Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14/12/2024, 23:44 UTC
Behavioral task
behavioral1
Sample
76436512E3E3A9DCA38F5EAF312FE323.dll
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
76436512E3E3A9DCA38F5EAF312FE323.dll
Resource
win10v2004-20241007-en
General
-
Target
76436512E3E3A9DCA38F5EAF312FE323.dll
-
Size
660KB
-
MD5
76436512e3e3a9dca38f5eaf312fe323
-
SHA1
503af6ad7617f847abbe509a907944f0e9213505
-
SHA256
7d4ea4e69143df3f0f8fb9e4dee13c5251c4b1810d6b3a8626195906f00c0a49
-
SHA512
aab595de7a3af9a3e7c480f953b392f42965348ffcda6a410eb990ae2c11c5a87f975b2ad2c34a147767b14325c60117af64f2bcea2813a7fbcee94ddfc951d9
-
SSDEEP
12288:oIsMQVdsxSoqFsUzAbRb7aZJhztomX9mFu4Ou1GN3/k3jQlVUihjxWBZlUAxwqwX:nDQVdsxSoqFsGA6rX9mFujeMwQljhjxb
Malware Config
Extracted
socks5systemz
-
rc4_key
i4hiea56#7b&dfw3
Signatures
-
Detect Socks5Systemz Payload 2 IoCs
resource yara_rule behavioral2/memory/3812-0-0x00000000749A0000-0x0000000074A4D000-memory.dmp family_socks5systemz behavioral2/memory/3812-3-0x00000000749A0000-0x0000000074A4D000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Program crash 1 IoCs
pid pid_target Process procid_target 4900 3812 WerFault.exe 83 -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language rundll32.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1336 wrote to memory of 3812 1336 rundll32.exe 83 PID 1336 wrote to memory of 3812 1336 rundll32.exe 83 PID 1336 wrote to memory of 3812 1336 rundll32.exe 83
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76436512E3E3A9DCA38F5EAF312FE323.dll,#11⤵
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\76436512E3E3A9DCA38F5EAF312FE323.dll,#12⤵
- System Location Discovery: System Language Discovery
PID:3812 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3812 -s 8843⤵
- Program crash
PID:4900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3812 -ip 38121⤵PID:452
Network
-
Remote address:8.8.8.8:53Request58.55.71.13.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request21.49.80.91.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request71.159.190.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request95.221.229.192.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request97.17.167.52.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request56.163.245.4.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request198.187.3.20.in-addr.arpaIN PTRResponse
-
Remote address:8.8.8.8:53Request25.14.97.104.in-addr.arpaIN PTRResponse25.14.97.104.in-addr.arpaIN PTRa104-97-14-25deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request88.210.23.2.in-addr.arpaIN PTRResponse88.210.23.2.in-addr.arpaIN PTRa2-23-210-88deploystaticakamaitechnologiescom
-
Remote address:8.8.8.8:53Request43.229.111.52.in-addr.arpaIN PTRResponse
-
70 B 144 B 1 1
DNS Request
58.55.71.13.in-addr.arpa
-
70 B 145 B 1 1
DNS Request
21.49.80.91.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
71.159.190.20.in-addr.arpa
-
73 B 144 B 1 1
DNS Request
95.221.229.192.in-addr.arpa
-
71 B 145 B 1 1
DNS Request
97.17.167.52.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
56.163.245.4.in-addr.arpa
-
71 B 157 B 1 1
DNS Request
198.187.3.20.in-addr.arpa
-
71 B 135 B 1 1
DNS Request
25.14.97.104.in-addr.arpa
-
70 B 133 B 1 1
DNS Request
88.210.23.2.in-addr.arpa
-
72 B 158 B 1 1
DNS Request
43.229.111.52.in-addr.arpa