socks5systemz | 98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de

General

Target

98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.exe
Size

4.6MB
MD5

096fe09679ed7c934d91b3cc3ac0d3a0
SHA1

c06123d0ab9e5ac243df51a106135fa301c801c2
SHA256

98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de
SHA512

49b43ac951356b2638f08031bef7cd3e47f4cf7912fcc68a6f7d724d1873fc7011b19a8baced13235fe1d48e381c3da72f273334e112cf616f49a8afc10ba6f0
SSDEEP

98304:mJp7GjWPYAiqqtTPzapo+kXp/6CBz008TlNx4XCeeWKiai9h:EaWPIJTPzapop5/6CBz008HxreHai9h

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1472-86-0x00000000009C0000-0x0000000000A62000-memory.dmp	family_socks5systemz
behavioral1/memory/1472-114-0x00000000009C0000-0x0000000000A62000-memory.dmp	family_socks5systemz
behavioral1/memory/1472-115-0x00000000009C0000-0x0000000000A62000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp
2528	cybersoundaudiodirector.exe
1472	cybersoundaudiodirector.exe

Loads dropped DLL 1 IoCs

pid	Process
1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2032 wrote to memory of 1804	2032	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.exe	85
PID 2032 wrote to memory of 1804	2032	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.exe	85
PID 2032 wrote to memory of 1804	2032	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.exe	85
PID 1804 wrote to memory of 2528	1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp	88
PID 1804 wrote to memory of 2528	1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp	88
PID 1804 wrote to memory of 2528	1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp	88
PID 1804 wrote to memory of 1472	1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp	90
PID 1804 wrote to memory of 1472	1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp	90
PID 1804 wrote to memory of 1472	1804	98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp	90

C:\Users\Admin\AppData\Local\Temp\98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.exe
"C:\Users\Admin\AppData\Local\Temp\98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2032
- C:\Users\Admin\AppData\Local\Temp\is-2DK9I.tmp\98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-2DK9I.tmp\98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp" /SL5="$501CE,4526482,54272,C:\Users\Admin\AppData\Local\Temp\98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1804
- - C:\Users\Admin\AppData\Local\CyberSound AudioDirector\cybersoundaudiodirector.exe
    "C:\Users\Admin\AppData\Local\CyberSound AudioDirector\cybersoundaudiodirector.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2528
- - C:\Users\Admin\AppData\Local\CyberSound AudioDirector\cybersoundaudiodirector.exe
    "C:\Users\Admin\AppData\Local\CyberSound AudioDirector\cybersoundaudiodirector.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\CyberSound AudioDirector\cybersoundaudiodirector.exe

Filesize
2.5MB

MD5
3d727e09d0f9f88eadc1ebc9875843e1

SHA1
eec2bfb7b7e671703e6b427ed010127a393283ce

SHA256
0b77ea2e9dd9175775275d16ba9ca62263749e1d3fa9efe5d89f79daf3cd7979

SHA512
fba0699f0e35ceb2736ad13b11488868fd4e0180403d0668191b9fac7e9421bf871c94beb6063b8052f538d42de34c1b90a6ca68ca92aea002f5f85bd20753fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2DK9I.tmp\98eeb5fae4a928d8d8a7aa6735cf5cc7a2622cd824cfac9e1abac4ce5c4390de.tmp

Filesize
680KB

MD5
2f7a10abc9ac57fe2b18ca83046154a2

SHA1
ee972fbfc5267483149cc5528ca1db2cdaa5dac8

SHA256
48d17c0a238a801ffecc3515d3e4c8ee0382b3e7eacdf30276727fd32b73bb69

SHA512
7381009f5efaf94ac4862156e78d02c00d9255dc70d7470c3e355eb471c394f765f7e50c6af3e955a7ce3337c605a026720b6b4622d5cc2d6dc0965579814992

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-B3VJP.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/1472-95-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-78-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-119-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-115-0x00000000009C0000-0x0000000000A62000-memory.dmp

Filesize
648KB

Download
memory/1472-114-0x00000000009C0000-0x0000000000A62000-memory.dmp

Filesize
648KB

Download
memory/1472-113-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-66-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-68-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-110-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-107-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-71-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-75-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-74-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-104-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-81-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-84-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-86-0x00000000009C0000-0x0000000000A62000-memory.dmp

Filesize
648KB

Download
memory/1472-90-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-101-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1472-98-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/1804-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1804-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2032-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2032-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2032-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2528-64-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/2528-60-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download
memory/2528-59-0x0000000000400000-0x0000000000686000-memory.dmp

Filesize
2.5MB

Download

Analysis

Sharing