socks5systemz | 6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2

General

Target

6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2.exe
Size

4.5MB
MD5

250cc589c3b8b0518e356c3f70a68510
SHA1

1912bc4cea5800fce1944c334b2e2fff74c3e41c
SHA256

6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2
SHA512

418c9d19940d5ee11d92feefa813f94aa196aea62f6e6c2ed3caebca632091bd38a48a126d451ffaa873fc1dd14b505e6200ff32253293419828b2dcbd7b82c9
SSDEEP

98304:7aRRFqMvmdMRzovbRQQetMeuRHmV/n98eIN1nw2qaXi7f5vNTPkr:M+NQSeuRH2/n6C7wib3TPo

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://ebcrfzu.ua/search/?q=67e28dd86809f27b415ba51b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffb11c1ec949e3b

http://ebcrfzu.ua/search/?q=67e28dd86809f27b415ba51b7c27d78406abdd88be4b12eab517aa5c96bd86e9908748885a8bbc896c58e713bc90c94836b5281fc235a925ed3e04d6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee919a3ace6e9216

Signatures

Detect Socks5Systemz Payload 5 IoCs

resource	yara_rule
behavioral2/memory/540-92-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz
behavioral2/memory/540-97-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz
behavioral2/memory/540-106-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz
behavioral2/memory/540-119-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz
behavioral2/memory/540-120-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2832	is-QRCPK.tmp
4336	recorder32.exe
540	recorder32.exe

Loads dropped DLL 3 IoCs

pid	Process
2832	is-QRCPK.tmp
2832	is-QRCPK.tmp
2832	is-QRCPK.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2088 wrote to memory of 2832	2088	6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2.exe	72
PID 2088 wrote to memory of 2832	2088	6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2.exe	72
PID 2088 wrote to memory of 2832	2088	6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2.exe	72
PID 2832 wrote to memory of 4336	2832	is-QRCPK.tmp	73
PID 2832 wrote to memory of 4336	2832	is-QRCPK.tmp	73
PID 2832 wrote to memory of 4336	2832	is-QRCPK.tmp	73
PID 2832 wrote to memory of 540	2832	is-QRCPK.tmp	74
PID 2832 wrote to memory of 540	2832	is-QRCPK.tmp	74
PID 2832 wrote to memory of 540	2832	is-QRCPK.tmp	74

C:\Users\Admin\AppData\Local\Temp\6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2.exe
"C:\Users\Admin\AppData\Local\Temp\6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2088
- C:\Users\Admin\AppData\Local\Temp\is-P9ASB.tmp\is-QRCPK.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-P9ASB.tmp\is-QRCPK.tmp" /SL4 $6022C "C:\Users\Admin\AppData\Local\Temp\6952b162730b2cfdb4512d9975b22a4e9fd7c68fc1a406acb0baf6e31e5b77a2.exe" 4463743 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2832
- - C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe
    "C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4336
- - C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe
    "C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Color Media Player\recorder32.exe

Filesize
1.9MB

MD5
daddc1e6389230a7fda1da414120d41b

SHA1
896a87c42d18343781d0296e4547b5f76c78f66a

SHA256
b7533c7937bf102d56cf69d845bf805eb4aba67a8ff4a0ebfe4a34469570c3f8

SHA512
6d9748886f12f558d497d8a17ad7e98dbd5b7473946437d807f85477c27c48beb8b8fb0748d0f19075a0e578e63a464aecf7a106d6aa60ddb48c14e5c3756119

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-P9ASB.tmp\is-QRCPK.tmp

Filesize
648KB

MD5
d29800551373c0e0b534392c7b925fda

SHA1
801e795989d66db0f862b861ee0a7560da6c6ddc

SHA256
bbd73a9d3754b09a090ead3c7bcc67e010098d3dc8c498c5a56643b7817f64c5

SHA512
563864a085f1c17e7d6477fa1e2fe3475fe6ee670e95998361baca79b769699b9a30b3fd74c47d89972ba6b91eb104dd7f5f43a74de0a189b8ecbab1d2b5a8de

Download Submit
\Users\Admin\AppData\Local\Temp\is-6S37O.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-6S37O.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
memory/540-115-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-79-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-88-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-91-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-139-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-136-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-133-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-73-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-74-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-92-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/540-130-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-77-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-127-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-118-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-82-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-85-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-124-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-120-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/540-119-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/540-96-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-97-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/540-102-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-105-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-106-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/540-109-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/540-112-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/2088-75-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2088-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2088-3-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2832-7-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2832-78-0x00000000001F0000-0x00000000001F1000-memory.dmp

Filesize
4KB

Download
memory/2832-76-0x0000000000400000-0x00000000004B1000-memory.dmp

Filesize
708KB

Download
memory/4336-65-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/4336-69-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/4336-70-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download
memory/4336-66-0x0000000000400000-0x00000000005E1000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing