socks5systemz | 499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d

General

Target

499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.exe
Size

3.4MB
MD5

592a701bc4892547ef1a96a6336548de
SHA1

b9cf102da3627d412154736f09f8ecfac42a59fd
SHA256

499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d
SHA512

c1a9ab4c6fb2b55ce0f4dd215539203952ceb52370acbe969f846eb58c7fe44305d454cda7008e1f793ffc3af074ed009a4adaef3ef547b1b3b6e25ba9d86bd4
SSDEEP

98304:cjBf676DpowCfpV48epyfqhhYW/8ZEflpvEvCYjxlE:6fA6FowCfrMpyMR8ZEflaqYjxu

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

Attributes

rc4_key
i4hiea56#7b&dfw3

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1560-88-0x00000000009E0000-0x0000000000A8D000-memory.dmp	family_socks5systemz
behavioral2/memory/1560-90-0x00000000009E0000-0x0000000000A8D000-memory.dmp	family_socks5systemz
behavioral2/memory/1560-99-0x00000000009E0000-0x0000000000A8D000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
2424	TVLand.exe
1560	TVLand.exe

Loads dropped DLL 3 IoCs

pid	Process
4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops file in Program Files directory 19 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\TVLand\UIText\is-DVTFA.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File opened for modification	C:\Program Files (x86)\Common Files\TVLand\unins000.dat	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-8DQIP.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-JM99Q.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-3H8LA.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-QBQ80.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File opened for modification	C:\Program Files (x86)\Common Files\TVLand\TVLand.exe	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-1LH1Q.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-GPON6.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-CDA3K.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-2FNJ8.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-EOSNL.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-KK23K.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\UIText\is-HFR0I.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-TD17E.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-IL152.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\unins000.dat	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-KTP3E.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
File created	C:\Program Files (x86)\Common Files\TVLand\is-J556U.tmp	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs net.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 4676	2296	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.exe	44
PID 2296 wrote to memory of 4676	2296	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.exe	44
PID 2296 wrote to memory of 4676	2296	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.exe	44
PID 4676 wrote to memory of 1204	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	73
PID 4676 wrote to memory of 1204	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	73
PID 4676 wrote to memory of 1204	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	73
PID 4676 wrote to memory of 2424	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	75
PID 4676 wrote to memory of 2424	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	75
PID 4676 wrote to memory of 2424	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	75
PID 4676 wrote to memory of 96	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	78
PID 4676 wrote to memory of 96	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	78
PID 4676 wrote to memory of 96	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	78
PID 4676 wrote to memory of 1560	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	77
PID 4676 wrote to memory of 1560	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	77
PID 4676 wrote to memory of 1560	4676	499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp	77
PID 96 wrote to memory of 220	96	net.exe	79
PID 96 wrote to memory of 220	96	net.exe	79
PID 96 wrote to memory of 220	96	net.exe	79

C:\Users\Admin\AppData\Local\Temp\499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.exe
"C:\Users\Admin\AppData\Local\Temp\499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\is-TJLRI.tmp\499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TJLRI.tmp\499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp" /SL5="$801F8,3336069,76288,C:\Users\Admin\AppData\Local\Temp\499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Program Files directory
  - Suspicious use of WriteProcessMemory
  PID:4676
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\system32\schtasks.exe" /Query
    3⤵
    PID:1204
- - C:\Program Files (x86)\Common Files\TVLand\TVLand.exe
    "C:\Program Files (x86)\Common Files\TVLand\TVLand.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2424
- - C:\Program Files (x86)\Common Files\TVLand\TVLand.exe
    "C:\Program Files (x86)\Common Files\TVLand\TVLand.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1560
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\system32\net.exe" helpmsg 27
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:96
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 helpmsg 27
      4⤵
      PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\TVLand\TVLand.exe

Filesize
524KB

MD5
13c36e755536c72d9e7858149856f92d

SHA1
d31cbef11598cb8883e812f17826925597bb7bfe

SHA256
158b4eb6dfc3f3cc08a93575edaf11fe977a3ca3dfd420c4e6d06d9a90440031

SHA512
7f42b507c5257b89c9865338325c95f6e2402f387123bbc157e0f3a23ea3c86f121a783d49210f63ba6c4f76808cc0ee8f4fc112d5d7847e76e384d15c07049b

Download Submit
C:\Program Files (x86)\Common Files\TVLand\TVLand.exe

Filesize
113KB

MD5
4cca7ce515645f3b8e5d3ab6644bdb3c

SHA1
e9e2a845d700501d88a571ba82a21f22a26983e4

SHA256
061b2c70e5152dca3c6127c100bfe5b7435aa3d0dba1a1de5ba26761f00cd94e

SHA512
3d5b3b93b83db054550d5f633e1994724edeaf3cd00c4ed22fa8762066a72b8206d8460c0f0be445b7ee192f0f45bbff30f56662196192f69994772768029772

Download Submit
C:\Program Files (x86)\Common Files\TVLand\TVLand.exe

Filesize
131KB

MD5
ea41053ab5b4cab1d3b55659a7640d77

SHA1
9f61236c0fd2a8e8fd6a26c0752b5ba9e76c341a

SHA256
2ff3d35b3f5d6ab92184917afca1e7992fafaf78a912352c896e8a13382226a5

SHA512
81febdd69371d7539d77d90b105a73f650053a0203e293c41a885257e982c6f108f5a3399c4e89c3eb66675c9cea83e31198ffa1dc6f03b78d3ac76845ef305b

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TJLRI.tmp\499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp

Filesize
325KB

MD5
70ef1cec92a5e7f80da0e0c51cf9cf6a

SHA1
a20778ff7e80ef07e15e7b23d99c054f422b7824

SHA256
85b22653d1d36a6d7855dd9e49818ad2f540a385864580c8d06c421b014b806f

SHA512
132e675866561fa00db9dc5b69cbf40a601f225e03d25b5bc8da548ad5bab8c112da26aa2b42301898a907802f534a159920e555fa9df8c0bfbb3ae961813b82

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TJLRI.tmp\499ffbd3b9de920c56d02a330be136c49203e6b9f226398a006be470eda8ce0d.tmp

Filesize
329KB

MD5
90fb5c129e3e608f55fb48a3557e0de8

SHA1
94e4a8470f640849182186c43aab56d7909b0c85

SHA256
945448340d5d8cbbf2bb44301698240071cd8f6507d66ac7768f990a67a73176

SHA512
524d894e03ea7aab97f24bd79a60413bcd34f9504791526d37368d9de9798c56fe195c89c08c3b01e0da126b34e26a5dbf2112fce34c9722f7e84daad88c1052

Download Submit
\Users\Admin\AppData\Local\Temp\is-OKUAC.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-OKUAC.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b6f11a0ab7715f570f45900a1fe84732

SHA1
77b1201e535445af5ea94c1b03c0a1c34d67a77b

SHA256
e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67

SHA512
78a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771

Download Submit
memory/1560-102-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-108-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-135-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-130-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-127-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-124-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-121-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-68-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-118-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-115-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-71-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-112-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-75-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-76-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-79-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-82-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-85-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-88-0x00000000009E0000-0x0000000000A8D000-memory.dmp

Filesize
692KB

Download
memory/1560-90-0x00000000009E0000-0x0000000000A8D000-memory.dmp

Filesize
692KB

Download
memory/1560-89-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-95-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-98-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/1560-99-0x00000000009E0000-0x0000000000A8D000-memory.dmp

Filesize
692KB

Download
memory/1560-105-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/2296-0-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2296-69-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2296-2-0x0000000000400000-0x000000000041A000-memory.dmp

Filesize
104KB

Download
memory/2424-60-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/2424-65-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/2424-64-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/2424-61-0x0000000000400000-0x00000000007E8000-memory.dmp

Filesize
3.9MB

Download
memory/4676-72-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/4676-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4676-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing