Analysis
-
max time kernel
141s -
max time network
127s -
platform
windows11-21h2_x64 -
resource
win11-20240508-en -
resource tags
arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system -
submitted
28-06-2024 13:38
Static task
static1
Behavioral task
behavioral1
Sample
b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral2
Sample
b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe
Resource
win11-20240508-en
General
-
Target
b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe
-
Size
5.1MB
-
MD5
05a546060127e38ef20e701bd6fe7945
-
SHA1
5d02af987adbf0359e4afcbd52ced4b2b9f22ed9
-
SHA256
b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900
-
SHA512
e6f72c88daffa24953f5ac9df17a325186f93b1c2bd326c6c4381811067b44a02b69ba4664df8ced71d79c453458537bd49ce6949897b19b63662a70fef2b31c
-
SSDEEP
98304:CEleUkaAC3wHei5QlMBoS25YqVgfAZzYkXAvLtAiB8IZSNQJBfMmFgscP/Xqy/Au:Zleh9C3wHV5QKoS65zrAvLtVqoSNGCss
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2024-85-0x0000000000B80000-0x0000000000C21000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmptotalrecorderfree32.exetotalrecorderfree32.exepid process 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp 2040 totalrecorderfree32.exe 2024 totalrecorderfree32.exe -
Loads dropped DLL 1 IoCs
Processes:
b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmppid process 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp -
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmppid process 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exeb1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmpdescription pid process target process PID 3556 wrote to memory of 3304 3556 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp PID 3556 wrote to memory of 3304 3556 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp PID 3556 wrote to memory of 3304 3556 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp PID 3304 wrote to memory of 2040 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp totalrecorderfree32.exe PID 3304 wrote to memory of 2040 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp totalrecorderfree32.exe PID 3304 wrote to memory of 2040 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp totalrecorderfree32.exe PID 3304 wrote to memory of 2024 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp totalrecorderfree32.exe PID 3304 wrote to memory of 2024 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp totalrecorderfree32.exe PID 3304 wrote to memory of 2024 3304 b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp totalrecorderfree32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe"C:\Users\Admin\AppData\Local\Temp\b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-KPJRF.tmp\b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp"C:\Users\Admin\AppData\Local\Temp\is-KPJRF.tmp\b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmp" /SL5="$40232,5113268,54272,C:\Users\Admin\AppData\Local\Temp\b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Total Recorder Free\totalrecorderfree32.exe"C:\Users\Admin\AppData\Local\Total Recorder Free\totalrecorderfree32.exe" -i3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Total Recorder Free\totalrecorderfree32.exe"C:\Users\Admin\AppData\Local\Total Recorder Free\totalrecorderfree32.exe" -s3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-2CC6S.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
C:\Users\Admin\AppData\Local\Temp\is-KPJRF.tmp\b1a17410a647837c61df842ccda7baa242e5f1254c97107c182bb19844d72900.tmpFilesize
680KB
MD530aac890bf700fefcd93022f840254b1
SHA170739b6caf72dd41b3b4cefd6ad2d4942db7ea2a
SHA256796212c565796f92a71eb1fc46cbe8e06a746f1da93a232ae58fcd500670f4f8
SHA512e954a5e610118163cbc471766d9d9f1a9dad95dc06b96cc3b7e9d695da1974e0ef57ab890d06e10bee25a055a022ddd17d63a2ef9919ffc3cee5c516b15567b2
-
C:\Users\Admin\AppData\Local\Total Recorder Free\totalrecorderfree32.exeFilesize
3.6MB
MD5fa25c75df45e8a9d8c6b25d66d37ce0a
SHA1a16f2cce562995f814b09cf290b0384a33ed98c7
SHA2568d0da3b0bfae4bc62ea49768b5790c3c05c0d6ef2fd902f6b3b84f5a3d886adc
SHA512e6df69edf59cc0bc9ff0823d701eee07eb8b50473e62053a9d006780eec01910cad305d4cde9d576a106ca6e6bca917b68ea75996328a46dd24947fdcad0e80a
-
memory/2024-94-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-77-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-116-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-113-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-109-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-106-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-103-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-67-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-100-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-97-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-70-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-73-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-74-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-89-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-80-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-83-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2024-85-0x0000000000B80000-0x0000000000C21000-memory.dmpFilesize
644KB
-
memory/2040-60-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2040-64-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2040-63-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/2040-59-0x0000000000400000-0x0000000000791000-memory.dmpFilesize
3.6MB
-
memory/3304-16-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/3304-69-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/3556-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3556-68-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/3556-3-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB