socks5systemz | 6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
05/04/2024, 01:22

Target

6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6.dll
Size

648KB
MD5

9f272c4667d2d9cb7e79097bc248c88f
SHA1

3f26a7b54cd6a137ac8a7edfd4776756d2c59c15
SHA256

6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6
SHA512

3cd5a772b11c452000eb9c548fd863dd0358dce6440c4cb28b39039bacc60a7962eda4fab0c79d1c52031c1e756d0eeea12e4fdb5d7740999628852f45ee3b44
SSDEEP

12288:HjsgiZdvAeRwV+a4HZ50cCBPBqkPcvpWwF9mxRKLiTOkkRp6HmmkLiIjcBDQg5EC:DsgwdvA8r550cCBPBqkkvpfF9mxR+iTn

Score

10^/10

Detect Socks5Systemz Payload 2 IoCs

resource	yara_rule
behavioral1/memory/2492-0-0x0000000074DF0000-0x0000000074E92000-memory.dmp	family_socks5systemz
behavioral1/memory/2492-1-0x0000000074D40000-0x0000000074DE2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 2492	2068	rundll32.exe	28
PID 2068 wrote to memory of 2492	2068	rundll32.exe	28
PID 2068 wrote to memory of 2492	2068	rundll32.exe	28
PID 2068 wrote to memory of 2492	2068	rundll32.exe	28
PID 2068 wrote to memory of 2492	2068	rundll32.exe	28
PID 2068 wrote to memory of 2492	2068	rundll32.exe	28
PID 2068 wrote to memory of 2492	2068	rundll32.exe	28

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\6895060efb59dfdd836fea080df3fe04dd99e178308543a4916fe549bde602a6.dll,#1
  2⤵
  PID:2492

memory/2492-0-0x0000000074DF0000-0x0000000074E92000-memory.dmp

Filesize
648KB

Download
memory/2492-1-0x0000000074D40000-0x0000000074DE2000-memory.dmp

Filesize
648KB

Download
memory/2492-2-0x0000000074D40000-0x0000000074DE2000-memory.dmp

Filesize
648KB

Download