socks5systemz | de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 19:07

Target

de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll
Size

648KB
MD5

773ee7c6340a3b637f1d469c10753895
SHA1

640999f3973a354e6bd99ce13ce5936802644679
SHA256

de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3
SHA512

f61864c918448b3b275e8df8e536bff16501283400377bd0850c327cd3b3d872ea48349f34381d5f7e1eb6661a7b83a4e8b04dd84c180726a0230776139018a6
SSDEEP

12288:HjsgiZdvAeRwz+agHL50cCJeBqWycvpWwXkmvRKLiTOksRpFHDIkGiIjcBDQg5Ey:DsgwdvAKrr50cCJeBqW/vpfXkmvR+iT4

Score

10^/10

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4680-0-0x0000000074CD0000-0x0000000074D72000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Program crash 2 IoCs

pid	pid_target	Process	procid_target
2500	4680	WerFault.exe	85
5088	4680	WerFault.exe	85

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4680	4952	rundll32.exe	85
PID 4952 wrote to memory of 4680	4952	rundll32.exe	85
PID 4952 wrote to memory of 4680	4952	rundll32.exe	85

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\de40fe5b591e715a225f4391a2dcc608ed63fd474f59a53ff2355c6d3ce7a7f3.dll,#1
  2⤵
  PID:4680
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 604
    3⤵
    - Program crash
    PID:2500
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4680 -s 612
    3⤵
    - Program crash
    PID:5088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4680 -ip 4680
1⤵
PID:4692

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 4680 -ip 4680
1⤵
PID:3420

memory/4680-0-0x0000000074CD0000-0x0000000074D72000-memory.dmp

Filesize
648KB

Download