Analysis
-
max time kernel
293s -
max time network
299s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 05:03
Static task
static1
Behavioral task
behavioral1
Sample
4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe
Resource
win10-20240404-en
General
-
Target
4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe
-
Size
5.0MB
-
MD5
0c08920d01eeb7bc6e2c909e750d6183
-
SHA1
2221bfda019f34b8ad75a24e5d70d70613fe9f7e
-
SHA256
4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae
-
SHA512
b61e6c4bc8474d205a6df9d48e059831947b372ff87c16f950b2d1cfde0102f2815bf61c3b8d1968d632a461d622103098a5760e44e72c0987d84aa208226e26
-
SSDEEP
98304:CbznFGZc1nc7Qbx59/31/sSZEq1N0D5dwt6ypECFUL9hdqqkQxj:EEMncEbx59f1Eq1qlKpEQyvhkQ9
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2648-92-0x00000000027D0000-0x0000000002871000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmpvkfreeaudiosaver.exevkfreeaudiosaver.exepid process 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp 2472 vkfreeaudiosaver.exe 2648 vkfreeaudiosaver.exe -
Loads dropped DLL 5 IoCs
Processes:
4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmppid process 2036 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 152.89.198.214 Destination IP 91.211.247.248 Destination IP 152.89.198.214 Destination IP 91.211.247.248 Destination IP 45.155.250.90 Destination IP 141.98.234.31 Destination IP 141.98.234.31 Destination IP 141.98.234.31 Destination IP 45.155.250.90 Destination IP 81.31.197.38 Destination IP 81.31.197.38 Destination IP 141.98.234.31 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmppid process 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmpdescription pid process target process PID 2036 wrote to memory of 2568 2036 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp PID 2036 wrote to memory of 2568 2036 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp PID 2036 wrote to memory of 2568 2036 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp PID 2036 wrote to memory of 2568 2036 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp PID 2036 wrote to memory of 2568 2036 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp PID 2036 wrote to memory of 2568 2036 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp PID 2036 wrote to memory of 2568 2036 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp PID 2568 wrote to memory of 2472 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp vkfreeaudiosaver.exe PID 2568 wrote to memory of 2472 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp vkfreeaudiosaver.exe PID 2568 wrote to memory of 2472 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp vkfreeaudiosaver.exe PID 2568 wrote to memory of 2472 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp vkfreeaudiosaver.exe PID 2568 wrote to memory of 2648 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp vkfreeaudiosaver.exe PID 2568 wrote to memory of 2648 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp vkfreeaudiosaver.exe PID 2568 wrote to memory of 2648 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp vkfreeaudiosaver.exe PID 2568 wrote to memory of 2648 2568 4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp vkfreeaudiosaver.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe"C:\Users\Admin\AppData\Local\Temp\4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-9GKLN.tmp\4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp"C:\Users\Admin\AppData\Local\Temp\is-9GKLN.tmp\4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmp" /SL5="$40150,4976259,54272,C:\Users\Admin\AppData\Local\Temp\4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe" -i3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exe" -s3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\is-558KL.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-558KL.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
\Users\Admin\AppData\Local\Temp\is-9GKLN.tmp\4eff1ef626264e3f1d795dfd71ea0b217810b5902dcb46bf914e9466ba81aeae.tmpFilesize
680KB
MD591abaa26324a0747e32442afeaf939d0
SHA190133d4c1b101d8fb8d05ed7cc005b2359f62b86
SHA2560041e3aef210e7e0566bbb3ec0e5dc34f0d65ec5563a971fa862559da249736a
SHA512a5c557fbc8dc8d44814a3527398da439d494568e7abaa32c0e28ec2417b1aba467a66311fc308bec8e8c7eff8bab6041a1dcc7e4e6360896de702ebbb46781e5
-
\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver.exeFilesize
3.3MB
MD50c66c4f91ef4a63c6fe9c2ed4ea725c8
SHA1f5dc6d81d22329bb8944599ebad3f63324b8a0d0
SHA25634ce10408fa0869b7bf4ffc253a8adc7e7b5375809fea8a538ca617884fa657f
SHA5125525e31815477bb47d44446ab5c89d621766a1e5252326853ab3284934d84ea91099576113fd6a0f6c7fe6bdb368e6591a92cc1ddd2c0cb012bcb1f83b1c5ad1
-
memory/2036-3-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/2036-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2036-73-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2472-65-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2472-66-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2472-69-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2568-12-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2568-78-0x0000000003960000-0x0000000003CA5000-memory.dmpFilesize
3.3MB
-
memory/2568-63-0x0000000003960000-0x0000000003CA5000-memory.dmpFilesize
3.3MB
-
memory/2568-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2648-79-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-107-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-71-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-82-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-85-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-88-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-91-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-92-0x00000000027D0000-0x0000000002871000-memory.dmpFilesize
644KB
-
memory/2648-98-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-101-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-104-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-75-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-110-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-113-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-116-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-119-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-122-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-125-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-128-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-131-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB
-
memory/2648-134-0x0000000000400000-0x0000000000745000-memory.dmpFilesize
3.3MB