Analysis
-
max time kernel
142s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
18-12-2024 05:33
General
-
Target
42WFo3FaTHYyBEwuU2uDHxNr.exe
-
Size
7.6MB
-
MD5
98f743c21a83ff1ebb7a55b3d32ac099
-
SHA1
e715b3eb8a3518369d20012533d4cc8eb8950749
-
SHA256
e880e19545c1a04e0cced43714c2c027fa1cc8558499091dae57a3675b9fc82c
-
SHA512
5fe640e5c9b6bc9dc8ace041b20ce5b9f1190b010aeabc13e17310220ec4352e025b22d9a2ec876a83e0bf8088e4b30cd7e43dd9a47904d6df9b639bfba39452
-
SSDEEP
196608:DnIjlo7SWx8ktMWfDsRhcI76Mrmaa6t9BHKNPv/94s23rG04BbpmBj:DIhoeWxwW7sRhr6Mrmaaq9BqN3/9oZ0S
Malware Config
Signatures
-
Detect Socks5Systemz Payload 3 IoCs
-
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Socks5systemz family
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 1 IoCs
-
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\42WFo3FaTHYyBEwuU2uDHxNr.exe"C:\Users\Admin\AppData\Local\Temp\42WFo3FaTHYyBEwuU2uDHxNr.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-HE3KI.tmp\is-CBH3Q.tmp"C:\Users\Admin\AppData\Local\Temp\is-HE3KI.tmp\is-CBH3Q.tmp" /SL4 $A0242 "C:\Users\Admin\AppData\Local\Temp\42WFo3FaTHYyBEwuU2uDHxNr.exe" 7717549 522242⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Jennysoft Video Editor\jennysoftvideoeditor32.exe"C:\Users\Admin\AppData\Local\Jennysoft Video Editor\jennysoftvideoeditor32.exe" -i3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8.5MB
MD59115b542d4b1a9d7f8687b0b046ee8ca
SHA1b36570fc05c0ea3902bc9fad3c6bd94939aa8227
SHA25601fabcf19194dce2115fc2f5aa11c12aac16d5089bca0cd7644038b6ed14f4da
SHA512e8aa22e223f46ba92513d74eda4e3e4ae9711e1813285036c47470766d4d5015ca4e1b2848f4511ae01a9261dbb14351372b11a4e52adafa7837c65540436d8e
-
Filesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
Filesize
647KB
MD5fef9f37b0bf2bfe2b6fca576c965a691
SHA14feb38c272b8dfb6b0cd96eeb1dbf76e03dfebb4
SHA2562217b8b847bffac814c809c6ba9cd7117420893683e5e0b69f92f656c7db9141
SHA5121f6c75c422b3ec8f5e4ffce2d155d69f07df0ac2e74ac90d439c01a7587164b8900c514134123824ad06120ff0a2bbbf8daed6f1b832be8a867c51c5c5bf1752
-
Filesize
704KB
-
Filesize
704KB
-
Filesize
8.5MB
-
Filesize
648KB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
648KB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
8.5MB
-
Filesize
648KB
-
Filesize
36KB
-
Filesize
76KB
-
Filesize
76KB