Analysis
-
max time kernel
142s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-11-2024 09:03
Static task
static1
Behavioral task
behavioral1
Sample
18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe
Resource
win10v2004-20241007-en
General
-
Target
18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe
-
Size
5.8MB
-
MD5
ac760eaf97ff184b95bb0130537d22f3
-
SHA1
34ce346debea4de39b700524d58183ff34302190
-
SHA256
18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2
-
SHA512
796abc18e07064715746beca2380a59310e6218a91340e9cf6ca98fe9da3bd771de63e98594d4fff1c7052e55c762698e097252a95d2fadcd6985e548b70fbb7
-
SSDEEP
98304:NKjj93l3hNdqgzFVlhOnBhl9GeZHWI+Zbca7zkFMKJFsuzoq6t95a4kdmp:MjjVqgzFnhAlr2txuzMtIS
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
resource yara_rule behavioral2/memory/4352-97-0x0000000000BE0000-0x0000000000C82000-memory.dmp family_socks5systemz behavioral2/memory/4352-126-0x0000000000BE0000-0x0000000000C82000-memory.dmp family_socks5systemz behavioral2/memory/4352-127-0x0000000000BE0000-0x0000000000C82000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Executes dropped EXE 2 IoCs
pid Process 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 4352 screenstudio3.exe -
Loads dropped DLL 2 IoCs
pid Process 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 4352 screenstudio3.exe -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 45.155.250.90 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language screenstudio3.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2340 wrote to memory of 1964 2340 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe 85 PID 2340 wrote to memory of 1964 2340 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe 85 PID 2340 wrote to memory of 1964 2340 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe 85 PID 1964 wrote to memory of 3172 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 87 PID 1964 wrote to memory of 3172 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 87 PID 1964 wrote to memory of 3172 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 87 PID 1964 wrote to memory of 4352 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 89 PID 1964 wrote to memory of 4352 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 89 PID 1964 wrote to memory of 4352 1964 18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp 89 PID 3172 wrote to memory of 4904 3172 net.exe 90 PID 3172 wrote to memory of 4904 3172 net.exe 90 PID 3172 wrote to memory of 4904 3172 net.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe"C:\Users\Admin\AppData\Local\Temp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2340 -
C:\Users\Admin\AppData\Local\Temp\is-95VLA.tmp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp"C:\Users\Admin\AppData\Local\Temp\is-95VLA.tmp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp" /SL5="$80070,5818534,54272,C:\Users\Admin\AppData\Local\Temp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1964 -
C:\Windows\SysWOW64\net.exe"C:\Windows\system32\net.exe" pause screenstudio_111743⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3172 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 pause screenstudio_111744⤵
- System Location Discovery: System Language Discovery
PID:4904
-
-
-
C:\Users\Admin\AppData\Local\Screen Studio 1.42\screenstudio3.exe"C:\Users\Admin\AppData\Local\Screen Studio 1.42\screenstudio3.exe" -i3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4352
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6.6MB
MD5cf982bdbe7b0b22007f029a24cac00cc
SHA154db7f914d2a55b79c5897af8cfd8f439289e2ef
SHA25689399bb260cca725f5d6aa3ac76581fcd1baca215bc7b54d3a71144445e1d945
SHA512a89079b901a7e3d6f253f008081afc7e8bdeba8524d92b8672c1d47cf7ff5c3c6f07e8ff55dbe85ae1477de11b82dcb28ed4ce1a8ae6ed187132cf1334c704a5
-
Filesize
630KB
MD5e477a96c8f2b18d6b5c27bde49c990bf
SHA1e980c9bf41330d1e5bd04556db4646a0210f7409
SHA25616574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660
SHA512335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-95VLA.tmp\18b12f655314b498c20855118e8d0386a72656e6550070f04bebc0409341b4e2.tmp
Filesize692KB
MD54d3a2bb8d7a7dfcfeee20f95757d29e4
SHA14ca66ee00b950e6c45c09263b0e451039c572e96
SHA25688f7d0bc0c2cea9ac3ad806480310c9deae405ba505f6a19f9591115b6cbc57d
SHA512920d30524b4e1bf7cb3556a578459be4e9122e8c8716e34310fd70ae1deded50bad8bf7a03a46db46557b2e5500a523511a0bb9ddacf2dd966016e98a7cc6e74