socks5systemz | 6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5

General

Target

7272273eb523020414a5a02f91a3922a.exe
Size

3.9MB
MD5

7272273eb523020414a5a02f91a3922a
SHA1

3bdf99591a1949cad49f3649590430c927110b86
SHA256

6bd2bcb51574eb7e2e18a9a784113c48543f20a1758275a2d141ddc0d22dedc5
SHA512

43b4a0497f89eda59c8e24e552c9af33f2bc84ead0f52027130664eafa9c448b896198cdecf1b8edd127a0184bae9e26e4550d20bd8443304404949c5975f77a
SSDEEP

98304:7ank3YFLhyADS1cWwcD1qTNOdZXfGbfdjCaN09iyJp:B3YFEZcvIvubdjCd

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://ebuubtb.ua/search/?q=67e28dd8655bfa7a130da94c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978f371ea771795af8e05c644db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a648bff16c8ee96

Signatures

Detect Socks5Systemz Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2976-86-0x00000000024B0000-0x0000000002552000-memory.dmp	family_socks5systemz
behavioral1/memory/2976-96-0x00000000024B0000-0x0000000002552000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

is-8IA7E.tmpsimplefreewaveeditor.exesimplefreewaveeditor.exe

pid process

1580 is-8IA7E.tmp
2548 simplefreewaveeditor.exe
2976 simplefreewaveeditor.exe

pid	process
1580	is-8IA7E.tmp
2548	simplefreewaveeditor.exe
2976	simplefreewaveeditor.exe

Loads dropped DLL 10 IoCs

Processes:

7272273eb523020414a5a02f91a3922a.exeis-8IA7E.tmpsimplefreewaveeditor.exesimplefreewaveeditor.exe

pid	process
1068	7272273eb523020414a5a02f91a3922a.exe
1580	is-8IA7E.tmp
1580	is-8IA7E.tmp
1580	is-8IA7E.tmp
1580	is-8IA7E.tmp
2548	simplefreewaveeditor.exe
2548	simplefreewaveeditor.exe
1580	is-8IA7E.tmp
2976	simplefreewaveeditor.exe
2976	simplefreewaveeditor.exe

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 152.89.198.214
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc
Destination IP	152.89.198.214

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

7272273eb523020414a5a02f91a3922a.exeis-8IA7E.tmp

description	pid	process	target process
PID 1068 wrote to memory of 1580	1068	7272273eb523020414a5a02f91a3922a.exe	is-8IA7E.tmp
PID 1068 wrote to memory of 1580	1068	7272273eb523020414a5a02f91a3922a.exe	is-8IA7E.tmp
PID 1068 wrote to memory of 1580	1068	7272273eb523020414a5a02f91a3922a.exe	is-8IA7E.tmp
PID 1068 wrote to memory of 1580	1068	7272273eb523020414a5a02f91a3922a.exe	is-8IA7E.tmp
PID 1068 wrote to memory of 1580	1068	7272273eb523020414a5a02f91a3922a.exe	is-8IA7E.tmp
PID 1068 wrote to memory of 1580	1068	7272273eb523020414a5a02f91a3922a.exe	is-8IA7E.tmp
PID 1068 wrote to memory of 1580	1068	7272273eb523020414a5a02f91a3922a.exe	is-8IA7E.tmp
PID 1580 wrote to memory of 2548	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2548	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2548	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2548	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2548	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2548	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2548	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2976	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2976	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2976	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2976	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2976	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2976	1580	is-8IA7E.tmp	simplefreewaveeditor.exe
PID 1580 wrote to memory of 2976	1580	is-8IA7E.tmp	simplefreewaveeditor.exe

C:\Users\Admin\AppData\Local\Temp\7272273eb523020414a5a02f91a3922a.exe
"C:\Users\Admin\AppData\Local\Temp\7272273eb523020414a5a02f91a3922a.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1068

C:\Users\Admin\AppData\Local\Temp\is-GB3OT.tmp\is-8IA7E.tmp
"C:\Users\Admin\AppData\Local\Temp\is-GB3OT.tmp\is-8IA7E.tmp" /SL4 $5015E "C:\Users\Admin\AppData\Local\Temp\7272273eb523020414a5a02f91a3922a.exe" 3709989 52224
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1580

C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe
"C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe" -i
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2548

C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe
"C:\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe" -s
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2976

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Simple Free Wave Editor\simplefreewaveeditor.exe
Filesize
4.0MB

MD5
56b8f72726a17787936c8428d1e203b7

SHA1
01ab24f02a3573cdf5473a3d3d274fab564c9333

SHA256
5598295bb89377b3a1ad39c0c33363c1ee5b59abe7c358d250c76be6b115b9ba

SHA512
18c8cdc1ccfc485043edf2a8bc99c1b742f02b557dfdc394d797cf3aad166ac9d5923685df91f6a559c751f282e489d5e7e55d645323f405725d490f6c9bbe8a

Download Submit
\Users\Admin\AppData\Local\Temp\is-GB3OT.tmp\is-8IA7E.tmp
Filesize
648KB

MD5
6b2d50f7b74945a2d03a39b16e1eb7be

SHA1
f3ff5ddcff5616327ae545e695f9b89941036919

SHA256
cdc40754b9af9a02ed5d9647c00d2cd7324ddd9b0ef0a64e3379c0a17e705039

SHA512
7f2548ab8c6af80d966e1855f1d9efb6aa876747c01b0478016cc9f47fbd8aebbc1a786bbb3c7160e532bebeeceac9ee4e5b359cbe7c203a2d9d62dcd0180f02

Download Submit
\Users\Admin\AppData\Local\Temp\is-NV0AS.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-NV0AS.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/1068-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1068-60-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1068-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1580-63-0x0000000003610000-0x0000000003A14000-memory.dmp

Filesize
4.0MB

Download
memory/1580-40-0x0000000003610000-0x0000000003A14000-memory.dmp

Filesize
4.0MB

Download
memory/1580-61-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2548-46-0x0000000000D50000-0x0000000001154000-memory.dmp

Filesize
4.0MB

Download
memory/2548-49-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2548-51-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2548-48-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2548-47-0x0000000000D50000-0x0000000001154000-memory.dmp

Filesize
4.0MB

Download
memory/2548-43-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-62-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-78-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-57-0x0000000000D20000-0x0000000001124000-memory.dmp

Filesize
4.0MB

Download
memory/2976-56-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-66-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-67-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-69-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-70-0x0000000000D20000-0x0000000001124000-memory.dmp

Filesize
4.0MB

Download
memory/2976-72-0x0000000000D20000-0x0000000001124000-memory.dmp

Filesize
4.0MB

Download
memory/2976-73-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-75-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-58-0x0000000000D20000-0x0000000001124000-memory.dmp

Filesize
4.0MB

Download
memory/2976-80-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-85-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-86-0x00000000024B0000-0x0000000002552000-memory.dmp

Filesize
648KB

Download
memory/2976-90-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-94-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-96-0x00000000024B0000-0x0000000002552000-memory.dmp

Filesize
648KB

Download
memory/2976-98-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-101-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-103-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-107-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download
memory/2976-111-0x0000000000400000-0x0000000000804000-memory.dmp

Filesize
4.0MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads