Analysis

  • max time kernel
    111s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    10-11-2024 16:45

General

  • Target

    545160402919f25ad903f04124a325695527a66168fdf8094b554554126b1151N.exe

  • Size

    5.9MB

  • MD5

    8a7bb92c029592c20a43dfe8b2765730

  • SHA1

    5a43077baa53dbecc23170e69ae32a547299d8ab

  • SHA256

    545160402919f25ad903f04124a325695527a66168fdf8094b554554126b1151

  • SHA512

    3c89532801e9b06e4203f49128718720fb309601839d133eccc921f7b2a934425b23aefb7194d4560dedd1ff955d5db7720798483d295dcc1340a7ece6310fae

  • SSDEEP

    98304:44vRPrY8ct5HRMMvE5lbJ2+le2CZien2w0emgsG9ZvN33AKSl:vr7QHRQjQPQVgsIFq

Malware Config

Signatures

  • Detect Socks5Systemz Payload 1 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Socks5systemz family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\545160402919f25ad903f04124a325695527a66168fdf8094b554554126b1151N.exe
    "C:\Users\Admin\AppData\Local\Temp\545160402919f25ad903f04124a325695527a66168fdf8094b554554126b1151N.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4496
    • C:\Users\Admin\AppData\Local\Temp\is-AQPQA.tmp\545160402919f25ad903f04124a325695527a66168fdf8094b554554126b1151N.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-AQPQA.tmp\545160402919f25ad903f04124a325695527a66168fdf8094b554554126b1151N.tmp" /SL5="$A0068,5890217,56832,C:\Users\Admin\AppData\Local\Temp\545160402919f25ad903f04124a325695527a66168fdf8094b554554126b1151N.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1368
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" pause cut_movie_1173
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:2336
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 pause cut_movie_1173
          4⤵
          • System Location Discovery: System Language Discovery
          PID:932
      • C:\Users\Admin\AppData\Local\Cut Movie 2020.3.34\cutmovie32.exe
        "C:\Users\Admin\AppData\Local\Cut Movie 2020.3.34\cutmovie32.exe" -i
        3⤵
        • Executes dropped EXE
        • System Location Discovery: System Language Discovery
        PID:1452

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Cut Movie 2020.3.34\cutmovie32.exe

    Filesize

    3.6MB

    MD5

    818901e977eecec84539cb763fc7fde9

    SHA1

    f4bd5c72fd2f5b6c5150504e2c75518b3f96c8cc

    SHA256

    baca49f9561d7cf0e760acf01431fe58259fe1b6a9fbfe974d455f4e4b204416

    SHA512

    a20e1a69b2841a1bae2d7ab3961b59649b103ed6523f145b77aad59efae6576c8b3fbea36851e5834b4d0c93930ba0a15b82481498f11f60bfe35436d9497bc8

  • C:\Users\Admin\AppData\Local\Temp\is-5S293.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • C:\Users\Admin\AppData\Local\Temp\is-AQPQA.tmp\545160402919f25ad903f04124a325695527a66168fdf8094b554554126b1151N.tmp

    Filesize

    692KB

    MD5

    8d0efda21efb3632087dfc1e0c453d6b

    SHA1

    ce9fb5248583d80961c985a786c7fcdf7dec6bf2

    SHA256

    a943b2d37a1a038079264319d261078bd3fb9508db52d39b90977b242074217a

    SHA512

    e5a21d5e57bd4e5b9f4779ce5a22d3d37905fbb84e69d3392b4b314d39abd21dc012c4ef1e7583f3435a7a8390514ffc971bfbdf0fe7a09abe8872c1b014cb57

  • memory/1368-84-0x0000000000400000-0x00000000004BD000-memory.dmp

    Filesize

    756KB

  • memory/1368-6-0x0000000000400000-0x00000000004BD000-memory.dmp

    Filesize

    756KB

  • memory/1452-88-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-105-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-81-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-83-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-125-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-122-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-87-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-119-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-91-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-94-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-97-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-100-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-104-0x0000000000A10000-0x0000000000AB2000-memory.dmp

    Filesize

    648KB

  • memory/1452-80-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-112-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-115-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/1452-116-0x0000000000400000-0x00000000007A7000-memory.dmp

    Filesize

    3.7MB

  • memory/4496-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/4496-85-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4496-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB