socks5systemz | 783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716

General

Target

783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.exe
Size

5.6MB
MD5

c21c10b06ba0f47db962f7458bd8e464
SHA1

a7658a05fcd8bfbb421086c12fc3bc55a34ff138
SHA256

783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716
SHA512

1a393079afcd4cb87e527c6beb8952fa13191dceda8f1c1a0376c3d7572f071a228184dafb262d7c7021d6953adcee86cc83f4ce82a2c0ba0d45484067d3e545
SSDEEP

98304:mJ+QyhtXOgysCvAisZ0argtaj2ThmtjJ4tiL/oK+rDqwZSDTiE3SdyK+J4bNy3:o+9VO9BvbFaEstCti772NmB3CP+JN3

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4156-92-0x0000000000A30000-0x0000000000AD2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp
1048	5kplayer32.exe
4156	5kplayer32.exe

Loads dropped DLL 3 IoCs

pid	Process
3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp
3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp
3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 3564	3280	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.exe	82
PID 3280 wrote to memory of 3564	3280	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.exe	82
PID 3280 wrote to memory of 3564	3280	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.exe	82
PID 3564 wrote to memory of 1048	3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp	83
PID 3564 wrote to memory of 1048	3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp	83
PID 3564 wrote to memory of 1048	3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp	83
PID 3564 wrote to memory of 4156	3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp	84
PID 3564 wrote to memory of 4156	3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp	84
PID 3564 wrote to memory of 4156	3564	783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp	84

C:\Users\Admin\AppData\Local\Temp\783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.exe
"C:\Users\Admin\AppData\Local\Temp\783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Users\Admin\AppData\Local\Temp\is-3JT4R.tmp\783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3JT4R.tmp\783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp" /SL5="$401D4,5611634,54272,C:\Users\Admin\AppData\Local\Temp\783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3564
- - C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe
    "C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:1048
- - C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe
    "C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:4156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\5K Player\5kplayer32.exe

Filesize
3.3MB

MD5
712409ef648de80b6f5831d2c93d2f14

SHA1
19a6b963be9d191012c5df082aca3e5a19854849

SHA256
71756cf2615ed001add675034ef700b598ee981ec718a908c82c25610cc27389

SHA512
aa91a100db5d9181f417f2fafa730c6eeb16f1e2252079e869638a4a6bdfa8d1b30571d30cbced274be2e6c0a4760461caddf7654ce979b899c09c0bf5e30677

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-3JT4R.tmp\783c1d97dde6a73f76e0ef316048685e822c78a455b80e9041a2cb55005ca716.tmp

Filesize
680KB

MD5
ef9105d68de970efad785e01b21e4e2b

SHA1
7fe8801a3e86814972da63a7a943bdc5e31d8888

SHA256
381198ca0669ab760f6f9b84e39c39ab5e870f65d17d03ed0dc572a1c602364a

SHA512
e388cbf32a4d833c0e4c6c1a129515b4d12eac5b333f2aec39e741d3a0da856c5923d47cf4d3083ad030f7f07b9214261b2b9119720920dd42929eeb617e779c

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L76H8.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-L76H8.tmp\_isetup\_isdecmp.dll

Filesize
32KB

MD5
b6f11a0ab7715f570f45900a1fe84732

SHA1
77b1201e535445af5ea94c1b03c0a1c34d67a77b

SHA256
e47dd306a9854599f02bc1b07ca6dfbd5220f8a1352faa9616d1a327de0bbf67

SHA512
78a757e67d21eb7cc95954df15e3eeff56113d6b40fb73f0c5f53304265cc52c79125d6f1b3655b64f9a411711b5b70f746080d708d7c222f4e65bad64b1b771

Download Submit
memory/1048-71-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/1048-65-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/1048-66-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/1048-70-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/3280-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3280-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3280-75-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3564-8-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3564-76-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4156-77-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-94-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-80-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-83-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-86-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-89-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-92-0x0000000000A30000-0x0000000000AD2000-memory.dmp

Filesize
648KB

Download
memory/4156-74-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-99-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-102-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-105-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-108-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-111-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-114-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-117-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download
memory/4156-120-0x0000000000400000-0x0000000000755000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing