socks5systemz | fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22

General

Target

fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe
Size

7.5MB
MD5

42f5eb399ee94ad2bb7809e600abebf7
SHA1

3a2c7d6b63ce50367c9c27a08a164ac037663919
SHA256

fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22
SHA512

0e39437fb30e47817e4b86d77d83037f6962df69996cb0cb343714bd641705403a24850f2a4d9760bbd0c19cfd75fb9d4e4aa67612682b203429300152d61cfa
SSDEEP

196608:iCKQKmhnguWQkn9sl7pQ//XYenYQs9bOBKhOcq3RW:DmmVuQkn9sl7KX2QswBKhnyE

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://bxjbjwk.com/search/?q=67e28dd86c5ea67d110ca51d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978a571ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ef816c2ed979a32

http://bxjbjwk.com/search/?q=67e28dd86c5ea67d110ca51d7c27d78406abdd88be4b12eab517aa5c96bd86eb94804b815a8bbc896c58e713bc90c91b36b5281fc235a925ed3e06d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ef929d39cf6d961f

Signatures

Detect Socks5Systemz Payload 5 IoCs

resource	yara_rule
behavioral2/memory/2352-91-0x0000000000AA0000-0x0000000000B42000-memory.dmp	family_socks5systemz
behavioral2/memory/2352-94-0x0000000000AA0000-0x0000000000B42000-memory.dmp	family_socks5systemz
behavioral2/memory/2352-103-0x0000000000AA0000-0x0000000000B42000-memory.dmp	family_socks5systemz
behavioral2/memory/2352-116-0x0000000000AA0000-0x0000000000B42000-memory.dmp	family_socks5systemz
behavioral2/memory/2352-117-0x0000000000AA0000-0x0000000000B42000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Detects executables packed with VMProtect. 19 IoCs

resource	yara_rule
behavioral2/memory/2092-64-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2092-68-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2092-67-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-71-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-74-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-78-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-79-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-82-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-85-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-88-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-93-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-99-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-102-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-106-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-109-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-112-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-115-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-121-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral2/memory/2352-124-0x0000000000400000-0x00000000007C1000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 3 IoCs

pid	Process
2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
2092	etcherlite.exe
2352	etcherlite.exe

Loads dropped DLL 3 IoCs

pid	Process
2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2444	1628	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe	85
PID 1628 wrote to memory of 2444	1628	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe	85
PID 1628 wrote to memory of 2444	1628	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe	85
PID 2444 wrote to memory of 2092	2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	86
PID 2444 wrote to memory of 2092	2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	86
PID 2444 wrote to memory of 2092	2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	86
PID 2444 wrote to memory of 2352	2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	87
PID 2444 wrote to memory of 2352	2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	87
PID 2444 wrote to memory of 2352	2444	fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp	87

C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe
"C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Users\Admin\AppData\Local\Temp\is-AOUCC.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AOUCC.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp" /SL5="$B0208,7652121,54272,C:\Users\Admin\AppData\Local\Temp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe
    "C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2092
- - C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe
    "C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe

Filesize
2.9MB

MD5
8b1bb9e32b3df1d98784939d827bc1b2

SHA1
791a20d896b1d621503ccaf6d2d2377c73327c96

SHA256
89e5074c696eae4786b5ee30bcfa7960bec9abeefca0fe575f4d3e1ff627811f

SHA512
6eed204de5600d389c8ba2a9717ca3f9d8fc2a578ec548bbe64851067598bf09a2bf2e8cda5a66ad2dd6a579dd66653439e69b0c10fc98aa2c5fbbf82c86ac6f

Download Submit
C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe

Filesize
981KB

MD5
b005173d161a5a87fd73f58c47757faa

SHA1
1181c31990b586e886e9043312a8fb95e5a34ac4

SHA256
51bd49f0aea6c6e9dd64582d9628bcca2db01591b38aba06dbe64abd422f8b17

SHA512
c640324118547fafa1b1fca269fc50c3399405efe5414d10ba8244df6be7744cbc4969882fe644c71881a6f19997ca6c98598829b7027cec235d07ba8943e131

Download Submit
C:\Users\Admin\AppData\Local\Etcher Lite\etcherlite.exe

Filesize
799KB

MD5
d7d68fd16a5f5cb44b0b176db005dbbe

SHA1
81198e56a22e7520faf2f8a40b9984ed8c1a1d16

SHA256
2d7417c73a2f334f0a211a22dc41ac5286575fcd08f08affd93ee550035ace4c

SHA512
6974ff0f051139b866cf8945db8b1b84af932b53de6c086d9e783b32f0b78bef9dc35430d76e6d388118de6c10e7b32a81bc01e6ef408ddd81f34638c875fe39

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-AOUCC.tmp\fec8e6f6b14a88b99cae2e25ecac09cc605c0d3b73402c9b3f14f874f6b3cb22.tmp

Filesize
687KB

MD5
cf35057735cf9b33eae98893b016854f

SHA1
dec2d4a603c7c9a4d727cd43e8bab773be00c7e4

SHA256
5cce70e17636268129c1a83f6141024920273fb04e2e868c5a726305dc2bf77c

SHA512
dbae41768d7dc126e0e50e384c96bfd73203104bc422408aa175ba658e6aa01ae82c6d5fe4ea9734a09cc5853d80a5191694e53f9b8ed9d9c35f72a2abe06b17

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K4IUP.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-K4IUP.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
memory/1628-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1628-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1628-72-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2092-63-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2092-64-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2092-68-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2092-67-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-78-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-94-0x0000000000AA0000-0x0000000000B42000-memory.dmp

Filesize
648KB

Download
memory/2352-124-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-74-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-121-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-117-0x0000000000AA0000-0x0000000000B42000-memory.dmp

Filesize
648KB

Download
memory/2352-79-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-82-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-85-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-88-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-91-0x0000000000AA0000-0x0000000000B42000-memory.dmp

Filesize
648KB

Download
memory/2352-71-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-93-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-99-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-102-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-103-0x0000000000AA0000-0x0000000000B42000-memory.dmp

Filesize
648KB

Download
memory/2352-106-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-109-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-112-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-115-0x0000000000400000-0x00000000007C1000-memory.dmp

Filesize
3.8MB

Download
memory/2352-116-0x0000000000AA0000-0x0000000000B42000-memory.dmp

Filesize
648KB

Download
memory/2444-9-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2444-75-0x00000000006A0000-0x00000000006A1000-memory.dmp

Filesize
4KB

Download
memory/2444-73-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download

Analysis

Sharing