socks5systemz | 5f9e934fc4a7d1f4e6e7cfccf3f072b9bb56fe83b5c70cf907502b31e9ae5e3c

Analysis

max time kernel
146s
max time network
135s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc9025618f9805eb801e2e3671f888cc.exe
Size 4.7MB
Sample240111-e2hsysfdf2
SHA256 5f9e934fc4a7d1f4e6e7cfccf3f072b9bb56fe83b5c70cf907502b31e9ae5e3c
MD5 bc9025618f9805eb801e2e3671f888cc
SHA1 a397d8170c353593843d832a76f8d9be1df05a1d
SHA512 5f048511f51da9937af023084ae481c5e6328907f7e87e1034bf3a822fd3e5ed41aac39890d65c05b9bfb1d6da07e9ebe469ad376b0c27cf1ed9b642d9e373c2
SSDEEP 98304:Ri/pvA3Q7kPhC2AtLsRXBRTstYPg97qaRo6K3DTH7c3Nm4L7rTLh+N+6Xke:w/pv0ek5C4botbEaEzfc3h3Xh+XXj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 5 IoCs

resource	yara_rule
behavioral1/memory/1260-162-0x00000000024B0000-0x0000000002552000-memory.dmp	family_socks5systemz
behavioral1/memory/1260-159-0x00000000024B0000-0x0000000002552000-memory.dmp	family_socks5systemz
behavioral1/memory/1260-171-0x00000000024B0000-0x0000000002552000-memory.dmp	family_socks5systemz
behavioral1/memory/1260-183-0x00000000024B0000-0x0000000002552000-memory.dmp	family_socks5systemz
behavioral1/memory/1260-182-0x00000000024B0000-0x0000000002552000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1968	is-0MRKC.tmp
1160	imaptestplugin.exe
1260	imaptestplugin.exe

Loads dropped DLL 10 IoCs

pid	Process
2516	bc9025618f9805eb801e2e3671f888cc.exe
1968	is-0MRKC.tmp
1968	is-0MRKC.tmp
1968	is-0MRKC.tmp
1968	is-0MRKC.tmp
1160	imaptestplugin.exe
1160	imaptestplugin.exe
1968	is-0MRKC.tmp
1260	imaptestplugin.exe
1260	imaptestplugin.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 1968	2516	bc9025618f9805eb801e2e3671f888cc.exe	28
PID 2516 wrote to memory of 1968	2516	bc9025618f9805eb801e2e3671f888cc.exe	28
PID 2516 wrote to memory of 1968	2516	bc9025618f9805eb801e2e3671f888cc.exe	28
PID 2516 wrote to memory of 1968	2516	bc9025618f9805eb801e2e3671f888cc.exe	28
PID 2516 wrote to memory of 1968	2516	bc9025618f9805eb801e2e3671f888cc.exe	28
PID 2516 wrote to memory of 1968	2516	bc9025618f9805eb801e2e3671f888cc.exe	28
PID 2516 wrote to memory of 1968	2516	bc9025618f9805eb801e2e3671f888cc.exe	28
PID 1968 wrote to memory of 1964	1968	is-0MRKC.tmp	29
PID 1968 wrote to memory of 1964	1968	is-0MRKC.tmp	29
PID 1968 wrote to memory of 1964	1968	is-0MRKC.tmp	29
PID 1968 wrote to memory of 1964	1968	is-0MRKC.tmp	29
PID 1968 wrote to memory of 1964	1968	is-0MRKC.tmp	29
PID 1968 wrote to memory of 1964	1968	is-0MRKC.tmp	29
PID 1968 wrote to memory of 1964	1968	is-0MRKC.tmp	29
PID 1968 wrote to memory of 1160	1968	is-0MRKC.tmp	31
PID 1968 wrote to memory of 1160	1968	is-0MRKC.tmp	31
PID 1968 wrote to memory of 1160	1968	is-0MRKC.tmp	31
PID 1968 wrote to memory of 1160	1968	is-0MRKC.tmp	31
PID 1968 wrote to memory of 1160	1968	is-0MRKC.tmp	31
PID 1968 wrote to memory of 1160	1968	is-0MRKC.tmp	31
PID 1968 wrote to memory of 1160	1968	is-0MRKC.tmp	31
PID 1964 wrote to memory of 2500	1964	net.exe	30
PID 1964 wrote to memory of 2500	1964	net.exe	30
PID 1964 wrote to memory of 2500	1964	net.exe	30
PID 1964 wrote to memory of 2500	1964	net.exe	30
PID 1964 wrote to memory of 2500	1964	net.exe	30
PID 1964 wrote to memory of 2500	1964	net.exe	30
PID 1964 wrote to memory of 2500	1964	net.exe	30
PID 1968 wrote to memory of 1260	1968	is-0MRKC.tmp	33
PID 1968 wrote to memory of 1260	1968	is-0MRKC.tmp	33
PID 1968 wrote to memory of 1260	1968	is-0MRKC.tmp	33
PID 1968 wrote to memory of 1260	1968	is-0MRKC.tmp	33
PID 1968 wrote to memory of 1260	1968	is-0MRKC.tmp	33
PID 1968 wrote to memory of 1260	1968	is-0MRKC.tmp	33
PID 1968 wrote to memory of 1260	1968	is-0MRKC.tmp	33

C:\Users\Admin\AppData\Local\Temp\bc9025618f9805eb801e2e3671f888cc.exe
"C:\Users\Admin\AppData\Local\Temp\bc9025618f9805eb801e2e3671f888cc.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Users\Admin\AppData\Local\Temp\is-1PQ6M.tmp\is-0MRKC.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-1PQ6M.tmp\is-0MRKC.tmp" /SL4 $400E0 "C:\Users\Admin\AppData\Local\Temp\bc9025618f9805eb801e2e3671f888cc.exe" 4643901 431616
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1968
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 1111
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1964
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 1111
      4⤵
      PID:2500
- - C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
    "C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe" -i
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1160
- - C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
    "C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe" -s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:1260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

imaptestplugin.exe

Path C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 1.3MB
SHA256 b3ef25e257dc54938cc4119fb1d66f825126f06edd1cc8506b9710acbc99bb15
MD5 1e200218c0b48cda9aed1586c93d5d6b
SHA1 c0192d780e2f0725123cb8defa4e29142500e505
SHA512 22d0bf7a631d54fba761638129a863f63abb9410c5b2d0ec305e5652da501ab78a9573fad3cdfd692d81590ce31129c2b5bf160dda16a47ce44e29f22985673f
SSDEEP 12288:dOqvL1OmPV5U8cBLk2YPQ15I/ogqOvcYezpz1ZvJdb/iabKqhMWHpso5OuI:4sL1lPrlGIog/9v5ezpnfb/lbKctvq
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 591KB
SHA256 73cfcbe1cc4e957780118753e38f8474935edd5d2d6b8bac091cabe5ba402e91
MD5 d4fad519ac49d8ae58bdd2242051a0d3
SHA1 c0bd0356336810e79e8a056b34f93e501ebf119d
SHA512 4d3a733d73822a011cc0e9cf26601e398f89d671c5dc96356421a611ff47be0c7096ba7e8a3d68fc1fdeeefb94d3bb3aafa9850f9765d848797f525cb718c4b6
SSDEEP 12288:dOqvL1OmPV5U8cBLk2YPQ15I/ogqOvcYezpz1Zv5:4sL1lPrlGIog/9v5ezpn5
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 202KB
SHA256 8d9940dc35479121f48055aa68be9dcef49b90445ae63b42aa4e7705cc159763
MD5 d632c0c16f73fb92879d90072c612c29
SHA1 71c33673c0a84a2fc80aee079a5f2381daabf74c
SHA512 605fa2354ccc3697b6e5d05e273a664ee03ef6899a251e6e46ede28ceabf727858fb28d1eac7f4c3146ff6d12b9b69155101f59c8fa1bde977cf31c7fc650d0d
SSDEEP 3072:ntVKfuHexAOTz24OZYtNdArtVKfuyp4OkapivL19ezlbsHZlbJkDkLatVKA:uAOTz2HACaIvL19exbmPVyg0
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 896KB
SHA256 e52832f9a468860152c2f07aed537e8691c5b45164cf505c0b91ad09c67311b8
MD5 243dd4fa76bdc91ada6cf756d8645b84
SHA1 b22cc5be8592c3c35277a9ba360f1d12fcf69b5a
SHA512 4ffd787854d08862cdfa741fc9afbb595b780f3fb23d23641c56508892a3932232abce0d080c938fcbdf5413e87a4962d18dbb761b72794ca8a0c617624cd740
SSDEEP 12288:dOqvL1OmPV5U8cBLk2YPQ15I/ogqOvcYezpz1ZvJdb/iabKqhMWHpsoQ:4sL1lPrlGIog/9v5ezpnfb/lbKcti
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 544KB
SHA256 a53641caa65418ea600c7a807e0cd5c4f786ec3ac46f5f5279c45913352ee902
MD5 5055bd409e1eda4efa8bbcf526c388d1
SHA1 78e9ac05b90a11e8015c61eff1113e67c68d5606
SHA512 5831929a2e362269b4c7bb176edb642c382130d4b2fd9ee2ac6244fed5eb7ad472c4ff144a4d50407c6785e92c280b53860deb6767454c6b3545c29b6ca1edb9
SSDEEP 12288:dOqvL1OmPV5U8cBLk2YPQ15I/ogqOvcYezpu:4sL1lPrlGIog/9v5ezpu
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 397KB
SHA256 cf5121ca753d9d3000d5a4f38fbd85911111d9c9cac87950284aec416c74aa41
MD5 80d7fecc33c63eb39dd968a4aca2dc85
SHA1 a64bbb2a75085b658b05aaa451269697bafda9ca
SHA512 cc0a7f1557d943f82c9d1e2b3f172054c11eab9f1d764b76b15ef9165bccd3165a271a9b18bf65cb68073f0301b493bddd0217e7bb2ebe20736db024432a717c
SSDEEP 6144:uAOTz2HACaIvL19exbmPVyg15Le4ClmcBLDA2YT7cB15cTW2v1oWZr:dOqvL1OmPV5U8cBLk2YPQ15I/o8
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 238KB
SHA256 c3b1021abee9716c5889cbce8c3ebe71bcc3dda263bcd4d8d1a02064e41577c8
MD5 0326b5a7bf7941b1b3e8cbd829a6caa9
SHA1 b70bc7619f75bdd5ee1c0ea8a63f6fc2bb06abdb
SHA512 0abe9fb3206b3bf0bf463f17cc937bf8ab2efe6cc522911183a4fe4e24441db02de5b192a8175126972b4f8a63bf20bbff96ea053999b9a65ec31a6a47868d39
SSDEEP 3072:ntVKfuHexAOTz24OZYtNdArtVKfuyp4OkapivL19ezlbsHZlbJkDkLatVKfus5Li:uAOTz2HACaIvL19exbmPVyg15Le4Clmc
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 153KB
SHA256 857732d68fb9a00ea62eb5cf8e482ff3aefe3b1c200d59b07c233b364b895106
MD5 d0226a591dec00040b1ec5c462f0f120
SHA1 a0f580b736dd3254339f34f045a3a56bfe5ff246
SHA512 b15c8f74ea59d85f5c43260330cc524c8a845353ddab1da0cbdb04e951e9e7a32e94ee790bb46cc4b3a261380ecc6dafa71ad956441884ab53bb747030d29ed4
SSDEEP 3072:ntVKfuHexAOTz24OZYtNdArtVKfuyp4OkapivL19F:uAOTz2HACaIvL19F
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 157KB
SHA256 4e5c56df7f3e7d0ed794bda0e25e810f5c3378d7493c0e8323282890fdd66688
MD5 8d880ef62fc5b9b00c0a6a67f7577506
SHA1 cfa779c63d27d97d45c6b0fb94fcc8a925563456
SHA512 4cfc7006471fe06ec3bace22e68bd2c932a292cf4270fed46810d6fefbc778faba1e7e6c5b413ed2fdd6bb9d924e742c48037fa8aa7de5ceb7ac4ab12afbeaa1
SSDEEP 3072:ntVKfuHexAOTz24OZYtNdArtVKfuyp4OkapivL19ezlJ:uAOTz2HACaIvL19exJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-0MRKC.tmp

Path \Users\Admin\AppData\Local\Temp\is-1PQ6M.tmp\is-0MRKC.tmp
Size 642KB
SHA256 2e7e5e01fa3d18a2a76e33dd139dbf251f1dd2ab77aba843b7ef09e51cd86c1a
MD5 856bce6609a05646759555e24a534467
SHA1 800c78d9d82bc1d0d631bdd11a9b766b6b964d2d
SHA512 5bbfca64610ed8c148a8e182de5e5568af34465698bf6cdd3f5ccc6857bb4b3d90cfc9e6f0f780464a2fe5c776e6ee69291877bb14b5f64b4e9d8791807af47a
SSDEEP 12288:0hmNwuOE5lrP9377zHJA6YZasySNsh7daVDSePPxp:2mNwuOE5lrP9377zHJA6zsyBsVD7Pxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path \Users\Admin\AppData\Local\Temp\is-TMULN.tmp\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-TMULN.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1160-123-0x0000000000BF0000-0x0000000000DF8000-memory.dmp

Download

memory/1160-124-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1160-127-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1160-125-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1160-128-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1160-122-0x0000000000BF0000-0x0000000000DF8000-memory.dmp

Download

memory/1260-137-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-171-0x00000000024B0000-0x0000000002552000-memory.dmp

Download

memory/1260-190-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-134-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-135-0x0000000000C70000-0x0000000000E78000-memory.dmp

Download

memory/1260-187-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-182-0x00000000024B0000-0x0000000002552000-memory.dmp

Download

memory/1260-183-0x00000000024B0000-0x0000000002552000-memory.dmp

Download

memory/1260-181-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-140-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-143-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-145-0x0000000000C70000-0x0000000000E78000-memory.dmp

Download

memory/1260-144-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-148-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-149-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-152-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-155-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-158-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-162-0x00000000024B0000-0x0000000002552000-memory.dmp

Download

memory/1260-159-0x00000000024B0000-0x0000000002552000-memory.dmp

Download

memory/1260-165-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-168-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-178-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-172-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1260-175-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1968-118-0x0000000003250000-0x0000000003458000-memory.dmp

Download

memory/1968-139-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/1968-133-0x0000000003250000-0x0000000003458000-memory.dmp

Download

memory/2516-138-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2516-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2516-2-0x0000000000400000-0x0000000000470000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads