socks5systemz | fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22

General

Target

fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe
Size

7.5MB
MD5

42f5eb399ee94ad2bb7809e600abebf7
SHA1

3a2c7d6b63ce50367c9c27a08a164ac037663919
SHA256

fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22
SHA512

0e39437fb30e47817e4b86d77d83037f6962df69996cb0cb343714bd641705403a24850f2a4d9760bbd0c19cfd75fb9d4e4aa67612682b203429300152d61cfa
SSDEEP

196608:iCKQKmhnguWQkn9sl7pQ//XYenYQs9bOBKhOcq3RW:DmmVuQkn9sl7KX2QswBKhnyE

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 5 IoCs

resource	yara_rule
behavioral2/memory/2392-91-0x0000000000A40000-0x0000000000AE2000-memory.dmp	family_socks5systemz
behavioral2/memory/2392-95-0x0000000000A40000-0x0000000000AE2000-memory.dmp	family_socks5systemz
behavioral2/memory/2392-104-0x0000000000A40000-0x0000000000AE2000-memory.dmp	family_socks5systemz
behavioral2/memory/2392-117-0x0000000000A40000-0x0000000000AE2000-memory.dmp	family_socks5systemz
behavioral2/memory/2392-118-0x0000000000A40000-0x0000000000AE2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Detects executables packed with VMProtect. 19 IoCs

resource	yara_rule
behavioral2/memory/2392-72-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2156-68-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2156-67-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2156-64-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-75-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-79-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-80-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-83-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-86-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-89-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-94-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-100-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-103-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-107-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-110-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-113-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-116-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-122-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2392-125-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 3 IoCs

pid	Process
1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
2156	etcherlite.exe
2392	etcherlite.exe

Loads dropped DLL 3 IoCs

pid	Process
1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1496	2244	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe	19
PID 2244 wrote to memory of 1496	2244	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe	19
PID 2244 wrote to memory of 1496	2244	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe	19
PID 1496 wrote to memory of 2156	1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	26
PID 1496 wrote to memory of 2156	1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	26
PID 1496 wrote to memory of 2156	1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	26
PID 1496 wrote to memory of 2392	1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	27
PID 1496 wrote to memory of 2392	1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	27
PID 1496 wrote to memory of 2392	1496	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	27

C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe
"C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\is-DSNN0.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-DSNN0.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp" /SL5="$7006E,7652121,54272,C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1496
- - C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe
    "C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2156
- - C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe
    "C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe

Filesize
73KB

MD5
1492297527f8aca8e595234a6fe0da78

SHA1
563ed6a8187b5938c6c50b633848f21b1e2cbeb5

SHA256
3debd93869c9ffea1aef669f3240b899a5e1497fa75c346688044c58696deb80

SHA512
3692eaa034e51a051f3103e877d8f5f4ea6da5c95200038f8b69f93e14cee589c0c2d3b01b55934dd29e14c4e91e11891ee69682dc153a8767fd0b2cb61cd139

Download Submit
C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe

Filesize
14KB

MD5
d03d5f46af85455fd48ca4cef2606676

SHA1
ecae406bdcd7994bcc152631c4d30b7f063661c2

SHA256
9f41a2f036374878a40d35c35993971454664838cb5c676424379f1f21ef3c29

SHA512
23a6891f65ca5eb12aa005b8e2f1df911d6fc36131b2a6d2aabe6897bc286a3f6d404ecd2490a2da1cb0bb0f5c0ba8a0dea270524907f6befb723740ade2637e

Download Submit
C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe

Filesize
57KB

MD5
f883f56cb248230e95d7c1cd733d6991

SHA1
63a1d3fef368f8055f3a8e78ba60a5fe9a26349a

SHA256
5b2b016f49e28da866d7602f698fddbbed9c83c510ecd769caba4ab374d54f1b

SHA512
ce4ea5e4c68de92156df3c3a4b85e32f2cff5370ca1ca6ef8bf4357406d17568af7e0956ee649ae8d054e19dbcfbdd2b769cd08f72db3aec82136179e6970c08

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BDBUD.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BDBUD.tmp\_isetup\_isdecmp.dll

Filesize
1KB

MD5
53e91ee215f171e5337de9eadf2b7918

SHA1
e67d6bb06741306f964bdf21cb0426915e866488

SHA256
b765ef42a83ab9ec273f6a6aada2f5ab995ccbce40e7757fab35d77133da00a7

SHA512
fe24ad561525254de67cc62dd5e328242cd4cd1bbf943ac14736a5933974b153e413eca3d352af3eea8a8e3afc7dbc20795177e5d286f994e85bb8f594a3dae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BDBUD.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DSNN0.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Filesize
27KB

MD5
0cfcd49361e58af0d6c167d4d8df9b46

SHA1
5315c42f865fdc3a192a5388bb1fca89f1e1228e

SHA256
a398da50eca92db2677d92027a40cf85b4833a0d82b1817394a0e9463602fad1

SHA512
4554dc22016f9dba618d621e95b719dbc392fc3d42439a1c504da125fbd9c2db5dd29cdac868c66884f6618b07db83cb53aa129852b15a33857174a6cf391df0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-DSNN0.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Filesize
38KB

MD5
a3c14e8bf6292ae56cae78b3c271ba7b

SHA1
91357f69990e9f8ffd835ad2ce1992a7509496d8

SHA256
b7520ab95ae1b20f621845d915dd7247cb30f398ef24b0724293a1d9e4bf9154

SHA512
daaf935b0509bd6bb449a062d622c5b1ed0bcd43d5a3c295b18bd3665ca912e2db69240ed9109e3b28f0c7c056c6ace9d254b67414a4a92e812727e5de88b1ba

Download Submit
memory/1496-76-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1496-9-0x0000000000660000-0x0000000000661000-memory.dmp

Filesize
4KB

Download
memory/1496-74-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2156-63-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2156-68-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2156-67-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2156-64-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2244-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2244-73-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2244-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2392-72-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-100-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-71-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-79-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-80-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-83-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-86-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-89-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-91-0x0000000000A40000-0x0000000000AE2000-memory.dmp

Filesize
648KB

Download
memory/2392-94-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-95-0x0000000000A40000-0x0000000000AE2000-memory.dmp

Filesize
648KB

Download
memory/2392-75-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-103-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-104-0x0000000000A40000-0x0000000000AE2000-memory.dmp

Filesize
648KB

Download
memory/2392-107-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-110-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-113-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-116-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-117-0x0000000000A40000-0x0000000000AE2000-memory.dmp

Filesize
648KB

Download
memory/2392-118-0x0000000000A40000-0x0000000000AE2000-memory.dmp

Filesize
648KB

Download
memory/2392-122-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2392-125-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing