socks5systemz | 9397e1a3bd7e94ae5213d8dc4edef5e73fe8c6f0306196a1ffae832a3976e9ac

Analysis

max time kernel
145s
max time network
133s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5f4371e9fcc21652c9fb3867f64d4941.exe
Size

4.5MB
MD5

5f4371e9fcc21652c9fb3867f64d4941
SHA1

a19d69302a3993f2aca91d73bdc128e47b6ce174
SHA256

9397e1a3bd7e94ae5213d8dc4edef5e73fe8c6f0306196a1ffae832a3976e9ac
SHA512

3c736528fd01383b6fb37a30b306ccd0cfa6b2129cea650263d0a5488e1052c6348acac115ad394c7c70b647d42dc55f4811bd2321b11c3c4c6a37f9c8d21536
SSDEEP

98304:QDC5jNxoKkMBuu/KJmiuK3gqLkWSTGHVs49M4dm8:YCj6KPBuh8XUgqLXHLM4dD

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1632-156-0x0000000002730000-0x00000000027D2000-memory.dmp	family_socks5systemz
behavioral1/memory/1632-155-0x0000000002730000-0x00000000027D2000-memory.dmp	family_socks5systemz
behavioral1/memory/1632-167-0x0000000002730000-0x00000000027D2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2288	5f4371e9fcc21652c9fb3867f64d4941.tmp
2884	dvdreportviewer.exe
1632	dvdreportviewer.exe

Loads dropped DLL 6 IoCs

pid	Process
2652	5f4371e9fcc21652c9fb3867f64d4941.exe
2288	5f4371e9fcc21652c9fb3867f64d4941.tmp
2288	5f4371e9fcc21652c9fb3867f64d4941.tmp
2288	5f4371e9fcc21652c9fb3867f64d4941.tmp
2288	5f4371e9fcc21652c9fb3867f64d4941.tmp
2288	5f4371e9fcc21652c9fb3867f64d4941.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Runs net.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2288	5f4371e9fcc21652c9fb3867f64d4941.tmp

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 2288	2652	5f4371e9fcc21652c9fb3867f64d4941.exe	28
PID 2652 wrote to memory of 2288	2652	5f4371e9fcc21652c9fb3867f64d4941.exe	28
PID 2652 wrote to memory of 2288	2652	5f4371e9fcc21652c9fb3867f64d4941.exe	28
PID 2652 wrote to memory of 2288	2652	5f4371e9fcc21652c9fb3867f64d4941.exe	28
PID 2652 wrote to memory of 2288	2652	5f4371e9fcc21652c9fb3867f64d4941.exe	28
PID 2652 wrote to memory of 2288	2652	5f4371e9fcc21652c9fb3867f64d4941.exe	28
PID 2652 wrote to memory of 2288	2652	5f4371e9fcc21652c9fb3867f64d4941.exe	28
PID 2288 wrote to memory of 1972	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	29
PID 2288 wrote to memory of 1972	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	29
PID 2288 wrote to memory of 1972	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	29
PID 2288 wrote to memory of 1972	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	29
PID 2288 wrote to memory of 2884	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	31
PID 2288 wrote to memory of 2884	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	31
PID 2288 wrote to memory of 2884	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	31
PID 2288 wrote to memory of 2884	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	31
PID 1972 wrote to memory of 2932	1972	net.exe	32
PID 1972 wrote to memory of 2932	1972	net.exe	32
PID 1972 wrote to memory of 2932	1972	net.exe	32
PID 1972 wrote to memory of 2932	1972	net.exe	32
PID 2288 wrote to memory of 1632	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	33
PID 2288 wrote to memory of 1632	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	33
PID 2288 wrote to memory of 1632	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	33
PID 2288 wrote to memory of 1632	2288	5f4371e9fcc21652c9fb3867f64d4941.tmp	33

C:\Users\Admin\AppData\Local\Temp\5f4371e9fcc21652c9fb3867f64d4941.exe
"C:\Users\Admin\AppData\Local\Temp\5f4371e9fcc21652c9fb3867f64d4941.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Users\Admin\AppData\Local\Temp\is-ALCPP.tmp\5f4371e9fcc21652c9fb3867f64d4941.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-ALCPP.tmp\5f4371e9fcc21652c9fb3867f64d4941.tmp" /SL5="$30150,4446766,54272,C:\Users\Admin\AppData\Local\Temp\5f4371e9fcc21652c9fb3867f64d4941.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2288
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 1103
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1972
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 1103
      4⤵
      PID:2932
- - C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe
    "C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2884
- - C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe
    "C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe

Filesize
648KB

MD5
fa32d12b2dd88c3a6c022a5eca44ec2e

SHA1
0b755b61a8281075ee01d7e717a93a8087883e68

SHA256
46a782559d3f61a55faa65da4ee89b1e058874fdeea33ac285dd27c440cc0739

SHA512
09d9077443acae7b64193587c42aa83c88b7e3821294d41b3c3f29eaad6c666b3d497165b17cf2eae853c53d0570da9b5044c955255de0b2787b96dbe2776191

Download Submit
C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe

Filesize
74KB

MD5
a56aa62a6261a89638cd55d932a94e44

SHA1
068a3db90c26b8520c80ebab9ca687bde78e4e13

SHA256
ba34b5f671cbd5eca78f481a450efda1b75d1c1995850e49f967460a04e2eaa0

SHA512
9c28aafb152324139c08400e7c404cb6ef2437dde614f6649dd4f0da3a2e8dc2386ee5e3edb83e31bf3cdc25b259f58ed0e4c4a7505a96b55ddea8fd756e8ed2

Download Submit
C:\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe

Filesize
645KB

MD5
8242d28a7ea8a052b8f60c0839b31584

SHA1
a946f25f2fccd6071eee92201e9b2563f146e3be

SHA256
0c4ed52165a0d8d86a2f69ed8242ebf9922787b33ed92b2d478b2aa113442d28

SHA512
b47e868de1f45ba935d03dc41ecfbbe91292e6d4229a3124fb5d7ed6db99c5206a53255e5e38ad174e92c78d91faeb163bdf75570d88d1eae7566231ff3ac5b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-ALCPP.tmp\5f4371e9fcc21652c9fb3867f64d4941.tmp

Filesize
688KB

MD5
a7662827ecaeb4fc68334f6b8791b917

SHA1
f93151dd228d680aa2910280e51f0a84d0cad105

SHA256
05f159722d6905719d2d6f340981a293f40ab8a0d2d4a282c948066809d4af6d

SHA512
e9880b3f3ec9201e59114850e9c570d0ad6d3b0e04c60929a03cf983c62c505fcb6bb9dc3adeee88c78d43bd484159626b4a2f000a34b8883164c263f21e6f4a

Download Submit
\Users\Admin\AppData\Local\DVD Drive report viewer\dvdreportviewer.exe

Filesize
1.6MB

MD5
318cd1cf0a1e96ed5bfbf8679833e385

SHA1
e4b6d1aa044843c7c774c81625b2bd1bcf7d48dd

SHA256
af654c7a101f940b8acddfdcaf730f3df80f4fe6993597cba96f00fd2bfad982

SHA512
1407d7252af6f84a4f55c9eccf18a092a6404414283b09dfdba201718196e13c9a2605bb53a409246db59f0b2234027ffa4bb9f669cb9c17c45840ff02cd0025

Download Submit
\Users\Admin\AppData\Local\Temp\is-ALCPP.tmp\5f4371e9fcc21652c9fb3867f64d4941.tmp

Filesize
608KB

MD5
b43d74fa6adb3f52af55acba5a74d660

SHA1
63975bbf05865fce22ffa58e13a93762ffb8cb0b

SHA256
835f1f672859761160dd969febb80c99f64681bf1e3269a30edb9a40990a3c73

SHA512
b8923b0c2c63211300556b60f05c9673a4e4d73c2e2d652fdf42e256fe1e70796ce68644a9282eed6dd5b85c28d8b14f6175f7addc01da816b91dfdb4bb00166

Download Submit
\Users\Admin\AppData\Local\Temp\is-MGD4P.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-MGD4P.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-MGD4P.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1632-155-0x0000000002730000-0x00000000027D2000-memory.dmp

Filesize
648KB

Download
memory/1632-161-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-184-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-181-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-177-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-174-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-171-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-132-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-168-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-167-0x0000000002730000-0x00000000027D2000-memory.dmp

Filesize
648KB

Download
memory/1632-135-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-164-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-156-0x0000000002730000-0x00000000027D2000-memory.dmp

Filesize
648KB

Download
memory/1632-140-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-141-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-144-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-145-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-148-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-151-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/1632-154-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/2288-137-0x0000000002EC0000-0x0000000003089000-memory.dmp

Filesize
1.8MB

Download
memory/2288-136-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2288-134-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2288-8-0x00000000003C0000-0x00000000003C1000-memory.dmp

Filesize
4KB

Download
memory/2288-122-0x0000000002EC0000-0x0000000003089000-memory.dmp

Filesize
1.8MB

Download
memory/2652-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2652-133-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2884-124-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/2884-129-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/2884-128-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download
memory/2884-125-0x0000000000400000-0x00000000005C9000-memory.dmp

Filesize
1.8MB

Download