socks5systemz | 531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d

General

Target

531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe
Size

4.3MB
MD5

3f220e155378b321d7be2ccc24a2fb6a
SHA1

d787a36c12d3cfa95b201d3ec87d977ebaf8ebcb
SHA256

531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d
SHA512

8a0d79e35b6d1180d89ef134f38603634c54eece2d4646e4a3c50ba9a11a24efc31f21743aa4abf7affb60bdc85b364aee4706f599148db7cf5ae6dca33a4e96
SSDEEP

98304:+bnY/pSz+nb3C/uCgSp2IgYLwnYVzc7eLjGkM675/cD2d1ZWUj:D/8lPBpH3Vzc6vGU75PXWUj

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://csbdhkn.net/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6389f814c0e797

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2840-96-0x0000000002420000-0x00000000024C2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp
2740	auditorium.exe
2840	auditorium.exe

Loads dropped DLL 6 IoCs

pid	Process
2044	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe
2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp
2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp
2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp
2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp
2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2044 wrote to memory of 2000	2044	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe	28
PID 2044 wrote to memory of 2000	2044	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe	28
PID 2044 wrote to memory of 2000	2044	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe	28
PID 2044 wrote to memory of 2000	2044	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe	28
PID 2044 wrote to memory of 2000	2044	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe	28
PID 2044 wrote to memory of 2000	2044	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe	28
PID 2044 wrote to memory of 2000	2044	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe	28
PID 2000 wrote to memory of 2740	2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp	29
PID 2000 wrote to memory of 2740	2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp	29
PID 2000 wrote to memory of 2740	2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp	29
PID 2000 wrote to memory of 2740	2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp	29
PID 2000 wrote to memory of 2840	2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp	30
PID 2000 wrote to memory of 2840	2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp	30
PID 2000 wrote to memory of 2840	2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp	30
PID 2000 wrote to memory of 2840	2000	531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp	30

C:\Users\Admin\AppData\Local\Temp\531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe
"C:\Users\Admin\AppData\Local\Temp\531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2044
- C:\Users\Admin\AppData\Local\Temp\is-HCQ3G.tmp\531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HCQ3G.tmp\531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp" /SL5="$4014E,4245892,54272,C:\Users\Admin\AppData\Local\Temp\531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Users\Admin\AppData\Local\Auditorium\auditorium.exe
    "C:\Users\Admin\AppData\Local\Auditorium\auditorium.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2740
- - C:\Users\Admin\AppData\Local\Auditorium\auditorium.exe
    "C:\Users\Admin\AppData\Local\Auditorium\auditorium.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Auditorium\libeay32.dll

Filesize
2.3MB

MD5
5afad5dd0bae7f01c2be79f9f168c9e8

SHA1
553fe32e9cc002b3357c11de74478b85b04657bc

SHA256
4c5c6debe9453f0343f163aa72b7049f3167bc08d3b2d549fcabc4ee6bfbafcd

SHA512
3f78196965db2fa5f6a13fecd9d93abbbaafaa52a6b43e8bd957d3b1e52bc3930db2d72e79cd34315f56b9758ed37a5d6b122533351d90296abfe8ca7f62fb3f

Download Submit
\Users\Admin\AppData\Local\Auditorium\auditorium.exe

Filesize
2.2MB

MD5
d1994d1988ad9fa334568545896a2c88

SHA1
31a340fb3b67ddfc8a0b913901fbc9fd2c12c916

SHA256
ab77529debae46859b69a98d3ca815a399456f585f192fb01ed8dd510df84cae

SHA512
97a5992452f710e43201d1e06f6cbb4920b902b184836e88bca79148a0c8ef5ec7524bfaa063cc6d7450d22ad5ac8db0f7a6037879dd28376a754b128fc628d8

Download Submit
\Users\Admin\AppData\Local\Temp\is-HCQ3G.tmp\531294dc22300b7ed2710ea9bdd52ed915dbbbd66457e9903762877686e1ff9d.tmp

Filesize
695KB

MD5
2b2432f8f90f34e94323b63dcf038483

SHA1
93fd796b9dc71c69cec894a48bd4cc4d9a74430b

SHA256
481e58b48af909285459b2b9299c84e838fb4a7beb0fc823a9053c28134c738c

SHA512
57eea611fef19d6ecf76d6baf307b1b3c9b23ba08d34a88a17bcc55de141c29c8c3c7e75ced3d3e86d4fa069ea035f0d425a579dae2c3a9fa2eec5a6c8ba7a81

Download Submit
\Users\Admin\AppData\Local\Temp\is-HPIRK.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-HPIRK.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2000-16-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2000-64-0x00000000033D0000-0x000000000360A000-memory.dmp

Filesize
2.2MB

Download
memory/2000-80-0x00000000033D0000-0x000000000360A000-memory.dmp

Filesize
2.2MB

Download
memory/2000-78-0x0000000000400000-0x00000000004BD000-memory.dmp

Filesize
756KB

Download
memory/2044-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2044-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2044-77-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2740-65-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2740-70-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2740-69-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2740-66-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-83-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-111-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-75-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-86-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-89-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-92-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-95-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-96-0x0000000002420000-0x00000000024C2000-memory.dmp

Filesize
648KB

Download
memory/2840-102-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-105-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-108-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-79-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-114-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-117-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-121-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-124-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-127-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-130-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-133-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-136-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download
memory/2840-141-0x0000000000400000-0x000000000063A000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing