socks5systemz | 523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42

General

Target

523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.exe
Size

4.3MB
MD5

bc04272fdd34fd409d1226d33310695f
SHA1

84b12d279399b993308799218fd1879d11051c11
SHA256

523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42
SHA512

9ef238c2c28cc9ea49ae98bd8af74af628772637e1d4a13f7100e3a1b5bc34f37b8a53944e922782dfecea11cf7d56451ea4b40a09f9e86365bcb541581d9adb
SSDEEP

98304:0KAtrBEcSjDDaf4d6JeGDwG9ObQjvkL/o6lgTw+dhOMRwhr0QVpvl:0VS9+fWmtxO8C/SE6uhr0Q/vl

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://bxzbers.com/search/?q=67e28dd8655bf57a4609f84c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ffa13c0e6969a38

http://bxzbers.com/search/?q=67e28dd8655bf57a4609f84c7c27d78406abdd88be4b12eab517aa5c96bd86ef938f4c805a8bbc896c58e713bc90c91d36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee90983bc46c9615

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3916-83-0x00000000023F0000-0x0000000002492000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
4960	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp
4312	cdstudio32.exe
3916	cdstudio32.exe

Loads dropped DLL 1 IoCs

pid	Process
4960	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 4960	5000	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.exe	75
PID 5000 wrote to memory of 4960	5000	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.exe	75
PID 5000 wrote to memory of 4960	5000	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.exe	75
PID 4960 wrote to memory of 4312	4960	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp	76
PID 4960 wrote to memory of 4312	4960	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp	76
PID 4960 wrote to memory of 4312	4960	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp	76
PID 4960 wrote to memory of 3916	4960	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp	77
PID 4960 wrote to memory of 3916	4960	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp	77
PID 4960 wrote to memory of 3916	4960	523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp	77

C:\Users\Admin\AppData\Local\Temp\523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.exe
"C:\Users\Admin\AppData\Local\Temp\523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Users\Admin\AppData\Local\Temp\is-HP9UI.tmp\523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-HP9UI.tmp\523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp" /SL5="$601EA,4224248,54272,C:\Users\Admin\AppData\Local\Temp\523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4960
- - C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe
    "C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4312
- - C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe
    "C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe

Filesize
1.8MB

MD5
f5dafaee833606889f9602ce309f425c

SHA1
e0d28f046c59e6d82a0f8251905d2ab8418dee3a

SHA256
9e7f3c772811f31eeed732eb86109252fd667ad625073388c4d2f2f5a6f12c63

SHA512
f7068c5a1ec12e1383cbac22a2ab0b396a14d97817e32073ab2037d37a490f5bf155e203986d0a9c3b54fe80bbe1f8f879411be3bae4874298dbd19ea20048e7

Download Submit
C:\Users\Admin\AppData\Local\CD Studio\libeay32.dll

Filesize
1.9MB

MD5
5fbd844a6ce26deb5337e8e6dd7c7b70

SHA1
5302e49b2027a07c7bb8f95d45510efc0d954cf8

SHA256
f0d640c4e07c81c29f0ec2b603ec3017bdd4db0d0e26c3fa364a6bbf45826058

SHA512
c383b5ec9fb9efd53cdf00c2b0940fe60a35a857f8be40ae0763647c3523712553910aca8504768cc86895b2168525fa6043d567e66e0ed5696e2c8e5e7b992d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-HP9UI.tmp\523b54b1ebc27c72f90d58cfd845d52efeeb477cd9f19502bb0d702762a32c42.tmp

Filesize
696KB

MD5
2e2f983fe7fcf3751ff06afb8842a41d

SHA1
e7296f13ab8b7a0ba6ee1d2dee180a3eb345815f

SHA256
8e9f8ccf8a70e815a29dc9e0057b0ad7d43a5e9d9671a50e1c14d48344f76dea

SHA512
79f0eddfb107724d5a16d678e8ead3a8c10881d1486b5cb8b3fb8fa1ad96a864d4c45075be865c8f5637c3a9258630ff816d7253b5ce984f24f7602851243174

Download Submit
\Users\Admin\AppData\Local\Temp\is-V7Q1U.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/3916-104-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-111-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-131-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-126-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-123-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-120-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-67-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-117-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-114-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-70-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-73-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-76-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-79-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-82-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-83-0x00000000023F0000-0x0000000002492000-memory.dmp

Filesize
648KB

Download
memory/3916-87-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-92-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-95-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-98-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-101-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/3916-108-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/4312-60-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/4312-63-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/4312-59-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/4960-13-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4960-69-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/5000-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/5000-68-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5000-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing