socks5systemz | e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20

General

Target

e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20.exe
Size

3.8MB
MD5

ad4d59f67896456294dbc19e6aa0f92a
SHA1

5a4138250cd2463325384145e15da5ea2751af55
SHA256

e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20
SHA512

fed5bf6ed053c978665d4f72c3e90a0a96cce260d948d9093f82409e3584fab91872473b57160c0127cfea9a99a4ad2e75e8b764839b7635a599f94afb869d8e
SSDEEP

98304:7aOC7DOU4Cvnjd072ICAI0UJ2gvaH4lI2ItE0JjxqO:C7DOHKjPAIx2LR2ItP

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://bxytupu.com/search/?q=67e28dd83e59fb7a130afa4e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4fe8889b5e4fa9281ae978f671ea771795af8e05c644db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffc14c4e89c9d3b

http://bxytupu.com/search/?q=67e28dd83e59fb7a130afa4e7c27d78406abdd88be4b12eab517aa5c96bd86e994814a835a8bbc896c58e713bc90c91a36b5281fc235a925ed3e55d6bd974a95129070b617e96cc92be510b866db51b9e34eed4c2b14a82966836f23d7f210c7ee969f3fca669116

Signatures

Detect Socks5Systemz Payload 5 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2692-69-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz
behavioral2/memory/2692-74-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz
behavioral2/memory/2692-83-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz
behavioral2/memory/2692-96-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz
behavioral2/memory/2692-97-0x0000000000AD0000-0x0000000000B72000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

is-DV1E3.tmpfreewaveeditor.exefreewaveeditor.exe

pid process

2076 is-DV1E3.tmp
1192 freewaveeditor.exe
2692 freewaveeditor.exe
Loads dropped DLL 3 IoCs

Processes:

is-DV1E3.tmp

pid process

2076 is-DV1E3.tmp
2076 is-DV1E3.tmp
2076 is-DV1E3.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 91.211.247.248
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

pid	process
2076	is-DV1E3.tmp
1192	freewaveeditor.exe
2692	freewaveeditor.exe

pid	process
2076	is-DV1E3.tmp
2076	is-DV1E3.tmp
2076	is-DV1E3.tmp

description	ioc
Destination IP	91.211.247.248

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20.exeis-DV1E3.tmp

description	pid	process	target process
PID 32 wrote to memory of 2076	32	e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20.exe	is-DV1E3.tmp
PID 32 wrote to memory of 2076	32	e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20.exe	is-DV1E3.tmp
PID 32 wrote to memory of 2076	32	e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20.exe	is-DV1E3.tmp
PID 2076 wrote to memory of 1192	2076	is-DV1E3.tmp	freewaveeditor.exe
PID 2076 wrote to memory of 1192	2076	is-DV1E3.tmp	freewaveeditor.exe
PID 2076 wrote to memory of 1192	2076	is-DV1E3.tmp	freewaveeditor.exe
PID 2076 wrote to memory of 2692	2076	is-DV1E3.tmp	freewaveeditor.exe
PID 2076 wrote to memory of 2692	2076	is-DV1E3.tmp	freewaveeditor.exe
PID 2076 wrote to memory of 2692	2076	is-DV1E3.tmp	freewaveeditor.exe

C:\Users\Admin\AppData\Local\Temp\e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20.exe
"C:\Users\Admin\AppData\Local\Temp\e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:32

C:\Users\Admin\AppData\Local\Temp\is-PIP14.tmp\is-DV1E3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PIP14.tmp\is-DV1E3.tmp" /SL4 $3017E "C:\Users\Admin\AppData\Local\Temp\e8cc79043b2b8995bd5206513306ca8c3c3061e64fe4bab987a3f4c29beeff20.exe" 3637775 52224
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2076

C:\Users\Admin\AppData\Local\Free Wave Editor\freewaveeditor.exe
"C:\Users\Admin\AppData\Local\Free Wave Editor\freewaveeditor.exe" -i
3⤵
- Executes dropped EXE
PID:1192

C:\Users\Admin\AppData\Local\Free Wave Editor\freewaveeditor.exe
"C:\Users\Admin\AppData\Local\Free Wave Editor\freewaveeditor.exe" -s
3⤵
- Executes dropped EXE
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Free Wave Editor\freewaveeditor.exe
Filesize
3.8MB

MD5
c6338a9712978ae00826cf4b648cdc02

SHA1
c59333cc5950c3bbbbc072ba240ecd6a448f7ce5

SHA256
65fbb8376180f17ece9138c78e0472007b14e67dd78ccf24486594d153859f85

SHA512
d628d6b572722f3a27472f12ad94dc67edb149446fc3d8935e91fddd223bf8a9929ae72a79c801bd1ca4e3c26400b14898e3568f5f494689db050a6531e9da03

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-81DCP.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-81DCP.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PIP14.tmp\is-DV1E3.tmp
Filesize
648KB

MD5
ba27acf39f1bc1f782b5ff3ffad2f527

SHA1
58da67551e533e5b22f8acc4178ebbeedc22b304

SHA256
c2a86a5d853d1e437993bbaf2243620265a840ce0d36e5bddecb801805911a7e

SHA512
c9fb586001f34059a10caf6c2d100c5b387c18482ac59400ec405c4849b041cdf6ae5fd9242e07ef7561f1d27f3b5709520cc0895303621625cbeac76ce77667

Download Submit
memory/32-2-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/32-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/32-52-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1192-44-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1192-43-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1192-47-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/1192-48-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2076-55-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2076-7-0x0000000002340000-0x0000000002341000-memory.dmp

Filesize
4KB

Download
memory/2076-53-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/2692-58-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-82-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-51-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-59-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-62-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-65-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-68-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-69-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/2692-73-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-74-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/2692-79-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-54-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-83-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/2692-86-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-89-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-92-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-95-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-96-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/2692-97-0x0000000000AD0000-0x0000000000B72000-memory.dmp

Filesize
648KB

Download
memory/2692-101-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download
memory/2692-104-0x0000000000400000-0x00000000007CE000-memory.dmp

Filesize
3.8MB

Download

Analysis

Sharing