socks5systemz | 63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2024, 21:44

Target
file.dll
Size 623KB
Sample240401-1lf53sga3t
SHA256 63c666636e07e95e5e56ccb4e92db6dc350986bc4fcb401975dbae538aa73d15
MD5 8e3161bdec7310b024db91255398f39e
SHA1 12c65adfa60de424dbf2aa0a1cc6fba9b25063bd
SHA512 b70946035c50674ebf1503c1f8de95952f1e9c7d7fcce6e85ef43195fb4f65e9347fae4ee3a05d30af99e4b68254852056ff2c7aa12123f70b3ff6cf48b78e40
SSDEEP 12288:2jsgiZdvAeRw3+aXHv50cCleBqq2cvpzwnAmvRKLiTOkkRpZHD0kmiIjcBDfg5En:ksgwdvAOMP50cCleBqqzvp0nAmvR+iTs
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/740-0-0x0000000074B30000-0x0000000074BD2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 740	1176	rundll32.exe	85
PID 1176 wrote to memory of 740	1176	rundll32.exe	85
PID 1176 wrote to memory of 740	1176	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\file.dll,#1
  2⤵
  PID:740

memory/740-0-0x0000000074B30000-0x0000000074BD2000-memory.dmp

Download