socks5systemz | e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b

Analysis

max time kernel
299s
max time network
301s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-02-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe
Size

7.4MB
MD5

5a16c8dcc90fa2c9b614a4cc9811819a
SHA1

7ab31ec54bb54603594fe3b32acd3adeef1f9708
SHA256

e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b
SHA512

765f235297348ee0a8f4f2b002aa2c8d5e93ef21f7c4cf63819020f5e26c384889fa06d3a65b8a12746ab872282129720ed5cab738c851269906461709c37703
SSDEEP

98304:IsJGinClmXF+U5g4EEi78IO/OyzEXkNv4j2+n8Qh+FSvMUUv55RZW4AuzY8ARu+q:DWqF/KhEq8IiZv4pn8Q8dZZ/ARlkH1

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

http://bubtoes.com/search/?q=67e28dd8690cfa2d120bac1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4fe8889b5e4fa9281ae978f171ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923b6086f717c5e89c

http://bubtoes.com/search/?q=67e28dd8690cfa2d120bac1c7c27d78406abdd88be4b12eab517aa5c96bd86e9948e4e885a8bbc896c58e713bc90c91a36b5281fc235a925ed3e52d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff811c7e79d9c3eca66

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2636-97-0x0000000002620000-0x00000000026C2000-memory.dmp	family_socks5systemz
behavioral1/memory/2636-98-0x0000000002620000-0x00000000026C2000-memory.dmp	family_socks5systemz
behavioral1/memory/2636-108-0x0000000002620000-0x00000000026C2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp
2724	magnatcoverdesigner.exe
2636	magnatcoverdesigner.exe

Loads dropped DLL 6 IoCs

pid	Process
1940	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1940 wrote to memory of 2220	1940	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe	28
PID 1940 wrote to memory of 2220	1940	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe	28
PID 1940 wrote to memory of 2220	1940	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe	28
PID 1940 wrote to memory of 2220	1940	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe	28
PID 1940 wrote to memory of 2220	1940	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe	28
PID 1940 wrote to memory of 2220	1940	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe	28
PID 1940 wrote to memory of 2220	1940	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe	28
PID 2220 wrote to memory of 2724	2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp	29
PID 2220 wrote to memory of 2724	2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp	29
PID 2220 wrote to memory of 2724	2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp	29
PID 2220 wrote to memory of 2724	2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp	29
PID 2220 wrote to memory of 2636	2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp	30
PID 2220 wrote to memory of 2636	2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp	30
PID 2220 wrote to memory of 2636	2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp	30
PID 2220 wrote to memory of 2636	2220	e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp	30

C:\Users\Admin\AppData\Local\Temp\e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe
"C:\Users\Admin\AppData\Local\Temp\e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1940
- C:\Users\Admin\AppData\Local\Temp\is-MINFG.tmp\e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MINFG.tmp\e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp" /SL5="$5014C,7522492,54272,C:\Users\Admin\AppData\Local\Temp\e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2220
- - C:\Users\Admin\AppData\Local\Magnat CoverDesigner\magnatcoverdesigner.exe
    "C:\Users\Admin\AppData\Local\Magnat CoverDesigner\magnatcoverdesigner.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2724
- - C:\Users\Admin\AppData\Local\Magnat CoverDesigner\magnatcoverdesigner.exe
    "C:\Users\Admin\AppData\Local\Magnat CoverDesigner\magnatcoverdesigner.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2636

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Magnat CoverDesigner\magnatcoverdesigner.exe

Filesize
960KB

MD5
e2c946a7edfba98b2f3e92619b06e07e

SHA1
1b394673e5c7eb54565a40d1fb10ae28a3cbcff9

SHA256
d0318a585c81bf715ae1e73f8c089a093a187119335a18f74565e3986e689963

SHA512
bb629e7a2109b58496b2963d3df45cb9485987a126bee6410adc79019922f6ae7100e80708ea9bedc80671c48d2042b251e5e46b311f425f277f10a7c271b914

Download Submit
C:\Users\Admin\AppData\Local\Magnat CoverDesigner\magnatcoverdesigner.exe

Filesize
2.3MB

MD5
7d34d7484bc4534c3b95c4c5c0c3e3bf

SHA1
3e523d77601577560b5ecbc6bd7bcd9abdcdf17e

SHA256
4a7d11bb553280e2413fcf84fe6d7b6fe5c05bce1b8adef04f6b237244747b6c

SHA512
696adf2437a76ff46c175e82acc65cd9dc3642125e794dd372a1e797509da0123ec1221881c4656ce003f4d8ee8e4285a691bb237aff9b7987751162f21f9104

Download Submit
C:\Users\Admin\AppData\Local\Magnat CoverDesigner\magnatcoverdesigner.exe

Filesize
2.0MB

MD5
efe09c211024ccdd48bc96d9ef9ddb1f

SHA1
48d444d8a155603a9460de5866cd7983c5002c29

SHA256
b6c703b649942b42a1918f17a1df8dadf054e6f4cdbb4140fc0d85af0046691e

SHA512
861e553bed9825d8ef0b9bbad72568d78cca09e627f684c7d86ac355f6da484fbed05949d6f3e6b531595c4d4473d2c011f4952220f3f29710fa2afa23247be5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MINFG.tmp\e13c6d0463f12f15ddcebedb8704d28ce6621fe775a88a739963c2189d5fc67b.tmp

Filesize
689KB

MD5
9ef1392bc232ca156cab448572b4895e

SHA1
892b3f23908965c3373bb9daa4026013913f757c

SHA256
f65f2eb96a4c91c54dd5e5680d954b5080ecf676ec45ec35809af28e4f409bb8

SHA512
724d1de60ee2bfbaaad39fddc6c68fa8d2cebb17e0ab94a420deaa43a66b497ea581234a9470e0b09f01b40412bee4e8a95d4d1c634a4703e75851705b71a98b

Download Submit
\Users\Admin\AppData\Local\Magnat CoverDesigner\magnatcoverdesigner.exe

Filesize
881KB

MD5
3029c7cb70c8ab6ce58d6de2be06f073

SHA1
2a23d7dc7203c291c4ff3977f3be8bcca29a574a

SHA256
339eda85417b3d92336e518aab422285a56e49e77c819335d1f8083e401b84f3

SHA512
303a1ce58a3cdb882a52dde9a579d678c84839c2230962110efef43e96a758b7ca98e84350476b5278ccd288b6fd47262efa03b2256948ffc5e7e464bc6fe574

Download Submit
\Users\Admin\AppData\Local\Temp\is-00MHS.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-00MHS.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-00MHS.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1940-76-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1940-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1940-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2220-65-0x0000000003580000-0x00000000037D6000-memory.dmp

Filesize
2.3MB

Download
memory/2220-80-0x0000000003580000-0x00000000037D6000-memory.dmp

Filesize
2.3MB

Download
memory/2220-12-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2220-79-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2220-77-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2636-108-0x0000000002620000-0x00000000026C2000-memory.dmp

Filesize
648KB

Download
memory/2636-104-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-73-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-144-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-78-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-139-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-136-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-83-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-84-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-87-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-90-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-93-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-96-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-97-0x0000000002620000-0x00000000026C2000-memory.dmp

Filesize
648KB

Download
memory/2636-98-0x0000000002620000-0x00000000026C2000-memory.dmp

Filesize
648KB

Download
memory/2636-75-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-107-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-133-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-111-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-114-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-117-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-120-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-124-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-127-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2636-130-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2724-66-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2724-67-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2724-71-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download
memory/2724-70-0x0000000000400000-0x0000000000656000-memory.dmp

Filesize
2.3MB

Download