Analysis

  • max time kernel
    142s
  • max time network
    128s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-11-2024 09:03

General

  • Target

    18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe

  • Size

    5.8MB

  • MD5

    ac760eaf97ff184b95bb0130537d22f3

  • SHA1

    34ce346debea4de39b700524d58183ff34302190

  • SHA256

    18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2

  • SHA512

    796abc18e07064715746beca2380a59310e6218a91340e9cf6ca98fe9da3bd771de63e98594d4fff1c7052e55c762698e097252a95d2fadcd6985e548b70fbb7

  • SSDEEP

    98304:NKjj93l3hNdqgzFVlhOnBhl9GeZHWI+Zbca7zkFMKJFsuzoq6t95a4kdmp:MjjVqgzFnhAlr2txuzMtIS

Malware Config

Signatures

  • Detect Socks5Systemz Payload 3 IoCs
  • Socks5Systemz

    Socks5Systemz is a botnet written in C++.

  • Socks5systemz family
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Unexpected DNS network traffic destination 1 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe
    "C:\Users\Admin\AppData\Local\Temp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2340
    • C:\Users\Admin\AppData\Local\Temp\is-95VLA.tmp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp
      "C:\Users\Admin\AppData\Local\Temp\is-95VLA.tmp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp" /SL5="$80070,5818534,54272,C:\Users\Admin\AppData\Local\Temp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\system32\net.exe" pause screenstudio_11174
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3172
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 pause screenstudio_11174
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4904
      • C:\Users\Admin\AppData\Local\Screen Studio 1.42\screenstudio3.exe
        "C:\Users\Admin\AppData\Local\Screen Studio 1.42\screenstudio3.exe" -i
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:4352

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Screen Studio 1.42\screenstudio3.exe

    Filesize

    6.6MB

    MD5

    cf982bdbe7b0b22007f029a24cac00cc

    SHA1

    54db7f914d2a55b79c5897af8cfd8f439289e2ef

    SHA256

    89399bb260cca725f5d6aa3ac76581fcd1baca215bc7b54d3a71144445e1d945

    SHA512

    a89079b901a7e3d6f253f008081afc7e8bdeba8524d92b8672c1d47cf7ff5c3c6f07e8ff55dbe85ae1477de11b82dcb28ed4ce1a8ae6ed187132cf1334c704a5

  • C:\Users\Admin\AppData\Local\Screen Studio 1.42\sqlite3.dll

    Filesize

    630KB

    MD5

    e477a96c8f2b18d6b5c27bde49c990bf

    SHA1

    e980c9bf41330d1e5bd04556db4646a0210f7409

    SHA256

    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

    SHA512

    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

  • C:\Users\Admin\AppData\Local\Temp\is-47844.tmp\_isetup\_iscrypt.dll

    Filesize

    2KB

    MD5

    a69559718ab506675e907fe49deb71e9

    SHA1

    bc8f404ffdb1960b50c12ff9413c893b56f2e36f

    SHA256

    2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

    SHA512

    e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

  • C:\Users\Admin\AppData\Local\Temp\is-95VLA.tmp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp

    Filesize

    692KB

    MD5

    4d3a2bb8d7a7dfcfeee20f95757d29e4

    SHA1

    4ca66ee00b950e6c45c09263b0e451039c572e96

    SHA256

    88f7d0bc0c2cea9ac3ad806480310c9deae405ba505f6a19f9591115b6cbc57d

    SHA512

    920d30524b4e1bf7cb3556a578459be4e9122e8c8716e34310fd70ae1deded50bad8bf7a03a46db46557b2e5500a523511a0bb9ddacf2dd966016e98a7cc6e74

  • memory/1964-16-0x0000000000400000-0x00000000004BD000-memory.dmp

    Filesize

    756KB

  • memory/1964-74-0x0000000000400000-0x00000000004BD000-memory.dmp

    Filesize

    756KB

  • memory/2340-73-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/2340-2-0x0000000000401000-0x000000000040B000-memory.dmp

    Filesize

    40KB

  • memory/2340-0-0x0000000000400000-0x0000000000414000-memory.dmp

    Filesize

    80KB

  • memory/4352-79-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-105-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-69-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-76-0x0000000060900000-0x0000000060992000-memory.dmp

    Filesize

    584KB

  • memory/4352-75-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-68-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-83-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-87-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-91-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-95-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-97-0x0000000000BE0000-0x0000000000C82000-memory.dmp

    Filesize

    648KB

  • memory/4352-72-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-108-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-112-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-116-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-120-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-124-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-126-0x0000000000BE0000-0x0000000000C82000-memory.dmp

    Filesize

    648KB

  • memory/4352-127-0x0000000000BE0000-0x0000000000C82000-memory.dmp

    Filesize

    648KB

  • memory/4352-131-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB

  • memory/4352-135-0x0000000000400000-0x0000000000A9D000-memory.dmp

    Filesize

    6.6MB