socks5systemz | 74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db

General

Target

74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.exe
Size

2.2MB
MD5

2daa9c3029ff97afd2ed0874b7eecafe
SHA1

9c42451acc7ab59edfaa1f6e0267f85476091b17
SHA256

74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db
SHA512

40374dbf865dbbd12c9ffd162954fa958ac2df2977a4a45318e5872db96170c56c69f89632660a6aacf1fb3523011fcc7a2500ff22fa31634bb4f28a6e634afc
SSDEEP

49152:32oFzM2BqJ6Yarfqy4mZ0bmZ/cpFMu7a9qHwNhanH0:mkrQJ6Fyih86hCH0

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://difuols.info/search/?q=67e28dd83d54f12b140cff197c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a271ea771795af8e05c64bdb22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffe14c1ee9c9e38

http://difuols.info/search/?q=67e28dd83d54f12b140cff197c27d78406abdd88be4b12eab517aa5c96bd86ef95834a845a8bbc896c58e713bc90c91836b5281fc235a925ed3e01d6bd974a95129070b618e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee949f3acc669215

Signatures

Detect Socks5Systemz Payload 5 IoCs

resource	yara_rule
behavioral2/memory/3216-69-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz
behavioral2/memory/3216-70-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz
behavioral2/memory/3216-80-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz
behavioral2/memory/3216-93-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz
behavioral2/memory/3216-94-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1064	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp
2880	perlee.exe
3216	perlee.exe

Loads dropped DLL 1 IoCs

pid	Process
1064	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 652 wrote to memory of 1064	652	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.exe	79
PID 652 wrote to memory of 1064	652	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.exe	79
PID 652 wrote to memory of 1064	652	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.exe	79
PID 1064 wrote to memory of 2880	1064	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp	81
PID 1064 wrote to memory of 2880	1064	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp	81
PID 1064 wrote to memory of 2880	1064	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp	81
PID 1064 wrote to memory of 3216	1064	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp	82
PID 1064 wrote to memory of 3216	1064	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp	82
PID 1064 wrote to memory of 3216	1064	74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp	82

C:\Users\Admin\AppData\Local\Temp\74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.exe
"C:\Users\Admin\AppData\Local\Temp\74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:652
- C:\Users\Admin\AppData\Local\Temp\is-9VQAD.tmp\74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-9VQAD.tmp\74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp" /SL5="$50236,1962237,54272,C:\Users\Admin\AppData\Local\Temp\74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Users\Admin\AppData\Local\Perl Express Edition\perlee.exe
    "C:\Users\Admin\AppData\Local\Perl Express Edition\perlee.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2880
- - C:\Users\Admin\AppData\Local\Perl Express Edition\perlee.exe
    "C:\Users\Admin\AppData\Local\Perl Express Edition\perlee.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Perl Express Edition\perlee.exe

Filesize
2.2MB

MD5
55455fe5f7d41e6267e0ccc8ea3edf4b

SHA1
8de6a9cf4470fc9e1e77fdf5882aea8c0f75fc53

SHA256
4096deeed53fdf1c072850df100258e06458b37327bd9900c140fa27d491f5ea

SHA512
42da3813d63e1cdea3648159f775b21ebdc57e44c574bf9b369fcb963407ad71c1ca746925dfd7063c395762e8a36d4b47899a3249d89f9a369debd033306441

Download Submit
C:\Users\Admin\AppData\Local\Perl Express Edition\perlee.exe

Filesize
1.2MB

MD5
69a1a1a519b0931f09568975c1637588

SHA1
2bd06558f32ed858c09789a257ecd6ad60deabc4

SHA256
908a0bb80070b264f28d988fe575c5fa7c26f19d42a239fd5ce86b1913054ed9

SHA512
478d37149d22a42142c66e4e3f535080345c3f62d5576ed17384ef8f92b77c91ecdfeedc836790be35ee88f26d38e9ab2384dff0e4fc6477e1671d62a75cbef3

Download Submit
C:\Users\Admin\AppData\Local\Perl Express Edition\perlee.exe

Filesize
832KB

MD5
20daaa161d95409335656bc8c8ede80d

SHA1
d042e3e5e1c9b4330ed68f8137402e68f62a4074

SHA256
bf2ade6ab57a8461585a4f75151480bcc8218ae43803446d7b21434166166e01

SHA512
e42418fcacd0c043a5e21e4b6f05246ffbd303c1eb82d9034b611c323e781037eb1a506fe7c599c6de7690df6d799398c5cb667f1890e93e87fb0a61151c6efa

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9VQAD.tmp\74b7a7e6610586264fade394198ae0d7cd40fe0b6b65222693bbc12a2fd478db.tmp

Filesize
677KB

MD5
1f28afdd4bbe4d539d059abfa1415f9a

SHA1
a76a4a9e85ce32b156167a86d8251bbdd509c0fb

SHA256
3b4b52ed7f6606ef374450e40432790f0f8c80fa769e763b51f3c9307c41350a

SHA512
883cc8296bad677fa48afa931573c9f46d99195299f47a511c940d584a86aed8ec4c2609c1ad0706ec409116c0bd1ba211acc182b24c9e165f589917b45fc1a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TIVFD.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/652-16-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/652-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1064-6-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/1064-17-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1064-49-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1064-45-0x00000000007A0000-0x00000000007A1000-memory.dmp

Filesize
4KB

Download
memory/2880-40-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/2880-39-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/2880-43-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-55-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-70-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/3216-48-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-56-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-59-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-62-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-64-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-66-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-69-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/3216-51-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-74-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-79-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-80-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/3216-83-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-85-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-87-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-92-0x0000000000400000-0x00000000006B8000-memory.dmp

Filesize
2.7MB

Download
memory/3216-93-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/3216-94-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing