socks5systemz | 7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8

General

Target

7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe
Size

2.0MB
MD5

05b18baf8da6c2a30c6cf13971da9c7e
SHA1

1509d5f8523d02612352e7ef7dbd8d89bac967e2
SHA256

7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8
SHA512

3c870e237a84d93d30e4c9523f710f516edc18e0df4cbd9d70e9bc5552b5acd734108e8a6b4d37709ef230926a109345b55eb1644bc173fd9c5d3680ca2b9e1f
SSDEEP

49152:C9VQbo5Z5aRg/7bXL64sc9E3YH96vWPYQ26hiE:MVxRB/7bWzYGWPYit

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://boqdvhd.com/search/?q=67e28dd83955a42b4006aa1b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ee8889b5e4fa9281ae978f671ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923b6e89f716c4e79c

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2760-72-0x0000000002530000-0x00000000025D3000-memory.dmp	family_socks5systemz
behavioral1/memory/2760-75-0x0000000002530000-0x00000000025D3000-memory.dmp	family_socks5systemz
behavioral1/memory/2760-84-0x0000000002530000-0x00000000025D3000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp
2684	antispamsniper.exe
2760	antispamsniper.exe

Loads dropped DLL 5 IoCs

pid	Process
2240	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe
1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp
1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp
1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp
1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp
1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1204	2240	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe	28
PID 2240 wrote to memory of 1204	2240	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe	28
PID 2240 wrote to memory of 1204	2240	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe	28
PID 2240 wrote to memory of 1204	2240	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe	28
PID 2240 wrote to memory of 1204	2240	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe	28
PID 2240 wrote to memory of 1204	2240	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe	28
PID 2240 wrote to memory of 1204	2240	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe	28
PID 1204 wrote to memory of 2684	1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp	29
PID 1204 wrote to memory of 2684	1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp	29
PID 1204 wrote to memory of 2684	1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp	29
PID 1204 wrote to memory of 2684	1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp	29
PID 1204 wrote to memory of 2760	1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp	30
PID 1204 wrote to memory of 2760	1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp	30
PID 1204 wrote to memory of 2760	1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp	30
PID 1204 wrote to memory of 2760	1204	7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp	30

C:\Users\Admin\AppData\Local\Temp\7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe
"C:\Users\Admin\AppData\Local\Temp\7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Users\Admin\AppData\Local\Temp\is-HQ9QD.tmp\7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HQ9QD.tmp\7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp" /SL5="$40112,1703944,56832,C:\Users\Admin\AppData\Local\Temp\7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1204
- - C:\Users\Admin\AppData\Local\Anti Spam Sniper\antispamsniper.exe
    "C:\Users\Admin\AppData\Local\Anti Spam Sniper\antispamsniper.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2684
- - C:\Users\Admin\AppData\Local\Anti Spam Sniper\antispamsniper.exe
    "C:\Users\Admin\AppData\Local\Anti Spam Sniper\antispamsniper.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Anti Spam Sniper\antispamsniper.exe

Filesize
1.0MB

MD5
5e1b6880a3da05485f8681dec2199263

SHA1
99100e5bcbfc5558b90cf12b70cd41fc2b8f8a3d

SHA256
8568419db68efc655ab326522c4c1bbd2a43107164cdec9cd1d3ce70271a5bf7

SHA512
b98305f033aaab51e3d15775f61996e347f226d0b09768f8fe7cd34c31c2fc466ae00c812ac3d4497f213dfd4782e519511003bf8f056b13fb58091850ea70e7

Download Submit
\Users\Admin\AppData\Local\Anti Spam Sniper\antispamsniper.exe

Filesize
1.8MB

MD5
ec905295a4c5392d6e2664ea249cd102

SHA1
18705210bb76caf5cf9af8471a17dfb2b57ad2a7

SHA256
faa85e8b2acea74fe36e4bdfb17f98e1264fa92d781f1586760f2db10d171157

SHA512
c372293e43f18e516b3604b538098db73b59563e582d3f6bbd00579c8ed809bc85a4909f33c269b2af87b8541aa6a8196f7aa34a5b590696cae129799d8f693c

Download Submit
\Users\Admin\AppData\Local\Temp\is-F6LPO.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-F6LPO.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-HQ9QD.tmp\7f3bc6a9a10256c117c17f6c6b7cc89de9eb6db5ef5fd9062c0b6f2d56b5fef8.tmp

Filesize
690KB

MD5
3cdcd85f0416c07b271dee9ce7432c10

SHA1
e454875b4628260cc56999a37ed1534d30fec5d9

SHA256
b603b51c603928b8ec22cd2b60447d46683442a377ac7327278376523e99f1c4

SHA512
ee5ef475d9da7ca937002d95efebe64d859a593342ee2452bc5b1291e1d8e29a19e0c9d38d12605fb0367e94df434f825561abfd69350e8d3f42519c76d38913

Download Submit
memory/1204-8-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/1204-42-0x0000000003500000-0x00000000036D8000-memory.dmp

Filesize
1.8MB

Download
memory/1204-54-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/1204-56-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/2240-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2240-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2240-53-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2684-43-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2684-48-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2684-45-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2684-44-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-60-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-84-0x0000000002530000-0x00000000025D3000-memory.dmp

Filesize
652KB

Download
memory/2760-52-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-59-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-50-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-63-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-66-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-69-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-72-0x0000000002530000-0x00000000025D3000-memory.dmp

Filesize
652KB

Download
memory/2760-74-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-75-0x0000000002530000-0x00000000025D3000-memory.dmp

Filesize
652KB

Download
memory/2760-80-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-83-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-55-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-87-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-90-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-93-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-96-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-100-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-103-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-106-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-109-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-112-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-115-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download
memory/2760-120-0x0000000000400000-0x00000000005D8000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing