socks5systemz | 195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5

General

Target

195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.exe
Size

4.3MB
MD5

75cab99147852b877aeec544e91fdf03
SHA1

da7ce098bd485975f3636e8992a134add49da77e
SHA256

195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5
SHA512

acc1a3a44c2fbeb8438e7be9e9151fd6115953e0ec767a7a2891b96dc8ea2ccb9dc2c4c4d8e13b37249879e53748571dd3d1b24816bd338369824869a083d20d
SSDEEP

98304:KvmGccy/z7hh0+JcCfZj7l4+bCJAenKKLunqGTJ2x8lFBe24xvl:0mhxC+eCfdRbCBnKHPJwI4vl

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://csygxlb.net/search/?q=67e28dd83a09fa2d165cad4d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978a571ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffa13c1ec969f3c

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1660-85-0x0000000002760000-0x0000000002802000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
240	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp
1684	cdstudio32.exe
1660	cdstudio32.exe

Loads dropped DLL 1 IoCs

pid	Process
240	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1216 wrote to memory of 240	1216	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.exe	79
PID 1216 wrote to memory of 240	1216	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.exe	79
PID 1216 wrote to memory of 240	1216	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.exe	79
PID 240 wrote to memory of 1684	240	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp	81
PID 240 wrote to memory of 1684	240	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp	81
PID 240 wrote to memory of 1684	240	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp	81
PID 240 wrote to memory of 1660	240	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp	82
PID 240 wrote to memory of 1660	240	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp	82
PID 240 wrote to memory of 1660	240	195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp	82

C:\Users\Admin\AppData\Local\Temp\195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.exe
"C:\Users\Admin\AppData\Local\Temp\195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1216
- C:\Users\Admin\AppData\Local\Temp\is-0H0A2.tmp\195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0H0A2.tmp\195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp" /SL5="$60208,4242251,54272,C:\Users\Admin\AppData\Local\Temp\195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:240
- - C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe
    "C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:1684
- - C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe
    "C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CD Studio\cdstudio32.exe

Filesize
1.8MB

MD5
f0ab72efc3180a39f8e82d7b0b59df79

SHA1
12a94699bff0eb77e496034ff79b6f89d6ab5aee

SHA256
b29208ca417fa8468c0f0353003d41457bc71ab9833f46d73ec5b81357ce834f

SHA512
cfd764aea21572b7520b548e043a0257a4764547d5244aede72826d006da8af8535e27f2e74a373bb5d8d46cf1b39cf9622a292c38f9d6b06fe189905c5be85b

Download Submit
C:\Users\Admin\AppData\Local\CD Studio\libeay32.dll

Filesize
1.9MB

MD5
5fbd844a6ce26deb5337e8e6dd7c7b70

SHA1
5302e49b2027a07c7bb8f95d45510efc0d954cf8

SHA256
f0d640c4e07c81c29f0ec2b603ec3017bdd4db0d0e26c3fa364a6bbf45826058

SHA512
c383b5ec9fb9efd53cdf00c2b0940fe60a35a857f8be40ae0763647c3523712553910aca8504768cc86895b2168525fa6043d567e66e0ed5696e2c8e5e7b992d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0H0A2.tmp\195fa1e3d9a33dcc265dc16147d4922a982de029df3cb7c661b6e440064901f5.tmp

Filesize
696KB

MD5
2e2f983fe7fcf3751ff06afb8842a41d

SHA1
e7296f13ab8b7a0ba6ee1d2dee180a3eb345815f

SHA256
8e9f8ccf8a70e815a29dc9e0057b0ad7d43a5e9d9671a50e1c14d48344f76dea

SHA512
79f0eddfb107724d5a16d678e8ead3a8c10881d1486b5cb8b3fb8fa1ad96a864d4c45075be865c8f5637c3a9258630ff816d7253b5ce984f24f7602851243174

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-D3KD8.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/240-10-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/240-71-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/1216-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1216-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1216-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1660-94-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-84-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-69-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-116-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-113-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-72-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-75-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-78-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-81-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-109-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-85-0x0000000002760000-0x0000000002802000-memory.dmp

Filesize
648KB

Download
memory/1660-88-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-106-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-97-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-100-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1660-103-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1684-59-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1684-65-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1684-63-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download
memory/1684-61-0x0000000000400000-0x00000000005D9000-memory.dmp

Filesize
1.8MB

Download

Analysis

Sharing