Behavioral task
behavioral1
Sample
7d4ea4e69143df3f0f8fb9e4dee13c5251c4b1810d6b3a8626195906f00c0a49.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
7d4ea4e69143df3f0f8fb9e4dee13c5251c4b1810d6b3a8626195906f00c0a49.dll
Resource
win10v2004-20241007-en
General
-
Target
7d4ea4e69143df3f0f8fb9e4dee13c5251c4b1810d6b3a8626195906f00c0a49.dll
-
Size
660KB
-
MD5
76436512e3e3a9dca38f5eaf312fe323
-
SHA1
503af6ad7617f847abbe509a907944f0e9213505
-
SHA256
7d4ea4e69143df3f0f8fb9e4dee13c5251c4b1810d6b3a8626195906f00c0a49
-
SHA512
aab595de7a3af9a3e7c480f953b392f42965348ffcda6a410eb990ae2c11c5a87f975b2ad2c34a147767b14325c60117af64f2bcea2813a7fbcee94ddfc951d9
-
SSDEEP
12288:oIsMQVdsxSoqFsUzAbRb7aZJhztomX9mFu4Ou1GN3/k3jQlVUihjxWBZlUAxwqwX:nDQVdsxSoqFsGA6rX9mFujeMwQljhjxb
Malware Config
Extracted
socks5systemz
-
rc4_key
i4hiea56#7b&dfw3
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
resource yara_rule sample family_socks5systemz -
Socks5systemz family
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 7d4ea4e69143df3f0f8fb9e4dee13c5251c4b1810d6b3a8626195906f00c0a49.dll
Files
-
7d4ea4e69143df3f0f8fb9e4dee13c5251c4b1810d6b3a8626195906f00c0a49.dll.dll windows:5 windows x86 arch:x86
f0e11ecd3bbee7b4aa223cc34c18cd2a
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
Imports
wininet
InternetCloseHandle
InternetOpenA
InternetSetOptionA
InternetReadFile
InternetOpenUrlA
dnsapi
DnsFree
DnsQuery_A
kernel32
HeapSize
UnhandledExceptionFilter
SetUnhandledExceptionFilter
CreateFileA
lstrlenA
TlsGetValue
SetWaitableTimer
InterlockedIncrement
GetQueuedCompletionStatus
InterlockedDecrement
QueryPerformanceCounter
InterlockedCompareExchange
SleepEx
WriteFile
InitializeCriticalSection
TlsSetValue
TerminateThread
InitializeCriticalSectionAndSpinCount
GetTickCount
GetProcessHeap
HeapAlloc
CreateEventA
GetCurrentProcess
HeapFree
WaitForSingleObject
SetEvent
Sleep
GetSystemTimeAsFileTime
LeaveCriticalSection
CreateFileW
lstrcatA
InterlockedExchange
GetLastError
SetLastError
GetProcAddress
QueueUserAPC
EnterCriticalSection
InterlockedExchangeAdd
LocalAlloc
PostQueuedCompletionStatus
WaitForMultipleObjects
GetModuleFileNameA
CreateIoCompletionPort
GetModuleHandleA
lstrcatW
DeleteCriticalSection
GetVersionExA
TlsAlloc
CloseHandle
CreateWaitableTimerA
LocalFree
TlsFree
lstrcpyW
DeleteFileA
CreateThread
FreeLibrary
GetWindowsDirectoryA
LoadLibraryA
DeviceIoControl
GetFileTime
GetStartupInfoW
TerminateProcess
ReadFile
VirtualQuery
GetModuleFileNameW
GetStdHandle
WideCharToMultiByte
SetEndOfFile
FlushFileBuffers
WriteConsoleW
SetStdHandle
HeapReAlloc
AreFileApisANSI
OutputDebugStringW
SetFilePointerEx
LCMapStringW
GetStringTypeW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetFileType
GetConsoleCP
ReadConsoleW
GetConsoleMode
GetModuleHandleW
FormatMessageA
OpenEventA
ReleaseSemaphore
GetCurrentProcessId
GetCurrentThreadId
ResetEvent
ResumeThread
EncodePointer
DecodePointer
ExitThread
LoadLibraryExW
GetCommandLineA
RaiseException
RtlUnwind
IsDebuggerPresent
IsProcessorFeaturePresent
IsValidCodePage
GetACP
GetOEMCP
GetCPInfo
MultiByteToWideChar
ExitProcess
GetModuleHandleExW
user32
wsprintfA
shell32
SHGetSpecialFolderPathW
SHGetSpecialFolderPathA
ws2_32
ioctlsocket
WSAStringToAddressA
connect
inet_ntoa
WSAStartup
ntohl
inet_addr
htonl
getaddrinfo
WSARecv
WSASend
select
WSAGetLastError
htons
ntohs
getsockname
shutdown
setsockopt
freeaddrinfo
WSASetLastError
closesocket
getsockopt
WSASocketA
WSACleanup
Sections
.text Size: 185KB - Virtual size: 185KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 49KB - Virtual size: 49KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 12KB - Virtual size: 21KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 512B - Virtual size: 480B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 12KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
.vlizer Size: 399KB - Virtual size: 399KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE