socks5systemz | 211560aabd0a46ef0dde5f5a94bfefa3d1cad47ae133f526844d19dc623aad20

Analysis

max time kernel
126s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11/01/2024, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bf91b07dee48c48359b2f92f72b3e5a.exe
Size 4.6MB
Sample240111-jptrxacgd9
SHA256 211560aabd0a46ef0dde5f5a94bfefa3d1cad47ae133f526844d19dc623aad20
MD5 6bf91b07dee48c48359b2f92f72b3e5a
SHA1 c8cc840035cbb6bef239f5647c079fcc6de87d8f
SHA512 3b989fbd3d6039c3977c5013d485437e835762b3f0b4c5c4f17bf1f209d7edbd4724f2a640cfbcdd37e251922e90ebb55f411b050ebfad8ff6896b82af22f366
SSDEEP 98304:5i/pvA3Q7kfCZwAHUbfc+SAaH7fXgK4ExtEsG6fHXyUcW1f/wCnJV9yyy4Jkw:o/pv0ekf1l477fQox2bOyUL+CJV9ySF
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2832-161-0x0000000002A30000-0x0000000002AD2000-memory.dmp	family_socks5systemz
behavioral1/memory/2832-157-0x0000000002A30000-0x0000000002AD2000-memory.dmp	family_socks5systemz
behavioral1/memory/2832-168-0x0000000002A30000-0x0000000002AD2000-memory.dmp	family_socks5systemz
behavioral1/memory/2832-182-0x0000000002A30000-0x0000000002AD2000-memory.dmp	family_socks5systemz
behavioral1/memory/2832-181-0x0000000002A30000-0x0000000002AD2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2164	is-PH0AD.tmp
2968	imaptestplugin.exe
2832	imaptestplugin.exe

Loads dropped DLL 10 IoCs

pid	Process
2536	6bf91b07dee48c48359b2f92f72b3e5a.exe
2164	is-PH0AD.tmp
2164	is-PH0AD.tmp
2164	is-PH0AD.tmp
2164	is-PH0AD.tmp
2968	imaptestplugin.exe
2968	imaptestplugin.exe
2164	is-PH0AD.tmp
2832	imaptestplugin.exe
2832	imaptestplugin.exe

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 2164	2536	6bf91b07dee48c48359b2f92f72b3e5a.exe	28
PID 2536 wrote to memory of 2164	2536	6bf91b07dee48c48359b2f92f72b3e5a.exe	28
PID 2536 wrote to memory of 2164	2536	6bf91b07dee48c48359b2f92f72b3e5a.exe	28
PID 2536 wrote to memory of 2164	2536	6bf91b07dee48c48359b2f92f72b3e5a.exe	28
PID 2536 wrote to memory of 2164	2536	6bf91b07dee48c48359b2f92f72b3e5a.exe	28
PID 2536 wrote to memory of 2164	2536	6bf91b07dee48c48359b2f92f72b3e5a.exe	28
PID 2536 wrote to memory of 2164	2536	6bf91b07dee48c48359b2f92f72b3e5a.exe	28
PID 2164 wrote to memory of 2632	2164	is-PH0AD.tmp	29
PID 2164 wrote to memory of 2632	2164	is-PH0AD.tmp	29
PID 2164 wrote to memory of 2632	2164	is-PH0AD.tmp	29
PID 2164 wrote to memory of 2632	2164	is-PH0AD.tmp	29
PID 2164 wrote to memory of 2632	2164	is-PH0AD.tmp	29
PID 2164 wrote to memory of 2632	2164	is-PH0AD.tmp	29
PID 2164 wrote to memory of 2632	2164	is-PH0AD.tmp	29
PID 2164 wrote to memory of 2968	2164	is-PH0AD.tmp	31
PID 2164 wrote to memory of 2968	2164	is-PH0AD.tmp	31
PID 2164 wrote to memory of 2968	2164	is-PH0AD.tmp	31
PID 2164 wrote to memory of 2968	2164	is-PH0AD.tmp	31
PID 2164 wrote to memory of 2968	2164	is-PH0AD.tmp	31
PID 2164 wrote to memory of 2968	2164	is-PH0AD.tmp	31
PID 2164 wrote to memory of 2968	2164	is-PH0AD.tmp	31
PID 2632 wrote to memory of 2948	2632	net.exe	32
PID 2632 wrote to memory of 2948	2632	net.exe	32
PID 2632 wrote to memory of 2948	2632	net.exe	32
PID 2632 wrote to memory of 2948	2632	net.exe	32
PID 2632 wrote to memory of 2948	2632	net.exe	32
PID 2632 wrote to memory of 2948	2632	net.exe	32
PID 2632 wrote to memory of 2948	2632	net.exe	32
PID 2164 wrote to memory of 2832	2164	is-PH0AD.tmp	33
PID 2164 wrote to memory of 2832	2164	is-PH0AD.tmp	33
PID 2164 wrote to memory of 2832	2164	is-PH0AD.tmp	33
PID 2164 wrote to memory of 2832	2164	is-PH0AD.tmp	33
PID 2164 wrote to memory of 2832	2164	is-PH0AD.tmp	33
PID 2164 wrote to memory of 2832	2164	is-PH0AD.tmp	33
PID 2164 wrote to memory of 2832	2164	is-PH0AD.tmp	33

C:\Users\Admin\AppData\Local\Temp\6bf91b07dee48c48359b2f92f72b3e5a.exe
"C:\Users\Admin\AppData\Local\Temp\6bf91b07dee48c48359b2f92f72b3e5a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\is-CPODG.tmp\is-PH0AD.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-CPODG.tmp\is-PH0AD.tmp" /SL4 $400EC "C:\Users\Admin\AppData\Local\Temp\6bf91b07dee48c48359b2f92f72b3e5a.exe" 4639005 431616
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2164
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 1111
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2632
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 1111
      4⤵
      PID:2948
- - C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
    "C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe" -i
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2968
- - C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
    "C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe" -s
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    PID:2832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

imaptestplugin.exe

Path C:\Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 382KB
SHA256 ac5323cdbfb5ab254e4cd170f4163c3b30d6ce66364b6e1db94073e7d8d65f42
MD5 617ef2f66912206fbbf5a530005b7f11
SHA1 7826b06ff17f23e61440ec333f9470425ce322b3
SHA512 d02551d44a8ad13a26d28502c9890bf0fd12b0d1506028d1298e1767854d2bd72ac85bdfae835460716a32489c2ba9ce1becf3f53f7bc1261d924e69f8c43122
SSDEEP 6144:Qe7E7cFOf6HIe7EPHjN2kiZWCGe7EDSKrPZh2rae7EmPtwabtc4jtYkZke7ET:ZEoUqBEPHp2keN3EDhKrrEmPW+/+kZtA
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-PH0AD.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-CPODG.tmp\is-PH0AD.tmp
Size 321KB
SHA256 dcd3a58a2e70da5c4438b38aed62efd27d3cf6e0382f7d24eb9ae23b997ab2bd
MD5 6046f617a781b3c33416c43a5d311ad1
SHA1 fcd89dc886b0564702e3f47716060e009777ffb3
SHA512 8492222a237d9f61071794c4388975e7eae7418cd8c9db2c1558522e6a9ebf504e8344e6354d162b2d0ba78f785b7c6ae2014d97308b2d81b2a25f981c9cf170
SSDEEP 6144:LggoLQocJU7oJtRauUVb3E5WIRrP9377zHJA6XQwHKWgI:0hmNwuOE5lrP9377zHJA6YZI
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 1024KB
SHA256 3be1aad3ff8619b31d538f8c5d15121c0eeebf7d93082424335ba65a116af99f
MD5 33f7c5d26c87d96f8a1c36cc2e0fc03b
SHA1 d09222227decde81595413b9c98c568cf7747938
SHA512 c1736eb59a15f16042dc83a50a9bf67ecc7222f378cc1f075879e704a7f5b99db1a3e69a87aa90facecea8a9549286f752aa95de8d430538984ee7e8d7079b91
SSDEEP 24576:ZEoXERVqE9crEmPWI+stEUk6eE+EcE5Ot0:ZEoXER4E9crEORTEn6eE+EcEMa
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 381KB
SHA256 3b97446a9f635dddaf33202696b41049563f9d842b7d48c12651c017f34e726d
MD5 7296be1ec0ed6e584c063e85e5f7e141
SHA1 1b1626e9e6e51bad2dd055a41cd2b1aeaf526c6b
SHA512 2883423a90da013d6dd63c7d962faaa8344ec7429da4c3b92a0df4dcc51b2b1e49beb93da7dbbf8ab22f49e1534b6a1da655db54244835b990a1d555b32cf60b
SSDEEP 6144:Qe7E7cFOf6HIe7EPHjN2kiZWCGe7EDSKrPZh2rae7EmPtwabtc4jtYkZke7Ea:ZEoUqBEPHp2keN3EDhKrrEmPW+/+kZtp
MD5 SHA1 SHA512 SSDEEP

Submit Download

imaptestplugin.exe

Path \Users\Admin\AppData\Local\IMAP test plugin\imaptestplugin.exe
Size 95KB
SHA256 834c7c221e1f521f25210d25d62f01c65bfcbc1c5ace3483e4fe97c1fe87566a
MD5 fd2ffec8c22fd70785da81a9ff0040b5
SHA1 2ec0e0b5bd4343c85679cf708f00e46b50c9a3c5
SHA512 985070e7d072d5f4d718a8e5dde60d416aad8e388aad2a5ecbe4fa3781bb761d8c2a3e0962258a43f61b5e3f92fa67d0d3261e78356943b526b4caee58b625bb
SSDEEP 1536:QoTcH2QW6CPekmS9MutdLaySGriFkRxXYLV17x9iGh5zkUr2YZefIo:QecWQW6CPhaySclPoLNf6GgIo
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path \Users\Admin\AppData\Local\Temp\is-AACKT.tmp\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-AACKT.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

is-PH0AD.tmp

Path \Users\Admin\AppData\Local\Temp\is-CPODG.tmp\is-PH0AD.tmp
Size 642KB
SHA256 2e7e5e01fa3d18a2a76e33dd139dbf251f1dd2ab77aba843b7ef09e51cd86c1a
MD5 856bce6609a05646759555e24a534467
SHA1 800c78d9d82bc1d0d631bdd11a9b766b6b964d2d
SHA512 5bbfca64610ed8c148a8e182de5e5568af34465698bf6cdd3f5ccc6857bb4b3d90cfc9e6f0f780464a2fe5c776e6ee69291877bb14b5f64b4e9d8791807af47a
SSDEEP 12288:0hmNwuOE5lrP9377zHJA6YZasySNsh7daVDSePPxp:2mNwuOE5lrP9377zHJA6zsyBsVD7Pxp
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2164-139-0x0000000000400000-0x00000000004CF000-memory.dmp

Download

memory/2164-117-0x0000000003600000-0x0000000003808000-memory.dmp

Download

memory/2164-132-0x0000000003600000-0x0000000003808000-memory.dmp

Download

memory/2536-138-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2536-2-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2536-0-0x0000000000400000-0x0000000000470000-memory.dmp

Download

memory/2832-151-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-161-0x0000000002A30000-0x0000000002AD2000-memory.dmp

Download

memory/2832-133-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-135-0x0000000000BB0000-0x0000000000DB8000-memory.dmp

Download

memory/2832-134-0x0000000000BB0000-0x0000000000DB8000-memory.dmp

Download

memory/2832-189-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-137-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-186-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-181-0x0000000002A30000-0x0000000002AD2000-memory.dmp

Download

memory/2832-140-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-145-0x0000000000BB0000-0x0000000000DB8000-memory.dmp

Download

memory/2832-144-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-143-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-148-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-182-0x0000000002A30000-0x0000000002AD2000-memory.dmp

Download

memory/2832-167-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-171-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-160-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-157-0x0000000002A30000-0x0000000002AD2000-memory.dmp

Download

memory/2832-164-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-154-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-168-0x0000000002A30000-0x0000000002AD2000-memory.dmp

Download

memory/2832-180-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-174-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2832-177-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2968-120-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2968-123-0x0000000000C90000-0x0000000000E98000-memory.dmp

Download

memory/2968-126-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2968-127-0x0000000000400000-0x0000000000608000-memory.dmp

Download

memory/2968-124-0x0000000000400000-0x0000000000608000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads