socks5systemz | de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6

General

Target

de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.exe
Size

4.4MB
MD5

94d08733b55fdb08c511ad929d2ddf03
SHA1

092750754bb8d0a579ac78a6c8c1ae8650ce913a
SHA256

de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6
SHA512

f35db41d2fabe84df43faca46f73c82f244247f3e4949b66590ee9da5c3ffc071ee2c7761a74a1b882b8d27705cc9999c63ffae8965c1491888fc5fd69c4c590
SSDEEP

98304:W8JhJymQu/mOU9ItFnVLsrzcuU3103isHZv9+:amT89IHVLsrlUC3i6v9+

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4768-86-0x00000000008F0000-0x0000000000992000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
4292	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp
4940	radiobuster.exe
4768	radiobuster.exe

Loads dropped DLL 1 IoCs

pid	Process
4292	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 836 wrote to memory of 4292	836	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.exe	83
PID 836 wrote to memory of 4292	836	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.exe	83
PID 836 wrote to memory of 4292	836	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.exe	83
PID 4292 wrote to memory of 4940	4292	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp	84
PID 4292 wrote to memory of 4940	4292	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp	84
PID 4292 wrote to memory of 4940	4292	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp	84
PID 4292 wrote to memory of 4768	4292	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp	86
PID 4292 wrote to memory of 4768	4292	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp	86
PID 4292 wrote to memory of 4768	4292	de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp	86

C:\Users\Admin\AppData\Local\Temp\de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.exe
"C:\Users\Admin\AppData\Local\Temp\de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:836
- C:\Users\Admin\AppData\Local\Temp\is-RC3GD.tmp\de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-RC3GD.tmp\de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp" /SL5="$D0066,4380096,54272,C:\Users\Admin\AppData\Local\Temp\de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4292
- - C:\Users\Admin\AppData\Local\Radio Buster\radiobuster.exe
    "C:\Users\Admin\AppData\Local\Radio Buster\radiobuster.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4940
- - C:\Users\Admin\AppData\Local\Radio Buster\radiobuster.exe
    "C:\Users\Admin\AppData\Local\Radio Buster\radiobuster.exe" -s
    3⤵
    - Executes dropped EXE
    PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Radio Buster\libeay32.dll

Filesize
1.9MB

MD5
876a839023b8f962a72d295da7495734

SHA1
62a7728679bc18784b1fbf1d013f7cece18cbec9

SHA256
a757d773da406411fb977761f6e56f016d48d224aedaf3d875ed4d4a9ede6158

SHA512
e1b23a2f5ec0100ff874ca075bbd0f90e9065a90fec66861f99df603d7aaa9db8e8ec326710fdc11ad41d01befe4ea3077136127acf613614d0d12ff23bec6c1

Download Submit
C:\Users\Admin\AppData\Local\Radio Buster\radiobuster.exe

Filesize
2.1MB

MD5
c13163cb73c48c40bfb6fa0d8951a16b

SHA1
6e26781988a0df52de9e905289877e9028185bf7

SHA256
38783d543c5cac3a363919c23be83889b0c2f50a56abe8ea36c8b7fd2a6fe194

SHA512
2ba3703d86f6ad43a9dcb92b755b7c908f90856822879be99595d07613354b8b67340c1df6369278fa65765a95f4ba6d93f57f73ae2de78c6b6930c41a86be9c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-F85TD.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RC3GD.tmp\de5f8b987e059597e123828acfd03240724f64414d4b8dc58781801e55369ff6.tmp

Filesize
696KB

MD5
9506bec9e52f7358d3507abfef3dff76

SHA1
5cadad1620d283cafacc32714d4e8136499ec0e2

SHA256
0d8eb5f7cd825e50d48fe4e4d8b69f51dba9d55f0be9ed8732b727659ec417e8

SHA512
99638c72a1d6a48a6f2111caefe6f65e3ecb763bb459b101c3322ae0d621469c44d266bb1a7d6d52c52ad06a434d91e6eb58795d6e91094ccad8aa0bb1903142

Download Submit
memory/836-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/836-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/836-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4292-12-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4292-71-0x0000000000400000-0x00000000004BE000-memory.dmp

Filesize
760KB

Download
memory/4768-86-0x00000000008F0000-0x0000000000992000-memory.dmp

Filesize
648KB

Download
memory/4768-85-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-67-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-69-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-117-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-114-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-72-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-75-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-76-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-79-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-82-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-111-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-108-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-91-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-96-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-99-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-102-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4768-105-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4940-59-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4940-60-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4940-63-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download
memory/4940-64-0x0000000000400000-0x0000000000617000-memory.dmp

Filesize
2.1MB

Download

Analysis

Sharing