MalwareBazaar Database

You are currently viewing the MalwareBazaar entry for SHA256 14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116. While MalwareBazaar tries to identify whether the sample provided is malicious or not, there is no guarantee that a sample in MalwareBazaar is malicious.

Database Entry


Socks5Systemz


Vendor detections: 17


Intelligence 17 IOCs YARA File information Comments
Download sample Add tag Delete this sample Report a False Positive

SHA256 hash: 14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116
SHA3-384 hash: e4e9231c23e4aadbb58c99d69ea747ed047904a13050effdda37740a17158be53743f3e3548a434da0f4162682a5552d
SHA1 hash: 032745d28ac071497bea922aadc06ee4b0d22dbc
MD5 hash: a3a5e55a1714f02ace5b6e9a82134c56
humanhash: aspen-maine-september-indigo
File name:a3a5e55a1714f02ace5b6e9a82134c56.exe
Download: download sample
Signature Socks5Systemz
Create hunting rule
File size:2'383'360 bytes
First seen:2023-12-15 23:25:20 UTC
Last seen:Never
File type:Executable exe
MIME type:application/x-dosexec
imphash 646167cce332c1c252cdcb1839e0cf48 (8'473 x RedLineStealer, 4'851 x Amadey, 290 x Smoke Loader)
ssdeep 49152:4GOzsGwNJp72gr0XQZ/8VM+giH+pmGj1DrGpc85Rwxh:yfwnEg4hVvNCm6GpR5Rw
TLSH T11BB5232792D8C472E8E4A3717DF40386263738E118B9C66B2771B48FD872AD9A531773
TrID 41.1% (.CPL) Windows Control Panel Item (generic) (57583/11/19)
22.2% (.EXE) Win32 Executable MS Visual C++ (generic) (31206/45/13)
11.8% (.EXE) Microsoft Visual C++ compiled executable (generic) (16529/12/5)
7.5% (.EXE) Win64 Executable (generic) (10523/12/4)
4.6% (.DLL) Win32 Dynamic Link Library (generic) (6578/25/2)
File icon (PE):PE icon
dhash icon f8f0f4c8c8c8d8f0 (8'803 x RedLineStealer, 5'078 x Amadey, 288 x Smoke Loader)
Reporter abuse_ch
Tags:exe Socks5Systemz


Avatar
abuse_ch
Socks5Systemz C2:
91.92.249.253:50500

Intelligence

File Origin
# of uploads :
1
# of downloads :
318
Origin country :
NL NL
Vendor Threat Intelligence
Detection:
SmokeLoader
Create hunting rule
Link:
https://www.capesandbox.com/analysis/467818/
Detection(s):
Sanesecurity.Malware.28840.BadO.UNOFFICIAL
Create hunting rule

SecuriteInfo.com.Trojan.Agent.EAOQ.26295.2066.UNOFFICIAL
Create hunting rule

Result
Verdict:
Malware
Maliciousness:

Behaviour
Searching for the window
Creating a file in the %temp% subdirectories
Creating a process from a recently created file
Creating a process with a hidden window
Creating a window
Сreating synchronization primitives
Sending a custom TCP request
Creating a file
Unauthorized injection to a recently created process
Unauthorized injection to a system process
Gathering data
Verdict:
Malicious
Threat level:
  10/10
Confidence:
100%
Tags:
advpack anti-vm CAB control explorer installer lolbin lolbin packed replace rundll32 setupapi sfx shell32
Link:
https://www.filescan.io/uploads/657ce08eb290743934e60a3f/reports/74d52904-262c-4b12-b0a2-ca0827213359/overview
Verdict:
Malicious
Labled as:
Win/malicious_confidence_100%
Link:
https://www.hybrid-analysis.com/sample/14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116
Result
Verdict:
MALICIOUS
Details
Windows PE Executable
Found a Windows Portable Executable (PE) binary. Depending on context, the presence of a binary is suspicious or malicious.
Malware family:
Generic Malware
Create hunting rule
Verdict:
Malicious
Link:
https://analyze.intezer.com/analyses/2a06af2f-0da7-4600-b667-04ce82c46464
Result
Threat name:
LummaC Stealer, RedLine, RisePro Stealer
Create hunting rule
Detection:
malicious
Classification:
troj.spyw.evad
Score:
100 / 100
Link:
https://www.joesandbox.com/analysis/1363107
Signature
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains very large array initializations
Allocates memory in foreign processes
Antivirus / Scanner detection for submitted sample
Antivirus detection for dropped file
Antivirus detection for URL or domain
Benign windows process drops PE files
C2 URLs / IPs found in malware configuration
Changes security center settings (notifications, updates, antivirus, firewall)
Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation))
Checks if the current machine is a virtual machine (disk enumeration)
Creates a thread in another existing process (thread injection)
Detected unpacking (changes PE section rights)
Detected unpacking (overwrites its own PE header)
Found evasive API chain (may stop execution after checking computer name)
Found malware configuration
Found many strings related to Crypto-Wallets (likely being stolen)
Injects a PE file into a foreign processes
Machine Learning detection for dropped file
Machine Learning detection for sample
Malicious sample detected (through community Yara rule)
Maps a DLL or memory area into another process
PE file has a writeable .text section
Queries memory information (via WMI often done to detect virtual machines)
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines)
Queries sensitive service information (via WMI, Win32_LogicalDisk, often done to detect sandboxes)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Query firmware table information (likely to detect VMs)
Sample uses process hollowing technique
Snort IDS alert for network traffic
System process connects to network (likely due to code injection or exploit)
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Uses schtasks.exe or at.exe to add and modify task schedules
Writes to foreign memory regions
Yara detected AntiVM3
Yara detected Generic Downloader
Yara detected LummaC Stealer
Yara detected RedLine Stealer
Yara detected RisePro Stealer
Yara detected SmokeLoader
Yara detected Stealc
Yara detected Vidar stealer
Yara detected zgRAT
Behaviour
Behavior Graph:
Download SVG
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1363107 Sample: XrapI44JaW.exe Startdate: 16/12/2023 Architecture: WINDOWS Score: 100 105 soupinterestoe.fun 2->105 107 reviveincapablewew.pw 2->107 109 13 other IPs or domains 2->109 137 Snort IDS alert for network traffic 2->137 139 Found malware configuration 2->139 141 Malicious sample detected (through community Yara rule) 2->141 143 18 other signatures 2->143 10 XrapI44JaW.exe 1 4 2->10         started        13 svchost.exe 2->13         started        16 svchost.exe 1 2->16         started        18 12 other processes 2->18 signatures3 process4 dnsIp5 95 C:\Users\user\AppData\Local\...\5ii7kj6.exe, PE32 10->95 dropped 97 C:\Users\user\AppData\Local\...\2zx9966.exe, PE32 10->97 dropped 21 5ii7kj6.exe 10->21         started        24 2zx9966.exe 15 3 10->24         started        201 Changes security center settings (notifications, updates, antivirus, firewall) 13->201 203 Query firmware table information (likely to detect VMs) 16->203 111 127.0.0.1 unknown unknown 18->111 27 conhost.exe 18->27         started        29 conhost.exe 18->29         started        31 WerFault.exe 18->31         started        33 WerFault.exe 18->33         started        file6 signatures7 process8 dnsIp9 145 Tries to detect sandboxes and other dynamic analysis tools (process name or module or function) 21->145 147 Checks for kernel code integrity (NtQuerySystemInformation(CodeIntegrityInformation)) 21->147 149 Maps a DLL or memory area into another process 21->149 153 2 other signatures 21->153 35 explorer.exe 21->35 injected 123 77.91.124.172, 49706, 80 ECOTEL-ASRU Russian Federation 24->123 151 Found many strings related to Crypto-Wallets (likely being stolen) 24->151 40 RegAsm.exe 15 69 24->40         started        signatures10 process11 dnsIp12 113 185.215.113.68, 49719, 80 WHOLESALECONNECTIONSNL Portugal 35->113 115 5.42.65.125, 49730, 80 RU-KSTVKolomnaGroupofcompaniesGuarantee-tvRU Russian Federation 35->115 121 2 other IPs or domains 35->121 79 C:\Users\user\AppData\Local\Temp\64FB.exe, PE32 35->79 dropped 81 C:\Users\user\AppData\Local\Temp\5AD8.exe, PE32 35->81 dropped 83 C:\Users\user\AppData\Local\Temp\3742.exe, PE32 35->83 dropped 91 4 other malicious files 35->91 dropped 155 System process connects to network (likely due to code injection or exploit) 35->155 157 Benign windows process drops PE files 35->157 42 229F.exe 35->42         started        46 1A6F.exe 35->46         started        49 1D20.exe 35->49         started        57 5 other processes 35->57 117 91.92.249.253, 49707, 50500 THEZONEBG Bulgaria 40->117 119 ipinfo.io 34.117.186.192, 443, 49708 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 40->119 85 C:\Users\user\AppData\Local\...\sqlite3.dll, PE32 40->85 dropped 87 C:\...\RZ671Bg8sBTp7N5zU3RCfEAfNOAp3d6N.zip, Zip 40->87 dropped 89 C:\Users\user\AppData\...\FANBooster131.exe, PE32 40->89 dropped 93 2 other files (none is malicious) 40->93 dropped 159 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 40->159 161 Queries sensitive physical memory information (via WMI, Win32_PhysicalMemory, often done to detect virtual machines) 40->161 163 Found many strings related to Crypto-Wallets (likely being stolen) 40->163 165 3 other signatures 40->165 51 cmd.exe 40->51         started        53 cmd.exe 40->53         started        55 WerFault.exe 40->55         started        file13 signatures14 process15 dnsIp16 99 C:\Users\user\AppData\Roaming\...\File2.exe, PE32 42->99 dropped 101 C:\Users\user\AppData\Roaming\...\File1.exe, PE32 42->101 dropped 167 Machine Learning detection for dropped file 42->167 59 File2.exe 42->59         started        62 File1.exe 42->62         started        65 conhost.exe 42->65         started        125 ratefacilityframw.fun 104.21.74.182, 49726, 80 CLOUDFLARENETUS United States 46->125 127 dayfarrichjwclik.fun 104.21.80.57, 49721, 80 CLOUDFLARENETUS United States 46->127 133 3 other IPs or domains 46->133 169 Antivirus detection for dropped file 46->169 171 Detected unpacking (changes PE section rights) 46->171 173 Detected unpacking (overwrites its own PE header) 46->173 175 Found evasive API chain (may stop execution after checking computer name) 46->175 67 WerFault.exe 46->67         started        129 176.123.7.190, 32927, 49722, 49728 ALEXHOSTMD Moldova Republic of 49->129 177 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 49->177 179 Found many strings related to Crypto-Wallets (likely being stolen) 49->179 181 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 49->181 183 Uses schtasks.exe or at.exe to add and modify task schedules 51->183 69 conhost.exe 51->69         started        71 schtasks.exe 51->71         started        73 conhost.exe 53->73         started        75 schtasks.exe 53->75         started        131 77.105.132.161 PLUSTELECOM-ASRU Russian Federation 57->131 103 C:\Users\user\AppData\...\Protect544cd51a.dll, PE32 57->103 dropped 185 Writes to foreign memory regions 57->185 187 Allocates memory in foreign processes 57->187 189 Sample uses process hollowing technique 57->189 191 Injects a PE file into a foreign processes 57->191 77 3 other processes 57->77 file17 signatures18 process19 dnsIp20 193 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 59->193 195 Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines) 59->195 197 Tries to harvest and steal browser information (history, passwords, etc) 59->197 135 176.123.10.211, 47430, 49729 ALEXHOSTMD Moldova Republic of 62->135 199 Tries to steal Crypto Currency Wallets 62->199 signatures21
Score:
100%
Verdict:
Malware
File Type:
PE
Link:
https://malprob.io/report/14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116
Detection:
smokeloader
Create hunting rule
Link:
https://mwdb.cert.pl/sample/14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116/
Threat name:
Win32.Trojan.SmokeLoader
Create hunting rule
Status:
Malicious
First seen:
2023-12-15 23:26:06 UTC
File Type:
PE (Exe)
Extracted files:
40
AV detection:
14 of 37 (37.84%)
Threat level:
  5/5
Detection(s):
Suspicious file
Link:
https://check.spamhaus.org/check/?searchterm=ctkjmbpipbnzj3el7n7spa6vcpzvpe7sshcfkbfkpjmfgdvwcela._file
Verdict:
malicious
Result
Malware family:
smokeloader
Create hunting rule
Score:
  10/10
Tags:
family:lumma family:redline family:smokeloader botnet:@oleh_ps backdoor collection discovery infostealer persistence spyware stealer trojan
Link:
https://tria.ge/reports/231215-3ettpsbba7/
Behaviour
Checks SCSI registry key(s)
Creates scheduled task(s)
Modifies system certificate store
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: MapViewOfSection
Suspicious use of AdjustPrivilegeToken
Suspicious use of WriteProcessMemory
outlook_office_path
outlook_win_path
Enumerates physical storage devices
Program crash
Suspicious use of SetThreadContext
Accesses Microsoft Outlook profiles
Adds Run key to start application
Checks installed software on the system
Looks up external IP address via web service
Drops startup file
Executes dropped EXE
Loads dropped DLL
Reads user/profile data of web browsers
Downloads MZ/PE file
Detect Lumma Stealer payload V4
Lumma Stealer
RedLine
RedLine payload
SmokeLoader
Malware Config
C2 Extraction:
http://185.215.113.68/fks/index.php
176.123.7.190:32927
Unpacked files
SH256 hash:
47c151fec63ff732b8e237c2b2272e816ffb337d45271d6f73f7052236dd6558
MD5 hash:
543f511b239c2409a942ab050ff6a5fa
SHA1 hash:
cf66fca8d43e414eb5e790ec1113f0779f81d323
Link:
https://www.unpac.me/results/5db7d325-e2f4-46d6-82a7-deac41dab1df/
SH256 hash:
5beb56c9ec498f92b6f0ec37f333f2b1ba04e416e7485564e5aa85fcea3c1f11
MD5 hash:
e677ece7dc48bd78b9202533e2437cc5
SHA1 hash:
7060a79602288077377e4f9aff0d52e93b4a4872
Detections:
SmokeLoaderStage2
Create hunting rule
win_smokeloader_a2
Create hunting rule
Link:
https://www.unpac.me/results/5db7d325-e2f4-46d6-82a7-deac41dab1df/
Parent samples :
139b12dd41cbd5265eb479b207e18bf881ebc1f26787be435067b7b1ffd717b4
14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116
SH256 hash:
14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116
MD5 hash:
a3a5e55a1714f02ace5b6e9a82134c56
SHA1 hash:
032745d28ac071497bea922aadc06ee4b0d22dbc
Detections:
win_redline_wextract_hunting_oct_2023
Create hunting rule
Link:
https://www.unpac.me/results/5db7d325-e2f4-46d6-82a7-deac41dab1df/
Malware family:
SmokeLoader
Create hunting rule
Verdict:
Malicious
Link:
https://www.vmray.com/analyses/_mb/14d49605e878/report/overview.html
Please note that we are no longer able to provide a coverage score for Virus Total.
Threat name:
Malicious File
Score:
1.00
Link:
https://yomi.yoroi.company/submissions/14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116

File information

The table below shows additional information about this malware sample such as delivery method and external references.

Web download

Socks5Systemz

Executable exe 14d49605e8785b94ec8bfb7f2783d513f35793f291c45504aa7a58530eb61116

(this sample)

  
URLhaus
https://urlhaus.abuse.ch/url/2738241/
  
Delivery method
Distributed via web download
Cape
Cape
https://www.capesandbox.com/analysis/467818/

Comments