socks5systemz | 9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613

General

Target

9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.exe
Size

4.3MB
MD5

30ed0c72a440bf71d20c043c41db140f
SHA1

4f3b131808f42ef6bb7cffea741c4f274e83ff68
SHA256

9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613
SHA512

a8abf64bc8a3c6a3ba227b9592ed03d89df2444673523966b73367aa386714eb3dabdb4dd9ea3c14bd93a7077676f586ed9bcb2c46657268f9e592ce933f1156
SSDEEP

98304:ioju6pgiNseCvLbrg5IK+rrFicqXagwdG/a0e9JdQDBtXOzOcFT/3TNvSt:/jLpggvCvLw58rZicmRwwCDJi9YnxRv6

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://bewezmj.com/search/?q=67e28dd83f5aa4794209ff1c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978a271ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa12c7ec93983e

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/3508-90-0x00000000008C0000-0x0000000000962000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2564	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp
4228	mixerfreeedition.exe
3508	mixerfreeedition.exe

Loads dropped DLL 1 IoCs

pid	Process
2564	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 2564	4720	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.exe	81
PID 4720 wrote to memory of 2564	4720	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.exe	81
PID 4720 wrote to memory of 2564	4720	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.exe	81
PID 2564 wrote to memory of 4228	2564	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp	85
PID 2564 wrote to memory of 4228	2564	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp	85
PID 2564 wrote to memory of 4228	2564	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp	85
PID 2564 wrote to memory of 3508	2564	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp	86
PID 2564 wrote to memory of 3508	2564	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp	86
PID 2564 wrote to memory of 3508	2564	9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp	86

C:\Users\Admin\AppData\Local\Temp\9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.exe
"C:\Users\Admin\AppData\Local\Temp\9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\is-R89OL.tmp\9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-R89OL.tmp\9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp" /SL5="$70062,4251619,54272,C:\Users\Admin\AppData\Local\Temp\9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2564
- - C:\Users\Admin\AppData\Local\Mixer Free Edition\mixerfreeedition.exe
    "C:\Users\Admin\AppData\Local\Mixer Free Edition\mixerfreeedition.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4228
- - C:\Users\Admin\AppData\Local\Mixer Free Edition\mixerfreeedition.exe
    "C:\Users\Admin\AppData\Local\Mixer Free Edition\mixerfreeedition.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3508

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mixer Free Edition\libeay32.dll

Filesize
1.9MB

MD5
5fbd844a6ce26deb5337e8e6dd7c7b70

SHA1
5302e49b2027a07c7bb8f95d45510efc0d954cf8

SHA256
f0d640c4e07c81c29f0ec2b603ec3017bdd4db0d0e26c3fa364a6bbf45826058

SHA512
c383b5ec9fb9efd53cdf00c2b0940fe60a35a857f8be40ae0763647c3523712553910aca8504768cc86895b2168525fa6043d567e66e0ed5696e2c8e5e7b992d

Download Submit
C:\Users\Admin\AppData\Local\Mixer Free Edition\mixerfreeedition.exe

Filesize
1.9MB

MD5
ce20aee9882c57878dd540ec69e69004

SHA1
75bd2cd7e995d0048a9f3e728afc264c7ff203ec

SHA256
9600cd87e68f0608ef9bef81d664cbd6c648ac32eaba439f978778b26ad85ada

SHA512
f8ff8a3de868596d225a4ecda268f515b88c32a1cffa1032906aae6a12e556456d84cb0240951f1d37a8a542c4a651c0313c48c0caa75c01d12ba3c0a9b7e243

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-83EBT.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-R89OL.tmp\9e20ef30168d03c43fe437a75a8a5af7f41fbbae54ef38a3f396894bc0f04613.tmp

Filesize
696KB

MD5
c6061f804038f66af0cbf28c43abf849

SHA1
0473fc63f6514857bba850ce50206fbe8c992b64

SHA256
6261d17d1ab1744496c0f2988954989398d6829f2417df5420ffdf6d64f8678e

SHA512
edf27bfeec82752b6d52a8eb68853dde5d5effd9c3a8c1c93e181167d8bc5ae2c6d7b19ac74955c91aa4e90913fb7dcc8439d33a5e0c8aac5fe71c914596e0ae

Download Submit
memory/2564-72-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/2564-13-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/3508-91-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-103-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-119-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-116-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-112-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-68-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-70-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-109-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-106-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-73-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-76-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-77-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-80-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-83-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-86-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-100-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/3508-90-0x00000000008C0000-0x0000000000962000-memory.dmp

Filesize
648KB

Download
memory/3508-97-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/4228-63-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/4228-59-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/4228-60-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/4228-65-0x0000000000400000-0x00000000005F3000-memory.dmp

Filesize
1.9MB

Download
memory/4720-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4720-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4720-71-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing