Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
04-11-2024 10:41
General
-
Target
5c4ee2119304d10dd33b12af034c7d7ea39a88f9af4a8c0b96d983ee716052e9.exe
-
Size
5.4MB
-
MD5
b26dc0a90ffa08282e07197f167c8b34
-
SHA1
018145f6ef8e1cb0dfd20ad911e953e602898ed6
-
SHA256
5c4ee2119304d10dd33b12af034c7d7ea39a88f9af4a8c0b96d983ee716052e9
-
SHA512
3c7d70f2dd3a6f26439dff8ba87329bab873dec3138480491a97e138a582b2f7c04e08b01a0fb7c9315ff7edf561871b99718fbdbb8dae81ac0303a2012ee456
-
SSDEEP
98304:QB3jgjWzNh2gn6HH0mPrLrVs0+T3rOZE78wTgjUrnTqjY0W7xY0UhQiKW7Dkq:cFN0n0sdoTb4qRgjUrdVxFQ71
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of FindShellTrayWindow 1 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c4ee2119304d10dd33b12af034c7d7ea39a88f9af4a8c0b96d983ee716052e9.exe"C:\Users\Admin\AppData\Local\Temp\5c4ee2119304d10dd33b12af034c7d7ea39a88f9af4a8c0b96d983ee716052e9.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-FOEAU.tmp\5c4ee2119304d10dd33b12af034c7d7ea39a88f9af4a8c0b96d983ee716052e9.tmp"C:\Users\Admin\AppData\Local\Temp\is-FOEAU.tmp\5c4ee2119304d10dd33b12af034c7d7ea39a88f9af4a8c0b96d983ee716052e9.tmp" /SL5="$702AC,5456032,54272,C:\Users\Admin\AppData\Local\Temp\5c4ee2119304d10dd33b12af034c7d7ea39a88f9af4a8c0b96d983ee716052e9.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\SyncPlayer 1.8.1\syncplayer.exe"C:\Users\Admin\AppData\Local\SyncPlayer 1.8.1\syncplayer.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD547926d169ab620b5b068214b46ad477c
SHA1dce10d3f271d68e2992b09119ee24ab54580da54
SHA256a327212d8130b83b9fa177f0498ebb1c3ad4498290ac493d3ce6bbbff0eb6776
SHA5122bc524615a734549db0506ba7d6fe48e64307455d5e7f3c5f284f70c6ea12490caa96ce95ec427246340b3a0891f272686774e44269a27119566ff657165e4f0
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
688KB
MD50d1056b9db33b7c4cca8b079c431be68
SHA1f66f62a8bc4214a0671afe811e329b113d466ca0
SHA25682862289e2ef06e15667f5b4e3e9e2091b6e307837958c2cd2d10e4af8a770ef
SHA51294bc126065d3817435e339d0aae6671e7cf33ba8354bb630817802f12573aa91d890ffb80f1ff3c59606348a41091b681f3dce8d705c7d73ac81254626b74048
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
648KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
648KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
648KB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
2.9MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
752KB
-
Filesize
752KB