Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
01-12-2024 16:02
General
-
Target
04768fec909a41d9908a9a1ee4827e2f5debee21445be37c280bc8514c543c7b.exe
-
Size
3.9MB
-
MD5
b550e3dc4795f15c0bfebd24cb130ce7
-
SHA1
7af5b5727b303d36d3255eda769c1d1bf2c57518
-
SHA256
04768fec909a41d9908a9a1ee4827e2f5debee21445be37c280bc8514c543c7b
-
SHA512
641ccf1c98203b67b80ce754dae545b4b965d427e5825c5c4815daf870c70efae24668c685da3e2fef5dccd069328c30bd90b67e4b3357d52e28512c42bdbb11
-
SSDEEP
98304:M8rOytC3sPj55uOnZtpwOy42bE/cNlZFp6RCBKAJq:tTN5DZtysOE/ovqRsKAA
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\04768fec909a41d9908a9a1ee4827e2f5debee21445be37c280bc8514c543c7b.exe"C:\Users\Admin\AppData\Local\Temp\04768fec909a41d9908a9a1ee4827e2f5debee21445be37c280bc8514c543c7b.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-JAQNS.tmp\04768fec909a41d9908a9a1ee4827e2f5debee21445be37c280bc8514c543c7b.tmp"C:\Users\Admin\AppData\Local\Temp\is-JAQNS.tmp\04768fec909a41d9908a9a1ee4827e2f5debee21445be37c280bc8514c543c7b.tmp" /SL5="$7022C,3807573,53248,C:\Users\Admin\AppData\Local\Temp\04768fec909a41d9908a9a1ee4827e2f5debee21445be37c280bc8514c543c7b.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\DP Free Video Converter\dpfreevideoconverter3264.exe"C:\Users\Admin\AppData\Local\DP Free Video Converter\dpfreevideoconverter3264.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.7MB
MD53cbd9752e46d8042741de2de58f2b0df
SHA10c7676fd0800827397754f94c4e20577c215fc15
SHA256cd577f1c470aa8fac9cf894d5e873d130c6f04ed63d22aa116d8b72fc72e51af
SHA51281135a0d60d6835c3b6334e623351657956784a63f854e901631322aee9f2a3485d0b0c73fcdb4f657f14a7ac68ae9cfe57a2ae9ad11d95c0795186b98005eac
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
665KB
MD5bd4bfb94d85c372c939f660e464cfcd5
SHA18125c075db48f805bf273be88331ff1a5c702014
SHA2564110de541f3499b4c05aa8d6610551aa0fcee905ced2060d251f704041e8c78f
SHA512da6c8a136448ed251ae064e3795debb5a2a0ea8e16dbe4b45d8a3b863af2a61891c6941ca4cb3fec346e72f9a082b93f0578b5c580866c5709f7d768225ab97c
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
648KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
648KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
648KB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
2.7MB
-
Filesize
80KB
-
Filesize
80KB
-
Filesize
40KB
-
Filesize
724KB
-
Filesize
724KB