Overview

overview

10

Static

static

3

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    5d252b6a4b2ce5be7200b0f8d6b88e0d75718d9758e7c8bee23606e8b8371f7a

  • Size

    5.3MB

  • Sample

    240522-bz66zsgb74

  • MD5

    d40f8851f63e3cd69092676b283e8f50

  • SHA1

    a521b7a5906b02cdb4586d2b2dfc1941f008ef69

  • SHA256

    5d252b6a4b2ce5be7200b0f8d6b88e0d75718d9758e7c8bee23606e8b8371f7a

  • SHA512

    9b9b7f4271c862e2639e7578d46a857866f6bcd423c466e6cfd50ab05b18d6a3dd0d9ecea2c2a0434f870415735049a0a1cc1b59d3cc13b40fa86269de3e0a08

  • SSDEEP

    98304:m1HVzfed7+GQ/rwxU3HxdkQ0+h1KH8Q6VUQQSeZn2i2:azfedWkIkQ0dcRVfXwn2i2

Score
10/10
socks5systemzbotnetdiscovery

Malware Config

Targets

    • Target

      5d252b6a4b2ce5be7200b0f8d6b88e0d75718d9758e7c8bee23606e8b8371f7a

    • Size

      5.3MB

    • MD5

      d40f8851f63e3cd69092676b283e8f50

    • SHA1

      a521b7a5906b02cdb4586d2b2dfc1941f008ef69

    • SHA256

      5d252b6a4b2ce5be7200b0f8d6b88e0d75718d9758e7c8bee23606e8b8371f7a

    • SHA512

      9b9b7f4271c862e2639e7578d46a857866f6bcd423c466e6cfd50ab05b18d6a3dd0d9ecea2c2a0434f870415735049a0a1cc1b59d3cc13b40fa86269de3e0a08

    • SSDEEP

      98304:m1HVzfed7+GQ/rwxU3HxdkQ0+h1KH8Q6VUQQSeZn2i2:azfedWkIkQ0dcRVfXwn2i2

    Score
    10/10
    socks5systemzbotnetdiscovery

    • Detect Socks5Systemz Payload

    • Socks5Systemz

      Socks5Systemz is a botnet written in C++.

      botnetsocks5systemz

    • Executes dropped EXE

    • Loads dropped DLL

    • Unexpected DNS network traffic destination

      Network traffic to other servers than the configured DNS servers was detected on the DNS port.

    • Checks installed software on the system

      Looks up Uninstall key entries in the registry to enumerate software on the system.

      discovery
    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks