socks5systemz | a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a

General

Target

a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe
Size

2.4MB
MD5

47966d552ef2b5d1cfc6cbd8d39669fc
SHA1

19f55c91e934fa122793c6cd6e63ca2600585ad4
SHA256

a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a
SHA512

275c7b1c953ddf992bc9773d4f15bc5c839c17d5534a78d40cd9ba62d3e31d414c5b2e0415816d2056636283576364909cb4c3c1828598268c7edeea693546b2
SSDEEP

49152:C9dRiEpctuTm5P5743ExgJj+S5qYMyx6kH2QLcZiG0L7eIMF4EtB:MdRiHwCx747Lz7x6kH9gcmIMF4MB

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://bnmprum.com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923b6e8ff714c7e794

http://bnmprum.com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86e8928f48845a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff811c9ee9d9f3cc56e

Signatures

Detect Socks5Systemz Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2592-73-0x00000000026F0000-0x0000000002792000-memory.dmp	family_socks5systemz
behavioral1/memory/2592-76-0x00000000026F0000-0x0000000002792000-memory.dmp	family_socks5systemz
behavioral1/memory/2592-85-0x00000000026F0000-0x0000000002792000-memory.dmp	family_socks5systemz
behavioral1/memory/2592-98-0x00000000026F0000-0x0000000002792000-memory.dmp	family_socks5systemz
behavioral1/memory/2592-99-0x00000000026F0000-0x0000000002792000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Detects executables packed with VMProtect. 19 IoCs

resource	yara_rule
behavioral1/memory/2696-44-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2696-45-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2696-48-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-52-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-55-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-60-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-61-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-64-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-67-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-70-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-75-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-81-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-84-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-88-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-91-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-94-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-97-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-103-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2592-106-0x0000000000400000-0x00000000006E3000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 3 IoCs

pid	Process
2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp
2696	cdshrink.exe
2592	cdshrink.exe

Loads dropped DLL 5 IoCs

pid	Process
2100	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe
2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp
2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp
2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp
2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp
2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2964	2100	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe	28
PID 2100 wrote to memory of 2964	2100	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe	28
PID 2100 wrote to memory of 2964	2100	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe	28
PID 2100 wrote to memory of 2964	2100	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe	28
PID 2100 wrote to memory of 2964	2100	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe	28
PID 2100 wrote to memory of 2964	2100	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe	28
PID 2100 wrote to memory of 2964	2100	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe	28
PID 2964 wrote to memory of 2696	2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp	29
PID 2964 wrote to memory of 2696	2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp	29
PID 2964 wrote to memory of 2696	2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp	29
PID 2964 wrote to memory of 2696	2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp	29
PID 2964 wrote to memory of 2592	2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp	30
PID 2964 wrote to memory of 2592	2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp	30
PID 2964 wrote to memory of 2592	2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp	30
PID 2964 wrote to memory of 2592	2964	a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp	30

C:\Users\Admin\AppData\Local\Temp\a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe
"C:\Users\Admin\AppData\Local\Temp\a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\is-HIRAD.tmp\a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HIRAD.tmp\a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp" /SL5="$30144,2125319,56832,C:\Users\Admin\AppData\Local\Temp\a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2964
- - C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe
    "C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2696
- - C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe
    "C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2592

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe

Filesize
2.8MB

MD5
3b38f179f7d6e24b2f35517e88d0b00a

SHA1
da8cba1b98a3fcb4ef92ee965c759452245f5704

SHA256
73a1ad58e21cca91fe8d2c83a5b6523cfe51840deb63d263215d139a1285ab91

SHA512
845b8a1e0272d4796fba779cb26d18d9629ce574ff4ac9312e3a0cffc39763ab7a2837b171bd193a1371093dcaa24667827f10f29123e27762716c0c0bbb8e2e

Download Submit
C:\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe

Filesize
145KB

MD5
6401bfa06282cb4cfff4b0c3c5186616

SHA1
1b4c5a5d2f2175b38113e056b8470fd1d5817c84

SHA256
1ee4618f9d6e54c8711018106846313860636aad350edd38d894887fe65ad848

SHA512
cd1ca717b51ee918c3ed6d09361b16d1cbc3eb8106d03a1cbe6d97db500e7f8ca0f448f4e89c78df789e396d3c1f1ca58bcaf8bb8fdd2fb7d73b5de54b7f2560

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HIRAD.tmp\a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp

Filesize
448KB

MD5
1c52f38a47ea319c32130c515d30ed2d

SHA1
25a7f14923675a857858791f368ac63bdb087ea9

SHA256
30a37bf655c9765025603b47f21ce1e431ca74443618057cd416dad8e092557c

SHA512
51e46488231cf53c63380b7aef98043d31e1dada652edfcc9ca48500baed2aa73ce606002a2a1e20f0441566bd60eab8f2268683b4b636057629fa9de9114c88

Download Submit
\Users\Admin\AppData\Local\CD Shrink\cdshrink.exe

Filesize
2.9MB

MD5
38eb3f5c41db387858933dc109ea50b4

SHA1
f1fd7dfeab201f831f3dbbe4a603e9250765c53c

SHA256
adae10bfd766238543eb1016ae1d6840861a2013d823c64c75265c2d5b1ef62e

SHA512
e03c88fad04cadf903847e573014f943d0b234716ad64d25dfe214282f06a0944674ec12901b7ebd5b055d12dd0c91ee6c420816dfe8b18562119cd3a45e8900

Download Submit
\Users\Admin\AppData\Local\Temp\is-HIRAD.tmp\a09681c1f5230fc9ecc6c7e35716894f4fe7e59193b67bbdf8d2d7ed0c9f623a.tmp

Filesize
690KB

MD5
227526be87fbf4b4932a4f1ed146f82d

SHA1
8c5e96d4d6a517d1f94d14f2f13095022345ee8a

SHA256
7b157795b93dd287cbb24a23220ef262268430bfb657ecd3325c8e4c2d948953

SHA512
7d47234899e71db7cc3d2c516baaf820599654b22d82cb11eb3b5c199230021188406717405694c13c676a06e08eae865e81627108c8333c9ced94671d776fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-V1BDP.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-V1BDP.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2100-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2100-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2100-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2592-52-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-88-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-99-0x00000000026F0000-0x0000000002792000-memory.dmp

Filesize
648KB

Download
memory/2592-97-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-103-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-50-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-85-0x00000000026F0000-0x0000000002792000-memory.dmp

Filesize
648KB

Download
memory/2592-106-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-94-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-55-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-91-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-98-0x00000000026F0000-0x0000000002792000-memory.dmp

Filesize
648KB

Download
memory/2592-60-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-61-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-64-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-67-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-70-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-73-0x00000000026F0000-0x0000000002792000-memory.dmp

Filesize
648KB

Download
memory/2592-75-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-76-0x00000000026F0000-0x0000000002792000-memory.dmp

Filesize
648KB

Download
memory/2592-81-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2592-84-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2696-44-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2696-48-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2696-45-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2696-43-0x0000000000400000-0x00000000006E3000-memory.dmp

Filesize
2.9MB

Download
memory/2964-57-0x0000000003450000-0x0000000003733000-memory.dmp

Filesize
2.9MB

Download
memory/2964-56-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2964-54-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2964-42-0x0000000003450000-0x0000000003733000-memory.dmp

Filesize
2.9MB

Download
memory/2964-8-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing