socks5systemz | 8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614

General

Target

8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe
Size

4.3MB
MD5

54fd9b9f83e58f51a784ce990ea29ff1
SHA1

04202fe61794b80851904654d5e88eeb9622f97b
SHA256

8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614
SHA512

13962c7044c9ce3fcf724092a5e7add4f932244d5502cef38ea9fc8884741d1cce28bc19024ee07c16f321467e1a7df2f7eb2d5514128b265e4936f36889bd15
SSDEEP

98304:7apZ+ZiAiDICTa+ntaiBu7htKrSbfTtb6SxEOJr:UZMiAWIE1sEGtKahbrEOp

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://booxqeg.com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6489f912c7ef9d

http://booxqeg.com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12eab517aa5c96bd86e8908f4e815a8bbc896c58e713bc90c91c36b5281fc235a925ed3e5dd6bd974a95129070b616e96cc92be20ea778c255bbe258b90d3b4eed3233d1626a8ff810c3e893993ccd67

Signatures

Detect Socks5Systemz Payload 5 IoCs

Processes:

resource	yara_rule
behavioral1/memory/2616-103-0x00000000029B0000-0x0000000002A52000-memory.dmp	family_socks5systemz
behavioral1/memory/2616-106-0x00000000029B0000-0x0000000002A52000-memory.dmp	family_socks5systemz
behavioral1/memory/2616-115-0x00000000029B0000-0x0000000002A52000-memory.dmp	family_socks5systemz
behavioral1/memory/2616-128-0x00000000029B0000-0x0000000002A52000-memory.dmp	family_socks5systemz
behavioral1/memory/2616-129-0x00000000029B0000-0x0000000002A52000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

is-59QTA.tmprecorder32.exerecorder32.exe

pid process

1520 is-59QTA.tmp
2604 recorder32.exe
2616 recorder32.exe

pid	process
1520	is-59QTA.tmp
2604	recorder32.exe
2616	recorder32.exe

Loads dropped DLL 11 IoCs

Processes:

8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exeis-59QTA.tmprecorder32.exerecorder32.exe

pid	process
1540	8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe
1520	is-59QTA.tmp
1520	is-59QTA.tmp
1520	is-59QTA.tmp
1520	is-59QTA.tmp
1520	is-59QTA.tmp
2604	recorder32.exe
2604	recorder32.exe
1520	is-59QTA.tmp
2616	recorder32.exe
2616	recorder32.exe

Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 152.89.198.214
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

description	ioc
Destination IP	152.89.198.214

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exeis-59QTA.tmp

description	pid	process	target process
PID 1540 wrote to memory of 1520	1540	8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe	is-59QTA.tmp
PID 1540 wrote to memory of 1520	1540	8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe	is-59QTA.tmp
PID 1540 wrote to memory of 1520	1540	8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe	is-59QTA.tmp
PID 1540 wrote to memory of 1520	1540	8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe	is-59QTA.tmp
PID 1540 wrote to memory of 1520	1540	8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe	is-59QTA.tmp
PID 1540 wrote to memory of 1520	1540	8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe	is-59QTA.tmp
PID 1540 wrote to memory of 1520	1540	8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe	is-59QTA.tmp
PID 1520 wrote to memory of 2604	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2604	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2604	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2604	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2604	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2604	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2604	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2616	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2616	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2616	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2616	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2616	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2616	1520	is-59QTA.tmp	recorder32.exe
PID 1520 wrote to memory of 2616	1520	is-59QTA.tmp	recorder32.exe

C:\Users\Admin\AppData\Local\Temp\8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe
"C:\Users\Admin\AppData\Local\Temp\8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1540

C:\Users\Admin\AppData\Local\Temp\is-99MHM.tmp\is-59QTA.tmp
"C:\Users\Admin\AppData\Local\Temp\is-99MHM.tmp\is-59QTA.tmp" /SL4 $30142 "C:\Users\Admin\AppData\Local\Temp\8c365f0d741e4297716adba1e9a2c8aaba41f7a0cf246eb1794f997d7ad3a614.exe" 4290981 52224
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1520

C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe
"C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe" -i
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2604

C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe
"C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe" -s
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2616

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Color Media Player\recorder32.exe
Filesize
1.7MB

MD5
d859fee516876464ccd12cfd8b22ceda

SHA1
100e757d0f68d22595f8465635126cf3d7f0ab94

SHA256
36c329a9c887170a6685514aa596aa9220401a07d8f7f1793a36f3e988eccf14

SHA512
6de6d6006dc62efdaf61904173a16bb5828c643e7249e2ecf5cc361312b553fa3ca2c7b03d50d281034f3874a1f191fe50975816d7b24238b8df21412bbfba7d

Download Submit
\Users\Admin\AppData\Local\Temp\is-7M6P9.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-7M6P9.tmp\_isetup\_isdecmp.dll
Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
\Users\Admin\AppData\Local\Temp\is-7M6P9.tmp\_isetup\_shfoldr.dll
Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-99MHM.tmp\is-59QTA.tmp
Filesize
648KB

MD5
d29800551373c0e0b534392c7b925fda

SHA1
801e795989d66db0f862b861ee0a7560da6c6ddc

SHA256
bbd73a9d3754b09a090ead3c7bcc67e010098d3dc8c498c5a56643b7817f64c5

SHA512
563864a085f1c17e7d6477fa1e2fe3475fe6ee670e95998361baca79b769699b9a30b3fd74c47d89972ba6b91eb104dd7f5f43a74de0a189b8ecbab1d2b5a8de

Download Submit
memory/1520-64-0x0000000003560000-0x0000000003714000-memory.dmp

Filesize
1.7MB

Download
memory/1520-83-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/1540-1-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1540-81-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2604-70-0x0000000000A80000-0x0000000000C34000-memory.dmp

Filesize
1.7MB

Download
memory/2604-71-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2604-72-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2604-74-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-94-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-111-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-87-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-88-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-89-0x0000000000BB0000-0x0000000000D64000-memory.dmp

Filesize
1.7MB

Download
memory/2616-90-0x0000000000BB0000-0x0000000000D64000-memory.dmp

Filesize
1.7MB

Download
memory/2616-91-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-80-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-97-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-100-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-103-0x00000000029B0000-0x0000000002A52000-memory.dmp

Filesize
648KB

Download
memory/2616-104-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-106-0x00000000029B0000-0x0000000002A52000-memory.dmp

Filesize
648KB

Download
memory/2616-84-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-114-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-115-0x00000000029B0000-0x0000000002A52000-memory.dmp

Filesize
648KB

Download
memory/2616-118-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-121-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-124-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-127-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-128-0x00000000029B0000-0x0000000002A52000-memory.dmp

Filesize
648KB

Download
memory/2616-129-0x00000000029B0000-0x0000000002A52000-memory.dmp

Filesize
648KB

Download
memory/2616-133-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-136-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-139-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-142-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-145-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download
memory/2616-148-0x0000000000400000-0x00000000005B4000-memory.dmp

Filesize
1.7MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads