socks5systemz | 5f9e934fc4a7d1f4e6e7cfccf3f072b9bb56fe83b5c70cf907502b31e9ae5e3c

Analysis

max time kernel
156s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/01/2024, 04:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bc9025618f9805eb801e2e3671f888cc.exe
Size 4.7MB
Sample240111-e2hsysfdf2
SHA256 5f9e934fc4a7d1f4e6e7cfccf3f072b9bb56fe83b5c70cf907502b31e9ae5e3c
MD5 bc9025618f9805eb801e2e3671f888cc
SHA1 a397d8170c353593843d832a76f8d9be1df05a1d
SHA512 5f048511f51da9937af023084ae481c5e6328907f7e87e1034bf3a822fd3e5ed41aac39890d65c05b9bfb1d6da07e9ebe469ad376b0c27cf1ed9b642d9e373c2
SSDEEP 98304:Ri/pvA3Q7kPhC2AtLsRXBRTstYPg97qaRo6K3DTH7c3Nm4L7rTLh+N+6Xke:w/pv0ek5C4botbEaEzfc3h3Xh+XXj
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 2 IoCs

resource	yara_rule
behavioral2/memory/1580-142-0x00000000007A0000-0x0000000000842000-memory.dmp	family_socks5systemz
behavioral2/memory/1580-152-0x00000000007A0000-0x0000000000842000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
404	is-II666.tmp
3040	imaptestplugin.exe
1580	imaptestplugin.exe

Loads dropped DLL 1 IoCs

pid	Process
404	is-II666.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 404	2132	bc9025618f9805eb801e2e3671f888cc.exe	92
PID 2132 wrote to memory of 404	2132	bc9025618f9805eb801e2e3671f888cc.exe	92
PID 2132 wrote to memory of 404	2132	bc9025618f9805eb801e2e3671f888cc.exe	92
PID 404 wrote to memory of 1336	404	is-II666.tmp	94
PID 404 wrote to memory of 1336	404	is-II666.tmp	94
PID 404 wrote to memory of 1336	404	is-II666.tmp	94
PID 404 wrote to memory of 3040	404	is-II666.tmp	96
PID 404 wrote to memory of 3040	404	is-II666.tmp	96
PID 404 wrote to memory of 3040	404	is-II666.tmp	96
PID 1336 wrote to memory of 2176	1336	net.exe	97
PID 1336 wrote to memory of 2176	1336	net.exe	97
PID 1336 wrote to memory of 2176	1336	net.exe	97
PID 404 wrote to memory of 1580	404	is-II666.tmp	98
PID 404 wrote to memory of 1580	404	is-II666.tmp	98
PID 404 wrote to memory of 1580	404	is-II666.tmp	98

C:\Users\Admin\AppData\Local\Temp\bc9025618f9805eb801e2e3671f888cc.exe
"C:\Users\Admin\AppData\Local\Temp\bc9025618f9805eb801e2e3671f888cc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Users\Admin\AppData\Local\Temp\is-KJILA.tmp\is-II666.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-KJILA.tmp\is-II666.tmp" /SL4 $B0044 "C:\Users\Admin\AppData\Local\Temp\bc9025618f9805eb801e2e3671f888cc.exe" 4643901 431616
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 1111
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1336
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 1111
      4⤵
      PID:2176
- - C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
    "C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe" -i
    3⤵
    - Executes dropped EXE
    PID:3040
- - C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
    "C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

imaptestplugin.exe

Path C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 1.9MB
SHA256 a726ba6792960a376bc8a75c17e6b178be031b4a62567e79215a0d2f8acea0a8
MD5 0e7c363da4b557387cbb518cbe1e350f
SHA1 3073a68d8682af0bc74f9f18e7e04bf1cd67f630
SHA512 bfea21048b33efbbfb6d95d84e2c64be7dab48d27493ae683981dd6aef66f5ab124f7977a872d5047b7c535919c9e20aee234bbe558c4c9ee5bccdda597cff7d
SSDEEP 24576:4sL1lPrlGIog/9v5ezpnfb/lbKctvH9eag6osvA3Q7klbdVgFh5pP1f2LNWM30VQ:42429v5ezJz/lbKcJ9eag6pvA3Q7kLBt
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 696KB
SHA256 16ddca74e75b9138a4b10b34a6644fa753963af79a9762556cb96381a656a744
MD5 bb30d1bee2f144a285b6a74ed4bd20d2
SHA1 f33567db8d6edfcbf53e06f0e542f03ca502f4c4
SHA512 c0e66cd6e5fe15dfcdb5f0ba391b0d160885254d53bc4d4caf3bfab204a7557226c59182256f1bcf72a830ccf6f9380c391be3d4412c6a44ec268d300624b8b7
SSDEEP 12288:dOqvL1OmPV5U8cBLk2YPQ15I/ogqOvcYezpz1ZvJdb/iabKqhMr:4sL1lPrlGIog/9v5ezpnfb/lbKcs
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 609KB
SHA256 1cab16195ba9232c5f3f23b0d4f6a88ad5687e566d621c13d536588b4a56c401
MD5 a5bfe70a5a8c906979182f6c5f90f21c
SHA1 b680bda48f72e4d6b879481c6df66766976cebc9
SHA512 90d856dad5bed1955c4969285a86a5d4f0326c6039c409de2288a883c71cc08b7506124a5d0a3a669f4ed919a705f466a7f442ff633fdecee56d6e0984f895e8
SSDEEP 12288:dOqvL1OmPV5U8cBLk2YPQ15I/ogqOvcYezpz1ZvJc:4sL1lPrlGIog/9v5ezpnS
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-E74JT.tmp\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

is-II666.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-KJILA.tmp\is-II666.tmp
Size 642KB
SHA256 2e7e5e01fa3d18a2a76e33dd139dbf251f1dd2ab77aba843b7ef09e51cd86c1a
MD5 856bce6609a05646759555e24a534467
SHA1 800c78d9d82bc1d0d631bdd11a9b766b6b964d2d
SHA512 5bbfca64610ed8c148a8e182de5e5568af34465698bf6cdd3f5ccc6857bb4b3d90cfc9e6f0f780464a2fe5c776e6ee69291877bb14b5f64b4e9d8791807af47a
SSDEEP 12288:0hmNwuOE5lrP9377zHJA6YZasySNsh7daVDSePPxp:2mNwuOE5lrP9377zHJA6zsyBsVD7Pxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/404-7-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/404-125-0x0000000000660000-0x0000000000661000-memory.dmp

Download

memory/404-123-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/1580-150-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-135-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-170-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-121-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-167-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-164-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-124-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-160-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-128-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-129-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-132-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-157-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-138-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-141-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-142-0x00000000007A0000-0x0000000000842000-memory.dmp

Download

memory/1580-147-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-154-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/1580-152-0x00000000007A0000-0x0000000000842000-memory.dmp

Download

memory/2132-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2132-122-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/3040-117-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/3040-113-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/3040-114-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/3040-118-0x0000000000400000-0x0000000000608000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads