socks5systemz | 2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08

General

Target

2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.exe
Size

5.2MB
MD5

ea722aba6efcab9f9bdd63feea339054
SHA1

6df0048500b44c2bf6d184fcbd6effa79ce9353a
SHA256

2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08
SHA512

1e3b756d7d997ea1a2a2804427e2b9b78541ca21b400a13471af100bd489d2df05e75797487a0a48192df79a919ceba2c3b3580a39294bdea8c90412378895a9
SSDEEP

98304:mM/yobaLdRHCAgX+v2Oo3Vf0wN8cLdIpKW+afjWLABe56h5zEnPowDW8/2:D/yo+LHCAgOv2Omd0wNdJIwWLrrBe56/

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

http://bwehlfl.com/search/?q=67e28dd86d08f67e135aaa497c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa18e8889b5e4fa9281ae978a071ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ffa19c9ee9d983a

http://bwehlfl.com/search/?q=67e28dd86d08f67e135aaa497c27d78406abdd88be4b12eab517aa5c96bd86e495834f96148ab2865b77f80ebad9900f7cb63037ed2ab423a4654383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1ea9d933ac56d97

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/2176-92-0x0000000002490000-0x0000000002532000-memory.dmp	family_socks5systemz
behavioral2/memory/2176-116-0x0000000002490000-0x0000000002532000-memory.dmp	family_socks5systemz
behavioral2/memory/2176-117-0x0000000002490000-0x0000000002532000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp
5028	victoriapigments.exe
2176	victoriapigments.exe

Loads dropped DLL 3 IoCs

pid	Process
1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp
1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp
1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 1572	2504	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.exe	82
PID 2504 wrote to memory of 1572	2504	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.exe	82
PID 2504 wrote to memory of 1572	2504	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.exe	82
PID 1572 wrote to memory of 5028	1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp	83
PID 1572 wrote to memory of 5028	1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp	83
PID 1572 wrote to memory of 5028	1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp	83
PID 1572 wrote to memory of 2176	1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp	84
PID 1572 wrote to memory of 2176	1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp	84
PID 1572 wrote to memory of 2176	1572	2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp	84

C:\Users\Admin\AppData\Local\Temp\2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.exe
"C:\Users\Admin\AppData\Local\Temp\2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Users\Admin\AppData\Local\Temp\is-GKH10.tmp\2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-GKH10.tmp\2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp" /SL5="$701C8,5247770,54272,C:\Users\Admin\AppData\Local\Temp\2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Users\Admin\AppData\Local\Victoria Pigments\victoriapigments.exe
    "C:\Users\Admin\AppData\Local\Victoria Pigments\victoriapigments.exe" -i
    3⤵
    - Executes dropped EXE
    PID:5028
- - C:\Users\Admin\AppData\Local\Victoria Pigments\victoriapigments.exe
    "C:\Users\Admin\AppData\Local\Victoria Pigments\victoriapigments.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-CDD80.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CDD80.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b6f11a0ab7715f570f45900a1fe84732

SHA1
77b1201e535445af5ea94c1b03c0a1c34d67a77b

SHA256
e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67

SHA512
78a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GKH10.tmp\2d39680f84ce6f139d7026f95e728d091010899fb4e92f604e8f16da85f79d08.tmp

Filesize
677KB

MD5
867ec633824be260b8392cbfbbd3232b

SHA1
b840ccc4dd49bda228694dfb689174aafd0e4a62

SHA256
5446f45c97947f67e906fea075b51fe47ee075eb51faded600fdce2a4efa5f91

SHA512
679449c4d8cd77316693bfa5301dc9bda0d9aa17af4488f1ea892a4328c1b39ffc7793801a06663271722d6682313996255d5d2a5c0faff979c5e030a770a5e3

Download Submit
C:\Users\Admin\AppData\Local\Victoria Pigments\libeay32.dll

Filesize
1.9MB

MD5
876a839023b8f962a72d295da7495734

SHA1
62a7728679bc18784b1fbf1d013f7cece18cbec9

SHA256
a757d773da406411fb977761f6e56f016d48d224aedaf3d875ed4d4a9ede6158

SHA512
e1b23a2f5ec0100ff874ca075bbd0f90e9065a90fec66861f99df603d7aaa9db8e8ec326710fdc11ad41d01befe4ea3077136127acf613614d0d12ff23bec6c1

Download Submit
C:\Users\Admin\AppData\Local\Victoria Pigments\victoriapigments.exe

Filesize
2.2MB

MD5
e7659622ed76da0fcbce5728e163d3a4

SHA1
fb0d91cdf160d4b57569836624ceba01c6bcb018

SHA256
90fb4530193ace27c869b620e8bd6376ae33d8d139ca93265487cccdc42bc3f7

SHA512
1f652a3c905c244d8b2d2782d410a485e22fd8cc2790b1067e2b63b73bd89a9efe57c471f3f64c56a568eccba3704a90d946458b2d40bdddc64b7641b18104b8

Download Submit
memory/1572-76-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/1572-16-0x0000000000400000-0x00000000004B8000-memory.dmp

Filesize
736KB

Download
memory/2176-106-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-112-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-124-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-121-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-117-0x0000000002490000-0x0000000002532000-memory.dmp

Filesize
648KB

Download
memory/2176-74-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-116-0x0000000002490000-0x0000000002532000-memory.dmp

Filesize
648KB

Download
memory/2176-115-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-77-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-80-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-83-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-86-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-89-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-92-0x0000000002490000-0x0000000002532000-memory.dmp

Filesize
648KB

Download
memory/2176-95-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-100-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-103-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2176-109-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/2504-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2504-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2504-75-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5028-66-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/5028-65-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/5028-69-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download
memory/5028-70-0x0000000000400000-0x000000000062D000-memory.dmp

Filesize
2.2MB

Download

Analysis

Sharing