Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20240729-en -
resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system -
submitted
07-11-2024 22:41
Static task
static1
Behavioral task
behavioral1
Sample
ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe
Resource
win7-20240729-en
Behavioral task
behavioral2
Sample
ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe
Resource
win10v2004-20241007-en
General
-
Target
ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe
-
Size
5.8MB
-
MD5
55ebb627583fb00d5ac3605f08664aa4
-
SHA1
751d12ba6fb70b0b493c7447951d4a4da10580a3
-
SHA256
ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd
-
SHA512
3934b408ab53f134fc115cfbb3c08bfd7621db8e1269264c2c989c5c79ee48814367c20e1bb9bafe61f654627ebc4fc408ee3748209e5a515b159a82e6f066a8
-
SSDEEP
98304:4aSW8ENjhr9z1lpxy1EYcy7DV7ckN2MQK9aeMJPRdZZeZeN8/dzuaaONXSRBV7oY:53jF9ZOEC7tw29VMJPTnebdizwXuYigy
Malware Config
Signatures
-
Detect Socks5Systemz Payload 6 IoCs
resource yara_rule behavioral1/memory/1132-109-0x0000000002AB0000-0x0000000002B52000-memory.dmp family_socks5systemz behavioral1/memory/1132-132-0x0000000002AB0000-0x0000000002B52000-memory.dmp family_socks5systemz behavioral1/memory/1132-133-0x0000000002AB0000-0x0000000002B52000-memory.dmp family_socks5systemz behavioral1/memory/1132-141-0x0000000002AB0000-0x0000000002B52000-memory.dmp family_socks5systemz behavioral1/memory/1132-142-0x0000000002AB0000-0x0000000002B52000-memory.dmp family_socks5systemz behavioral1/memory/1132-143-0x0000000002AB0000-0x0000000002B52000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Executes dropped EXE 2 IoCs
pid Process 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 1132 cutmovie32_64.exe -
Loads dropped DLL 5 IoCs
pid Process 2216 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 141.98.234.31 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cutmovie32_64.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2216 wrote to memory of 2772 2216 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe 30 PID 2216 wrote to memory of 2772 2216 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe 30 PID 2216 wrote to memory of 2772 2216 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe 30 PID 2216 wrote to memory of 2772 2216 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe 30 PID 2216 wrote to memory of 2772 2216 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe 30 PID 2216 wrote to memory of 2772 2216 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe 30 PID 2216 wrote to memory of 2772 2216 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe 30 PID 2772 wrote to memory of 616 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 31 PID 2772 wrote to memory of 616 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 31 PID 2772 wrote to memory of 616 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 31 PID 2772 wrote to memory of 616 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 31 PID 2772 wrote to memory of 1132 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 33 PID 2772 wrote to memory of 1132 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 33 PID 2772 wrote to memory of 1132 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 33 PID 2772 wrote to memory of 1132 2772 ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp 33 PID 616 wrote to memory of 1716 616 net.exe 34 PID 616 wrote to memory of 1716 616 net.exe 34 PID 616 wrote to memory of 1716 616 net.exe 34 PID 616 wrote to memory of 1716 616 net.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe"C:\Users\Admin\AppData\Local\Temp\ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Users\Admin\AppData\Local\Temp\is-04I5V.tmp\ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp"C:\Users\Admin\AppData\Local\Temp\is-04I5V.tmp\ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp" /SL5="$4010A,5850870,56832,C:\Users\Admin\AppData\Local\Temp\ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" pause cut_movie_11743⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 pause cut_movie_11744⤵
- System Location Discovery: System Language Discovery
PID:1716
-
-
-
C:\Users\Admin\AppData\Local\Cut Movie 19.3.35\cutmovie32_64.exe"C:\Users\Admin\AppData\Local\Cut Movie 19.3.35\cutmovie32_64.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1132
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.5MB
MD554f0100366b2a4186814cbf0ce7b590c
SHA154e6e62348fe82d92b28a216185ef5b3d3036f6a
SHA2562d81f47c95caa3d65efedc3bb37718e85e77d819b00896a1df7fb7729a0b7257
SHA512a49de2b4e4d9606c296482fd7e6e69312361159371555a185ee22f1ccddadb27eebe0218d328ac9407a768e999d691b63db3dadfceba63516fae3b69016834bf
-
\Users\Admin\AppData\Local\Temp\is-04I5V.tmp\ae24275f5299cf7d209a13a7315e271d5fd0ea728ce2371e7b65045b196053fd.tmp
Filesize692KB
MD528838580325da7ae59739e5e3961b2f2
SHA1161f1b9afbbc27813016ee514989ff243076da71
SHA25672b954bbb237e3edda77ebf9043a6c4e90f80dc21c01ae2c4d2c51ff356f6746
SHA51221d869bfd62a11dd9370bdc7a9c49fe5d16eb2327b0d2b69d1ef3eefe00ff20482e517fa251e21139a7136b2c2c16f61c75ccf977bb1c03552cb2744120409d5
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3