socks5systemz | 3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be

General

Target

3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe
Size

2.5MB
MD5

6382b898cea4e8ea10bc0744d1120042
SHA1

cc423eec3e3355272e01d495d273162a4bb0918b
SHA256

3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be
SHA512

037f5a573d2ebcd8893e87c0a12e10d84d731165e97f6e3424d3fd916f62a27c2385e8b7d5dee27a54392cdc53f8c5327c26b70e187ff3f4a6ac76cfca989e8f
SSDEEP

49152:32SJR/pkj1DYGtOILUHZm6e5FKQf7ExHPHp1dnfNKYNr2pDl2sp2Pta7D0dP44ch:mSJRhWpY7EU5VezKs7ExHP/dnfz92N26

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://bfuvubx.com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a678bff10c6e79c

http://bfuvubx.com/search/?q=67e28dd8395dfb2f495fac1e7c27d78406abdd88be4b12eab517aa5c96bd86e995844c875a8bbc896c58e713bc90c91936b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c0ea959b3dc566

Signatures

Detect Socks5Systemz Payload 5 IoCs

resource	yara_rule
behavioral1/memory/2612-76-0x0000000002690000-0x0000000002734000-memory.dmp	family_socks5systemz
behavioral1/memory/2612-79-0x0000000002690000-0x0000000002734000-memory.dmp	family_socks5systemz
behavioral1/memory/2612-88-0x0000000002690000-0x0000000002734000-memory.dmp	family_socks5systemz
behavioral1/memory/2612-101-0x0000000002690000-0x0000000002734000-memory.dmp	family_socks5systemz
behavioral1/memory/2612-102-0x0000000002690000-0x0000000002734000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp
2988	freesitemapgenerator.exe
2612	freesitemapgenerator.exe

Loads dropped DLL 6 IoCs

pid	Process
2872	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe
2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp
2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp
2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp
2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp
2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2872 wrote to memory of 2916	2872	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe	28
PID 2872 wrote to memory of 2916	2872	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe	28
PID 2872 wrote to memory of 2916	2872	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe	28
PID 2872 wrote to memory of 2916	2872	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe	28
PID 2872 wrote to memory of 2916	2872	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe	28
PID 2872 wrote to memory of 2916	2872	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe	28
PID 2872 wrote to memory of 2916	2872	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe	28
PID 2916 wrote to memory of 2988	2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp	29
PID 2916 wrote to memory of 2988	2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp	29
PID 2916 wrote to memory of 2988	2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp	29
PID 2916 wrote to memory of 2988	2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp	29
PID 2916 wrote to memory of 2612	2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp	30
PID 2916 wrote to memory of 2612	2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp	30
PID 2916 wrote to memory of 2612	2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp	30
PID 2916 wrote to memory of 2612	2916	3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp	30

C:\Users\Admin\AppData\Local\Temp\3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe
"C:\Users\Admin\AppData\Local\Temp\3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2872
- C:\Users\Admin\AppData\Local\Temp\is-I661R.tmp\3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-I661R.tmp\3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp" /SL5="$40150,2257167,54272,C:\Users\Admin\AppData\Local\Temp\3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2916
- - C:\Users\Admin\AppData\Local\Free Sitemap Generator\freesitemapgenerator.exe
    "C:\Users\Admin\AppData\Local\Free Sitemap Generator\freesitemapgenerator.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2988
- - C:\Users\Admin\AppData\Local\Free Sitemap Generator\freesitemapgenerator.exe
    "C:\Users\Admin\AppData\Local\Free Sitemap Generator\freesitemapgenerator.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Free Sitemap Generator\freesitemapgenerator.exe

Filesize
1.8MB

MD5
918e022974314afae69459ba7128a15c

SHA1
31f227b0e528e2887f0230d3a6fc1bc4ed648061

SHA256
0b6371d8a18c407e07ffc0a510ad64ad0d9e75f89fb7b9f4fa1120efeb1f209b

SHA512
08acc4918a7ab7782c4625504f9dc19c66be76ca372f00fe930a0129b8b2a7959090049debda218148aa585f58b6abd3228eb938dd3b854d8c70fd8b843f1a81

Download Submit
\Users\Admin\AppData\Local\Free Sitemap Generator\freesitemapgenerator.exe

Filesize
2.6MB

MD5
e835939be1377715467b71610e13218e

SHA1
8a26f5ba1ee3daf58924a13d3f1a45dfe4df8a68

SHA256
5fd0d5c56b6e5a0967480e34e1f5d26a748c4d7664255b9eed6fd48b9b7418ec

SHA512
d91cc0a97d49c5b22ae83c24177941e3f3f59b73d99d144d99442557797a0d5e5f321a468ddd06dd0b15c0632361a2bdaafcfcc1d3ea12a9356a9956360c0373

Download Submit
\Users\Admin\AppData\Local\Temp\is-I661R.tmp\3313e3ace5b0f2a7dc0cc35f3d8350d1758877afa5e11ce8217cc002f88a00be.tmp

Filesize
677KB

MD5
33da9dc521f467c0405d3ef5377ce04b

SHA1
5249d7ce5dfabe5ee6d2fc7d3f3eba1e866b7d1f

SHA256
dbab8a7b2b45fc7001d5e34d3d45ccbe93a7591f12910281acf2c32f8c4e631c

SHA512
a3093637e1d731eab58080e10706db1afbf6e79fbac6593733b61033f97875ecbe230311e9741d349625ec3a66a6435318846d35290db8cd00af76d692699a55

Download Submit
\Users\Admin\AppData\Local\Temp\is-JJ327.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-JJ327.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-JJ327.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2612-79-0x0000000002690000-0x0000000002734000-memory.dmp

Filesize
656KB

Download
memory/2612-70-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-109-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-106-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-102-0x0000000002690000-0x0000000002734000-memory.dmp

Filesize
656KB

Download
memory/2612-101-0x0000000002690000-0x0000000002734000-memory.dmp

Filesize
656KB

Download
memory/2612-100-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-97-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-54-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-56-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-94-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-91-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-59-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-88-0x0000000002690000-0x0000000002734000-memory.dmp

Filesize
656KB

Download
memory/2612-63-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-64-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-67-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-87-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-73-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-76-0x0000000002690000-0x0000000002734000-memory.dmp

Filesize
656KB

Download
memory/2612-77-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2612-84-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2872-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2872-57-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2872-2-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2916-9-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2916-60-0x00000000002C0000-0x00000000002C1000-memory.dmp

Filesize
4KB

Download
memory/2916-58-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2916-46-0x0000000003490000-0x0000000003725000-memory.dmp

Filesize
2.6MB

Download
memory/2988-52-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2988-51-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2988-48-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download
memory/2988-47-0x0000000000400000-0x0000000000695000-memory.dmp

Filesize
2.6MB

Download

Analysis

Sharing