socks5systemz | 88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0

General

Target

88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.exe
Size

4.7MB
MD5

367150692e2c87ea47994271590571b9
SHA1

fda29eee794961527f07488bdeb3bdab546a3d01
SHA256

88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0
SHA512

4f2539d83ee4bb55651d191f7bb93fcc8431ff5053c6f8379efc777d85def23e28609571e74211094aa0477a037043cf97e5f43438b71935662d2bd388ad9307
SSDEEP

98304:mUldqPxN+axe9D7coc9NKpIs6LLo13lty4nn2YabSXBK:1dqPxIOCcoujs6LLoJqGVaCc

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2168-82-0x0000000000860000-0x0000000000902000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp
1804	submoremediaplayer32.exe
2168	submoremediaplayer32.exe

Loads dropped DLL 1 IoCs

pid	Process
5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp

Unexpected DNS network traffic destination 2 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 5056	5064	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.exe	73
PID 5064 wrote to memory of 5056	5064	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.exe	73
PID 5064 wrote to memory of 5056	5064	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.exe	73
PID 5056 wrote to memory of 1804	5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp	74
PID 5056 wrote to memory of 1804	5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp	74
PID 5056 wrote to memory of 1804	5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp	74
PID 5056 wrote to memory of 2168	5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp	75
PID 5056 wrote to memory of 2168	5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp	75
PID 5056 wrote to memory of 2168	5056	88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp	75

C:\Users\Admin\AppData\Local\Temp\88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.exe
"C:\Users\Admin\AppData\Local\Temp\88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\is-8TTLS.tmp\88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-8TTLS.tmp\88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp" /SL5="$50236,4632475,54272,C:\Users\Admin\AppData\Local\Temp\88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5056
- - C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe
    "C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:1804
- - C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe
    "C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Submore Media Player\submoremediaplayer32.exe

Filesize
3.0MB

MD5
b51f6b22eb023f10d4bdcf39475ca2e6

SHA1
d695cf30d19b774a96cde9d75c986164431a3fcf

SHA256
cafd7a682f473521c9feb0f48d6ab0cdf8fb0fbb18f3f5b1108aebabd6164ef4

SHA512
0a1ff826bdea2cbc235799aad25c93a40f7fdb3ad8b7d5a15d14eb6304515f801b5b4aa9e603568ea697e7169fa216c988b4e15e9d38f0bec3444555efaa1f3d

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-8TTLS.tmp\88c1ee6818a2e7826f5591862fbe3732d4cc441b40ff956fa371055aa51cf5f0.tmp

Filesize
680KB

MD5
fc38d5561cb12e0d573c043f2a02587c

SHA1
85881a5502366649652ef68aa644af8eb81baf1b

SHA256
1affeed602ac019e9274932be152257f6b4dde1fee65c4d4f9b5f64bf1d758b9

SHA512
de6dc4bca4c3a6d1d178e62349d00b74cb02ab308fca25b772a1a47c669657fa5b70fe6adb971a5221da853a009822b70f0dfc64527abe3b4a13acb1f652cf31

Download Submit
\Users\Admin\AppData\Local\Temp\is-KKLOQ.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/1804-59-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/1804-63-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/1804-60-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-77-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-93-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-127-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-124-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-121-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-68-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-71-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-74-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-117-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-80-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-82-0x0000000000860000-0x0000000000902000-memory.dmp

Filesize
648KB

Download
memory/2168-85-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-90-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-114-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-96-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-99-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-102-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-105-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-108-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/2168-111-0x0000000000400000-0x0000000000701000-memory.dmp

Filesize
3.0MB

Download
memory/5056-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/5056-67-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/5064-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5064-66-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5064-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing