socks5systemz | cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d

General

Target

cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.exe
Size

5.0MB
MD5

3faea3905a5c6ddcce696fd2a5575e42
SHA1

3f60ab107721e9bb161e480be4424aa717aac445
SHA256

cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d
SHA512

400d500d20676cc90a921ade436518670bfa57eb458fdaaec372036322d86279f5e8c5f7fcf917c6dd96e3933ef5f5292daf3cfff67330bc86723490a7c61da7
SSDEEP

98304:m3mN5kDqSCVmHjoiQFp+x2ai2Bu86vwe1ZBaEgq0m3b:+09SCgjUGs86v5Baa

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral1/memory/3748-91-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz
behavioral1/memory/3748-117-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz
behavioral1/memory/3748-118-0x00000000008B0000-0x0000000000952000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp
1400	midiplayer32.exe
3748	midiplayer32.exe

Loads dropped DLL 3 IoCs

pid	Process
2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp
2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp
2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 2076	4444	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.exe	82
PID 4444 wrote to memory of 2076	4444	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.exe	82
PID 4444 wrote to memory of 2076	4444	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.exe	82
PID 2076 wrote to memory of 1400	2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp	85
PID 2076 wrote to memory of 1400	2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp	85
PID 2076 wrote to memory of 1400	2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp	85
PID 2076 wrote to memory of 3748	2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp	87
PID 2076 wrote to memory of 3748	2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp	87
PID 2076 wrote to memory of 3748	2076	cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp	87

C:\Users\Admin\AppData\Local\Temp\cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.exe
"C:\Users\Admin\AppData\Local\Temp\cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Local\Temp\is-PLFE8.tmp\cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-PLFE8.tmp\cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp" /SL5="$6011C,4979434,54272,C:\Users\Admin\AppData\Local\Temp\cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2076
- - C:\Users\Admin\AppData\Local\Sounder Midi Player\midiplayer32.exe
    "C:\Users\Admin\AppData\Local\Sounder Midi Player\midiplayer32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:1400
- - C:\Users\Admin\AppData\Local\Sounder Midi Player\midiplayer32.exe
    "C:\Users\Admin\AppData\Local\Sounder Midi Player\midiplayer32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Sounder Midi Player\midiplayer32.exe

Filesize
2.3MB

MD5
b0eedab00147b48ab8a798e6149e72ce

SHA1
766a3eb5534657de8d78c67c262bd2414c91bc38

SHA256
b72b92181d747d3a2ed125665bf7995c01cf6ea313e95938487a4ac413121a2c

SHA512
ffc8d482900e1f466fa2c6b52d440f00617c5273f3fcd6f32fa667d01caa822cdfa231ce5c52843a2ab29beb8a896672a821dd1206b8b5e9e6ba43bf464a72d7

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BD12N.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-BD12N.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b6f11a0ab7715f570f45900a1fe84732

SHA1
77b1201e535445af5ea94c1b03c0a1c34d67a77b

SHA256
e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67

SHA512
78a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PLFE8.tmp\cf82712a16af53e4fae3f9c098f0dc224cb86034611ae74a3eaff152b801601d.tmp

Filesize
680KB

MD5
29ac48e0713a4220ff4b4b47efe542b4

SHA1
9ea8bdf5547a541b755f4b2c0bc14bf817885e94

SHA256
deead3dd651930ad0bec5d7bae647d7a1637b48bb7495593995218c4cd6dd67c

SHA512
501cdc7df40fb0cd1a114b4d5f5dcab765141c58f29bafa1e4a816319354a3d6d9e0d4b2ee5a2fad64f3fb08fb7bbdaad30551587a875f8fbdc2acdb8f67a3d4

Download Submit
memory/1400-66-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1400-65-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1400-70-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/1400-71-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/2076-77-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2076-9-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3748-81-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-113-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-74-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-125-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-122-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-78-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-118-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/3748-84-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-87-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-90-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-91-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/3748-96-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-101-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-104-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-107-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-110-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-75-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-116-0x0000000000400000-0x000000000065D000-memory.dmp

Filesize
2.4MB

Download
memory/3748-117-0x00000000008B0000-0x0000000000952000-memory.dmp

Filesize
648KB

Download
memory/4444-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4444-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4444-76-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing