce6cd5bd7b80b170623f7386408ae8c7a7d293df41b14a46d4dc8efc871798f8111ec951275b2a3fb10eec54634968cfd
-
SSDEEP
98304:ISLPnq/pTlAt97SLFFfm/SnP02BOCu0FyxoQFjoJ+cK:vPnqNlk2Bd/cCT0xoy8Jw
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\75e722495c157a05b557580863f90b856d6ec229c7cb4974a008c823377369f5.exe"C:\Users\Admin\AppData\Local\Temp\75e722495c157a05b557580863f90b856d6ec229c7cb4974a008c823377369f5.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-H3OBM.tmp\75e722495c157a05b557580863f90b856d6ec229c7cb4974a008c823377369f5.tmp"C:\Users\Admin\AppData\Local\Temp\is-H3OBM.tmp\75e722495c157a05b557580863f90b856d6ec229c7cb4974a008c823377369f5.tmp" /SL5="$602B6,4069819,54272,C:\Users\Admin\AppData\Local\Temp\75e722495c157a05b557580863f90b856d6ec229c7cb4974a008c823377369f5.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder3264.exe"C:\Users\Admin\AppData\Local\AScreenRecorder\ascreenrecorder3264.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.0MB
MD50572dd47bb905400cd4ad2ee6dc30e18
SHA1fc098bca7c1935739cf162bb4744b9769c7bf7b0
SHA2562b3e28727cf4ef3af0fb5a0f2c7e50946d57ea8871fcf4ccaf7201b243fbec61
SHA512ab184031dcff2e13f56a95e78045a34989e2532ad0316d344fdf269f8a6f7671f872eccc06b1033c72137a78158c7d130ecacd419af30e8f942e9ddc49541e7c
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
689KB
MD53f90052a7964226829c200d8bd265bcc
SHA1b71523bf083e8170712c790c30c7356ad952d5ff
SHA256da886079ca7de500a5ef6d02a855002b93bdf6f38022c414dca430cc4f4c58b1
SHA5122670cdab96df304793f23d3ad3e78df53e7266d50630a9d748ba24268db0afad9e9a94f53dbde185e56b78fce98aae3036cdf0122628c2c13f3cd132dba7804a
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
648KB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
648KB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
648KB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
3.0MB
-
Filesize
40KB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
752KB
-
Filesize
752KB