Analysis
-
max time kernel
293s -
max time network
299s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 05:04
Static task
static1
Behavioral task
behavioral1
Sample
7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe
Resource
win10-20240404-en
General
-
Target
7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe
-
Size
5.0MB
-
MD5
cee56c743cd7c20a6f403c0e903072f8
-
SHA1
67656b2cf28149242542919c15d8b759ca47424e
-
SHA256
7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4
-
SHA512
e1e066185f35cf90d46a4d4d7d70b22afe1e88d910d23654f72a3b86c0a04a05c2cbc3970e046b5d3ca05e2d69a1e6f4b43ff87674df1e4268651b2c1449ab0d
-
SSDEEP
98304:C830wCrav6QBqmJstibfDh036MaXgiFswyKmkdqkR1eBkGWpTBNUzgjY2nsYMYpq:P3qrk4Gstk7h03LaXNFtyKmYJGST3mgW
Malware Config
Signatures
-
Detect Socks5Systemz Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2540-92-0x00000000025D0000-0x0000000002672000-memory.dmp family_socks5systemz -
Socks5Systemz
Socks5Systemz is a botnet written in C++.
-
Executes dropped EXE 3 IoCs
Processes:
7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmpvkfreeaudiosaver32_64.exevkfreeaudiosaver32_64.exepid process 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp 2544 vkfreeaudiosaver32_64.exe 2540 vkfreeaudiosaver32_64.exe -
Loads dropped DLL 5 IoCs
Processes:
7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmppid process 1640 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp -
Unexpected DNS network traffic destination 13 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.211.247.248 Destination IP 45.155.250.90 Destination IP 45.155.250.90 Destination IP 81.31.197.38 Destination IP 81.31.197.38 Destination IP 45.155.250.90 Destination IP 141.98.234.31 Destination IP 152.89.198.214 Destination IP 141.98.234.31 Destination IP 152.89.198.214 Destination IP 152.89.198.214 Destination IP 91.211.247.248 Destination IP 152.89.198.214 -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmppid process 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmpdescription pid process target process PID 1640 wrote to memory of 2600 1640 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp PID 1640 wrote to memory of 2600 1640 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp PID 1640 wrote to memory of 2600 1640 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp PID 1640 wrote to memory of 2600 1640 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp PID 1640 wrote to memory of 2600 1640 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp PID 1640 wrote to memory of 2600 1640 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp PID 1640 wrote to memory of 2600 1640 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp PID 2600 wrote to memory of 2544 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp vkfreeaudiosaver32_64.exe PID 2600 wrote to memory of 2544 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp vkfreeaudiosaver32_64.exe PID 2600 wrote to memory of 2544 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp vkfreeaudiosaver32_64.exe PID 2600 wrote to memory of 2544 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp vkfreeaudiosaver32_64.exe PID 2600 wrote to memory of 2540 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp vkfreeaudiosaver32_64.exe PID 2600 wrote to memory of 2540 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp vkfreeaudiosaver32_64.exe PID 2600 wrote to memory of 2540 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp vkfreeaudiosaver32_64.exe PID 2600 wrote to memory of 2540 2600 7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp vkfreeaudiosaver32_64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe"C:\Users\Admin\AppData\Local\Temp\7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-N2HOM.tmp\7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp"C:\Users\Admin\AppData\Local\Temp\is-N2HOM.tmp\7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmp" /SL5="$40016,5005498,54272,C:\Users\Admin\AppData\Local\Temp\7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe" -i3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe"C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exe" -s3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-N2HOM.tmp\7bc701c979bd89179a721f3555fb0084c54e57c5c74d0ddb91ae6d141e656cf4.tmpFilesize
680KB
MD570295416713c0ce535665d806e3d54ac
SHA1fe13c334ec67412f41fe190f93da7d45a57eccbd
SHA256958c5f807a8268b09828e0f02a6c75a92f3a87dbd1853eb62e5996db990ba2ba
SHA5122336597fb6ffe697ba62cd931479108556fee44319176989f961ae43aea62b111df6870a169202c6d960aface42779a2f82db48a69fe2072b711a512812f925c
-
C:\Users\Admin\AppData\Local\VK Free Audio Saver\vkfreeaudiosaver32_64.exeFilesize
3.5MB
MD525a7753d8319489df4deeac9a034de8a
SHA1cac4eb323819f52955194874e8aee4f1acf0a2ce
SHA256a2a8db80e4ccef5b2692a3a7d213d75ab29cba50c5af02b7b747dddeab693f9b
SHA512c54b096a0e4f4463d7c17215b1a883f29d1cf80489d686b666217514f0f9291c9ab88329a7b7febdf80c73e2a73e7c7f7ceab50284dadc5891016cac250b23a2
-
\Users\Admin\AppData\Local\Temp\is-0C8J1.tmp\_isetup\_iscrypt.dllFilesize
2KB
MD5a69559718ab506675e907fe49deb71e9
SHA1bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA2562f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
SHA512e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
-
\Users\Admin\AppData\Local\Temp\is-0C8J1.tmp\_isetup\_shfoldr.dllFilesize
22KB
MD592dc6ef532fbb4a5c3201469a5b5eb63
SHA13e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA2569884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
SHA5129908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
-
memory/1640-2-0x0000000000401000-0x000000000040B000-memory.dmpFilesize
40KB
-
memory/1640-0-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/1640-73-0x0000000000400000-0x0000000000414000-memory.dmpFilesize
80KB
-
memory/2540-104-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-91-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-134-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-71-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-131-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-128-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-125-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-75-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-122-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-78-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-82-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-85-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-88-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-119-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-92-0x00000000025D0000-0x0000000002672000-memory.dmpFilesize
648KB
-
memory/2540-98-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-101-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-116-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-107-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-110-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2540-113-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2544-65-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2544-66-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2544-69-0x0000000000400000-0x0000000000784000-memory.dmpFilesize
3.5MB
-
memory/2600-12-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB
-
memory/2600-79-0x0000000004340000-0x00000000046C4000-memory.dmpFilesize
3.5MB
-
memory/2600-64-0x0000000004340000-0x00000000046C4000-memory.dmpFilesize
3.5MB
-
memory/2600-74-0x0000000000400000-0x00000000004BA000-memory.dmpFilesize
744KB