socks5systemz | 3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7

General

Target

3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.exe
Size

4.2MB
MD5

040d9594cb081c0fb225d1375445b4a0
SHA1

43653149ef61d07ee6f8efd45b43d2e7e6adbc2f
SHA256

3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7
SHA512

af2e84d618a76225e0e9412d1100bf730223001f72760f65fd1a6f55766b9f01bb93aa22cdca6f40789b0b61f4719684210e422fe6a7c8aead0c8ea6deb1e268
SSDEEP

98304:ILofN0cS1s7JHYMQB8NcMkWdH1oDKRoTzTd5lWyBXxMCBsERzbHvn:j0cys7JHRmZWdH1oDzTdWSxMCBsEhvn

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://ckhuvqs.net/search/?q=67e28dd83d55fb7e4809ae1d7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4be8889b5e4fa9281ae978a071ea771795af8e05c645db22f31dfe339426fa12a466c553adb719a9577e55b8603e983a608ffa13c5e7949d3e

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/3732-86-0x0000000002760000-0x0000000002802000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2840	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp
2080	cutterjoiner.exe
3732	cutterjoiner.exe

Loads dropped DLL 1 IoCs

pid	Process
2840	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 2840	1884	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.exe	77
PID 1884 wrote to memory of 2840	1884	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.exe	77
PID 1884 wrote to memory of 2840	1884	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.exe	77
PID 2840 wrote to memory of 2080	2840	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp	78
PID 2840 wrote to memory of 2080	2840	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp	78
PID 2840 wrote to memory of 2080	2840	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp	78
PID 2840 wrote to memory of 3732	2840	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp	79
PID 2840 wrote to memory of 3732	2840	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp	79
PID 2840 wrote to memory of 3732	2840	3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp	79

C:\Users\Admin\AppData\Local\Temp\3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.exe
"C:\Users\Admin\AppData\Local\Temp\3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\is-Q9K11.tmp\3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-Q9K11.tmp\3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp" /SL5="$8002A,4146883,54272,C:\Users\Admin\AppData\Local\Temp\3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2840
- - C:\Users\Admin\AppData\Local\Sound Cutter Joiner\cutterjoiner.exe
    "C:\Users\Admin\AppData\Local\Sound Cutter Joiner\cutterjoiner.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2080
- - C:\Users\Admin\AppData\Local\Sound Cutter Joiner\cutterjoiner.exe
    "C:\Users\Admin\AppData\Local\Sound Cutter Joiner\cutterjoiner.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Sound Cutter Joiner\cutterjoiner.exe

Filesize
1.9MB

MD5
3bbdf1b19519e0e021bfb8591e2a2447

SHA1
77af1821b16accd8efa297241eea811ca7132526

SHA256
4b03cbb0f3f75b606698183e4463355c9e57330c5e80368e8f36c90e1ef36027

SHA512
fd9c58f1c6c766b4208b6ee6038e3b339a1892f1bed30d7ef4b72396208d7ee73fd6ba75ffff1ec4f477873bf3e9b2eae7a23bdd30200e5010bb809f3da6b63a

Download Submit
C:\Users\Admin\AppData\Local\Sound Cutter Joiner\libeay32.dll

Filesize
1.9MB

MD5
5fbd844a6ce26deb5337e8e6dd7c7b70

SHA1
5302e49b2027a07c7bb8f95d45510efc0d954cf8

SHA256
f0d640c4e07c81c29f0ec2b603ec3017bdd4db0d0e26c3fa364a6bbf45826058

SHA512
c383b5ec9fb9efd53cdf00c2b0940fe60a35a857f8be40ae0763647c3523712553910aca8504768cc86895b2168525fa6043d567e66e0ed5696e2c8e5e7b992d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NQ88E.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-Q9K11.tmp\3a5e914f498f5cae0ff8616199c1e8ed1f01ed925f0c8ee03e9b710fb6e8e1b7.tmp

Filesize
696KB

MD5
cd4d1e0629d806614353e17ca8646259

SHA1
b262f6f451b07b594eb3f182538d9b4d33a4c9d8

SHA256
841d58bbf8495f49b9430f9faf25f1652b32ef8aaf43d7aec3fb9fda9b16ce00

SHA512
3e8b3841f8892fb63eee586c19753b32177bc908bd5e3fbec166b59a9692e362adb00494a85e51c4b0b9c9e1b0108f8914c134f552d5007b90a213ab1e24f533

Download Submit
memory/1884-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1884-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1884-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2080-59-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/2080-60-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/2080-63-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/2080-65-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/2840-71-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2840-16-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3732-72-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-95-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-75-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-76-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-79-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-82-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-85-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-86-0x0000000002760000-0x0000000002802000-memory.dmp

Filesize
648KB

Download
memory/3732-90-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-69-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-98-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-101-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-104-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-107-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-110-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-114-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download
memory/3732-117-0x0000000000400000-0x00000000005EE000-memory.dmp

Filesize
1.9MB

Download

Analysis

Sharing