socks5systemz | 2f145aa84376fb1c39f3026a8e7fa62841188f92a7b4af0926df217347c7102f

General

Target

7b9f684059e6b84764f01b64c45eb828.exe
Size

6.3MB
MD5

7b9f684059e6b84764f01b64c45eb828
SHA1

88f3aaf332bdc1ed1e6870d757b07ed9c3f47c4b
SHA256

2f145aa84376fb1c39f3026a8e7fa62841188f92a7b4af0926df217347c7102f
SHA512

577c5fcc9a2c9e518f7babf33d7ec951917a8d59a4dbe7ea626f9b13f6981125b00d0a94abec6a365b2eaa479ceb3dbbce0e46f6294cd1d44aeb10c6b2c649ea
SSDEEP

98304:mvGoTQdSVyjcSk+o55e4sknnO03fMmazTUW5bjqvG8N/1HAJsT6sGeP14H1633i:docdSVT3PnZfVazTUuCtB1Cs1GeiVA3i

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2824-95-0x0000000002710000-0x00000000027B2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2696	7b9f684059e6b84764f01b64c45eb828.tmp
2464	berryplayer32.exe
2824	berryplayer32.exe

Loads dropped DLL 5 IoCs

pid	Process
2492	7b9f684059e6b84764f01b64c45eb828.exe
2696	7b9f684059e6b84764f01b64c45eb828.tmp
2696	7b9f684059e6b84764f01b64c45eb828.tmp
2696	7b9f684059e6b84764f01b64c45eb828.tmp
2696	7b9f684059e6b84764f01b64c45eb828.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	45.155.250.90

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2696	7b9f684059e6b84764f01b64c45eb828.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2492 wrote to memory of 2696	2492	7b9f684059e6b84764f01b64c45eb828.exe	28
PID 2492 wrote to memory of 2696	2492	7b9f684059e6b84764f01b64c45eb828.exe	28
PID 2492 wrote to memory of 2696	2492	7b9f684059e6b84764f01b64c45eb828.exe	28
PID 2492 wrote to memory of 2696	2492	7b9f684059e6b84764f01b64c45eb828.exe	28
PID 2492 wrote to memory of 2696	2492	7b9f684059e6b84764f01b64c45eb828.exe	28
PID 2492 wrote to memory of 2696	2492	7b9f684059e6b84764f01b64c45eb828.exe	28
PID 2492 wrote to memory of 2696	2492	7b9f684059e6b84764f01b64c45eb828.exe	28
PID 2696 wrote to memory of 2464	2696	7b9f684059e6b84764f01b64c45eb828.tmp	29
PID 2696 wrote to memory of 2464	2696	7b9f684059e6b84764f01b64c45eb828.tmp	29
PID 2696 wrote to memory of 2464	2696	7b9f684059e6b84764f01b64c45eb828.tmp	29
PID 2696 wrote to memory of 2464	2696	7b9f684059e6b84764f01b64c45eb828.tmp	29
PID 2696 wrote to memory of 2824	2696	7b9f684059e6b84764f01b64c45eb828.tmp	30
PID 2696 wrote to memory of 2824	2696	7b9f684059e6b84764f01b64c45eb828.tmp	30
PID 2696 wrote to memory of 2824	2696	7b9f684059e6b84764f01b64c45eb828.tmp	30
PID 2696 wrote to memory of 2824	2696	7b9f684059e6b84764f01b64c45eb828.tmp	30

C:\Users\Admin\AppData\Local\Temp\7b9f684059e6b84764f01b64c45eb828.exe
"C:\Users\Admin\AppData\Local\Temp\7b9f684059e6b84764f01b64c45eb828.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2492
- C:\Users\Admin\AppData\Local\Temp\is-4UQF0.tmp\7b9f684059e6b84764f01b64c45eb828.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4UQF0.tmp\7b9f684059e6b84764f01b64c45eb828.tmp" /SL5="$7011E,6390727,54272,C:\Users\Admin\AppData\Local\Temp\7b9f684059e6b84764f01b64c45eb828.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2696
- - C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe
    "C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2464
- - C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe
    "C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe

Filesize
5.0MB

MD5
35216456b1ad576406a9982afbd52957

SHA1
7c811c4942be6171c4125f468ca569d4bc3da649

SHA256
0bbba052629c34a5c90806737158dc74d6fbecece292d102c68540adc9f50946

SHA512
f03187358aae223cb59f151665e4c1d9d10a0eadb80d73e64810f99a263e48ebe895606213d2eb7ca108ec809ffae816863a96f37f3bdcfdc54700ec8f8d238b

Download Submit
\Users\Admin\AppData\Local\Temp\is-3D8EL.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-3D8EL.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
\Users\Admin\AppData\Local\Temp\is-4UQF0.tmp\7b9f684059e6b84764f01b64c45eb828.tmp

Filesize
680KB

MD5
165a0d475a5c253e9800aeb6e840c81b

SHA1
aa0b69556e4e79443097f62c687431765cd34421

SHA256
279ee27cf8ac98c8c1d1535136abdd8b14a681f05dbd74a9308f62836cc3df58

SHA512
c6dbe2ceab8d58abc14c90ac4a90136ddfce1a34c29b57d1f1dc8e8515e57970da21a67a18b039eb0b15c491d1df62c3e2b9438fbfe71846a813cd877d094a3b

Download Submit
memory/2464-66-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2464-65-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2464-70-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2492-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2492-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2492-74-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2696-9-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2696-64-0x0000000005230000-0x000000000573F000-memory.dmp

Filesize
5.1MB

Download
memory/2696-79-0x0000000005230000-0x000000000573F000-memory.dmp

Filesize
5.1MB

Download
memory/2696-75-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2824-76-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-95-0x0000000002710000-0x00000000027B2000-memory.dmp

Filesize
648KB

Download
memory/2824-80-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-83-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-86-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-89-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-92-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-72-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-99-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-102-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-105-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-108-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-111-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-114-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-118-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download
memory/2824-121-0x0000000000400000-0x000000000090F000-memory.dmp

Filesize
5.1MB

Download

Analysis

Sharing