socks5systemz | bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4

General

Target

bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe
Size

1.9MB
MD5

609e4cc900279674a71b4c70e42b5cf4
SHA1

7c2ba9b3c0f8da0551d83a43f1c742ad00156d3c
SHA256

bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4
SHA512

a21dcce16545a907abe0cad4833148c85f21c44d787ce6d9a46074add691235aa82a4fcf3a455949cf0e8537dfdd5abf58fc9d7c16117af9ba7ee4d4b51e48d2
SSDEEP

49152:C9svreit7n2myw9Hn4knjqZqAr85YE1IUufLyO2:Ms60n2w4kjUqArqV1IUu4

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://bdcdxhu.com/search/?q=67e28dd83958f721120bac1a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4fe8889b5e4fa9281ae978f471ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a678efc10c7ef9c

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral1/memory/2376-73-0x0000000002540000-0x00000000025E3000-memory.dmp	family_socks5systemz
behavioral1/memory/2376-74-0x0000000002540000-0x00000000025E3000-memory.dmp	family_socks5systemz
behavioral1/memory/2376-86-0x0000000002540000-0x00000000025E3000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Detects executables packed with VMProtect. 19 IoCs

resource	yara_rule
behavioral1/memory/2664-43-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2664-44-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2664-47-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-51-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-54-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-59-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-62-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-63-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-66-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-69-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-72-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-80-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-83-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-87-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-90-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-93-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-96-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-100-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect
behavioral1/memory/2376-103-0x0000000000400000-0x00000000005BA000-memory.dmp	INDICATOR_EXE_Packed_VMProtect

Executes dropped EXE 3 IoCs

pid	Process
2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp
2664	magicmailmonitor.exe
2376	magicmailmonitor.exe

Loads dropped DLL 5 IoCs

pid	Process
2968	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe
2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp
2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp
2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp
2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp
2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2224	2968	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe	27
PID 2968 wrote to memory of 2224	2968	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe	27
PID 2968 wrote to memory of 2224	2968	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe	27
PID 2968 wrote to memory of 2224	2968	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe	27
PID 2968 wrote to memory of 2224	2968	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe	27
PID 2968 wrote to memory of 2224	2968	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe	27
PID 2968 wrote to memory of 2224	2968	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe	27
PID 2224 wrote to memory of 2664	2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp	28
PID 2224 wrote to memory of 2664	2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp	28
PID 2224 wrote to memory of 2664	2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp	28
PID 2224 wrote to memory of 2664	2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp	28
PID 2224 wrote to memory of 2376	2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp	29
PID 2224 wrote to memory of 2376	2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp	29
PID 2224 wrote to memory of 2376	2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp	29
PID 2224 wrote to memory of 2376	2224	bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp	29

C:\Users\Admin\AppData\Local\Temp\bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe
"C:\Users\Admin\AppData\Local\Temp\bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2968
- C:\Users\Admin\AppData\Local\Temp\is-HMAFD.tmp\bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HMAFD.tmp\bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp" /SL5="$4017E,1582238,56832,C:\Users\Admin\AppData\Local\Temp\bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Users\Admin\AppData\Local\Magic Mail Monitor\magicmailmonitor.exe
    "C:\Users\Admin\AppData\Local\Magic Mail Monitor\magicmailmonitor.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2664
- - C:\Users\Admin\AppData\Local\Magic Mail Monitor\magicmailmonitor.exe
    "C:\Users\Admin\AppData\Local\Magic Mail Monitor\magicmailmonitor.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Magic Mail Monitor\magicmailmonitor.exe

Filesize
256KB

MD5
0f81e13868eaf1c00998a9d3dfa917a2

SHA1
090b83e541a26b4ff135d00c645b612e16c6837c

SHA256
cac0370e315c2c9974bd95651c50753196eb6220220313d6df4aa199294508ea

SHA512
5a1e22b8701c783945b02e2e6b74468b1ca5e1298de31106e0c05989fd3205bc0ad38b72265768d2c6dd2402463646966349cbf2cab2988f72504662e3a6e1b3

Download Submit
C:\Users\Admin\AppData\Local\Magic Mail Monitor\magicmailmonitor.exe

Filesize
1.7MB

MD5
6a423cea737aa173f81c6972dca0eb11

SHA1
5da3bcd752029faa62a9eeeffc932be0841a9b85

SHA256
6cf4cb5f6c6d3ebacdb9f23ee2f84c6bfe2dcb7a272ac8beba0b319f29749e58

SHA512
f7de88e90029542f063dcfd9a0f2749226b72f05d33407176eb445ba62dcb73feb9b3e6a3613c2dc33d51134fd006adc56d90cc1cbdb4c7e8f32995ae33bca17

Download Submit
\Users\Admin\AppData\Local\Magic Mail Monitor\magicmailmonitor.exe

Filesize
896KB

MD5
84430c9c177b4d68df6f878e67cd3596

SHA1
4129a894bf950b3e1eb02b04a242e1efe5121e20

SHA256
af7288819eb306d7a9ef9dc05e5073b5e50fca9bfa0315e99fc78390bf372d23

SHA512
f952e5a762c53166052b6c3eb9752479052cf64213d3d0329c40d93cf791318feb74a1c996f91740d5568d43e7359754d349685bad5b014862c4a98385c38e30

Download Submit
\Users\Admin\AppData\Local\Temp\is-CRR68.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-CRR68.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-HMAFD.tmp\bdd5121ed4410781a6a3e2a6b1ed5a6804ee92a748ba9425b2e893c5a32da6f4.tmp

Filesize
690KB

MD5
3db3bf78ce9be21334ce22837170c5e3

SHA1
393963f52ab58b689c6348ddf8efef1338bf610c

SHA256
f1622c028f276c4ae4053c2266337224787b50a889a2d498f9dbafe37458fce4

SHA512
dcbf5611a35130a20c98f602a187f763b377ee1af10794e1b3597acbe96eb86ee4e74028e5d18a67f4a8bfb6daa0f531f7b7d8cff10a0361d4fca91349863af3

Download Submit
memory/2224-7-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2224-40-0x0000000003250000-0x000000000340A000-memory.dmp

Filesize
1.7MB

Download
memory/2224-56-0x0000000003250000-0x000000000340A000-memory.dmp

Filesize
1.7MB

Download
memory/2224-55-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2224-53-0x0000000000400000-0x00000000004BC000-memory.dmp

Filesize
752KB

Download
memory/2376-74-0x0000000002540000-0x00000000025E3000-memory.dmp

Filesize
652KB

Download
memory/2376-86-0x0000000002540000-0x00000000025E3000-memory.dmp

Filesize
652KB

Download
memory/2376-49-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-51-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-103-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-100-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-54-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-96-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-93-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-59-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-62-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-63-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-66-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-69-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-72-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-73-0x0000000002540000-0x00000000025E3000-memory.dmp

Filesize
652KB

Download
memory/2376-90-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-80-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-83-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2376-87-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2664-47-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2664-42-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2664-43-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2664-44-0x0000000000400000-0x00000000005BA000-memory.dmp

Filesize
1.7MB

Download
memory/2968-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2968-52-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing