socks5systemz | c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b

General

Target

c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.exe
Size

2.0MB
MD5

cc2436628125a7a1ec85f26467de79ef
SHA1

d49c3f7993f957a5f5bdc6ca8b398660e4e5961f
SHA256

c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b
SHA512

ce8229f466b801c37b7760e8cffdc768133e376a72384757ef5a7682ff0d5e4065a276436ef206d2b8aba629b2ad31621c3450800372cf15de204359cb49524a
SSDEEP

49152:32ABQaqBz4mnA3PvTTB02+KbCt+h7/KxbLJbwml:moOzFA/b1bQyb+byml

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://ejuyzgz.ua/search/?q=67e28dd83e0ff228160df91f7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ce8889b5e4fa9281ae978f571ea771795af8e05c64bdb22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608fff19c7eb979332

Signatures

Detect Socks5Systemz Payload 2 IoCs

resource	yara_rule
behavioral2/memory/2040-66-0x0000000000990000-0x0000000000A32000-memory.dmp	family_socks5systemz
behavioral2/memory/2040-76-0x0000000000990000-0x0000000000A32000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1824	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp
1356	rcpcpruler.exe
2040	rcpcpruler.exe

Loads dropped DLL 1 IoCs

pid	Process
1824	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 580 wrote to memory of 1824	580	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.exe	80
PID 580 wrote to memory of 1824	580	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.exe	80
PID 580 wrote to memory of 1824	580	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.exe	80
PID 1824 wrote to memory of 1356	1824	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp	82
PID 1824 wrote to memory of 1356	1824	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp	82
PID 1824 wrote to memory of 1356	1824	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp	82
PID 1824 wrote to memory of 2040	1824	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp	83
PID 1824 wrote to memory of 2040	1824	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp	83
PID 1824 wrote to memory of 2040	1824	c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp	83

C:\Users\Admin\AppData\Local\Temp\c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.exe
"C:\Users\Admin\AppData\Local\Temp\c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Users\Admin\AppData\Local\Temp\is-HBOVG.tmp\c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HBOVG.tmp\c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp" /SL5="$7010A,1712194,54272,C:\Users\Admin\AppData\Local\Temp\c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Users\Admin\AppData\Local\RCP SPRuler\rcpcpruler.exe
    "C:\Users\Admin\AppData\Local\RCP SPRuler\rcpcpruler.exe" -i
    3⤵
    - Executes dropped EXE
    PID:1356
- - C:\Users\Admin\AppData\Local\RCP SPRuler\rcpcpruler.exe
    "C:\Users\Admin\AppData\Local\RCP SPRuler\rcpcpruler.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\RCP SPRuler\rcpcpruler.exe

Filesize
1.5MB

MD5
d91714318223d23b7df04e09736fa131

SHA1
3fdbacb1eb4b18e87bb93301129748990ce1b7d1

SHA256
eade6d4d1df90ca4991bca4fa671d3f49690a86fc0d465a0de79ed6717044bcb

SHA512
fdc23af37956ec6d619e1b450291d007e14c9bb8a34ef289b3b2c4dd57c459bb3d9328ce2021b134d00da733f7f02a7ddbc0931b375e4bb830b34d6070601063

Download Submit
C:\Users\Admin\AppData\Local\RCP SPRuler\rcpcpruler.exe

Filesize
1.5MB

MD5
ba803379be92c29101b0b34932889534

SHA1
e95e4bf144d9e3462883a7621e58f22895e4e6fe

SHA256
8685430d8219d1546b7d51c9e88af13e1c9f284e86909064c94b7d9852554851

SHA512
1121d35da9670d00ce2b61c694a3e196665a6170bf19c8770ee418a73c0164749c4aad6eb3d0e3601cc8e6fbf93ff44454406fae902161405503838955744805

Download Submit
C:\Users\Admin\AppData\Local\RCP SPRuler\rcpcpruler.exe

Filesize
766KB

MD5
857915ebfda3d56b3389ca5191683c58

SHA1
61cc20dacf561b3de5a6f76eb89d0a64e8a779f3

SHA256
3ab32dee717dc25d6c9ab6896824d51d721f478dd1a6829aebde26c7caa3c289

SHA512
0c2031c4cabe5b2e8024bfb7918e4a3c2d8ead68d456f439b90850a8528a7bc2e51358b162a9f28b4bbe1dd7b5ab29131b9ebd84a76d57f773dc925f83959f29

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-85TL9.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HBOVG.tmp\c1e8fc39a2299bd8bfc8a0d756cfce0aead95a280acfcfb7505378ee2e8b7f3b.tmp

Filesize
677KB

MD5
f8e1d9f78e12f926961ff9dad1b68cde

SHA1
1fed3aefc1be086d8705c6927c28a1810c98b335

SHA256
fdb33e2812de516fb0ca01304a20d15c1d41e45a82fd0cc70b6b5d816a1f678c

SHA512
33dccb7a47aec149a09baa864dee513d9e3dda0fe500a42fabe46cf8bd74c882dff875a6bd88c2d8a8147285e68621c6bfc31b9b5f6e1c1f859612a80fc79df5

Download Submit
memory/580-46-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/580-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1356-38-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/1356-42-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/1356-40-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/1356-37-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/1824-49-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1824-6-0x0000000000690000-0x0000000000691000-memory.dmp

Filesize
4KB

Download
memory/1824-47-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2040-52-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-72-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-45-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-53-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-56-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-59-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-62-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-65-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-66-0x0000000000990000-0x0000000000A32000-memory.dmp

Filesize
648KB

Download
memory/2040-48-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-75-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-76-0x0000000000990000-0x0000000000A32000-memory.dmp

Filesize
648KB

Download
memory/2040-79-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-82-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-85-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-88-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-92-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download
memory/2040-95-0x0000000000400000-0x00000000005F1000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing