socks5systemz

General

Target
06666dd94140ff36f90471caba87d0e941ffdc6719d410957970d1bca943b9ca
Size 1.9MB
Sample240330-ynyf2adh85
SHA256 06666dd94140ff36f90471caba87d0e941ffdc6719d410957970d1bca943b9ca
MD5 2214dd1a0d3875c55361f9bfeb6ccc4f
SHA1 353da314fa9c77be99711dad884e026e43cf189f
SHA512 a698a9f29cfbbebe7c0e237e46b2849ae194bd45596a62ceeeece701e5d0aef24f37bb94f7532c0751a6ef473b8b458dca18ddecc06201df0e2a1035473361c7
SSDEEP 24576:3204UwUanHi+77CAwtueLcYyoyy5gr9HOjL7rJR1z9zU23s+OfRlc2guNIpTmnN3:32lU47CAwzf56NOjLZRp9Y28B9IpTxY
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

http://bgwneke.com/search/?q=67e28dd86f5af1211209a81b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffe19c2e7939c38
http://bgwneke.com/search/?q=67e28dd86f5af1211209a81b7c27d78406abdd88be4b12eab517aa5c96bd86ee9d8f4b875a8bbc896c58e713bc90c91d36b5281fc235a925ed3e53d6bd974a95129070b616e96cc92be510b866db52b2e34aec4c2b14a82966836f23d7f210c7ee949239c5699015
http://bmmceqg.com/search/?q=67e28dd83a0ba47b435ca84a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1ee8889b5e4fa9281ae978a071ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffe19c2e7939d38

Targets

- Target
  06666dd94140ff36f90471caba87d0e941ffdc6719d410957970d1bca943b9ca
- Size 1.9MB
- SHA256 06666dd94140ff36f90471caba87d0e941ffdc6719d410957970d1bca943b9ca
- MD5 2214dd1a0d3875c55361f9bfeb6ccc4f
- SHA1 353da314fa9c77be99711dad884e026e43cf189f
- SHA512 a698a9f29cfbbebe7c0e237e46b2849ae194bd45596a62ceeeece701e5d0aef24f37bb94f7532c0751a6ef473b8b458dca18ddecc06201df0e2a1035473361c7
- SSDEEP 24576:3204UwUanHi+77CAwtueLcYyoyy5gr9HOjL7rJR1z9zU23s+OfRlc2guNIpTmnN3:32lU47CAwzf56NOjLZRp9Y28B9IpTxY
- MD5 SHA1 SHA512 SSDEEP
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2