socks5systemz | 928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd

Analysis

max time kernel
146s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
02/06/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.exe
Size 6.8MB
Sample240602-mlqsmabc66
SHA256 928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd
MD5 4433490e1e6d69766b84ef21c16a27a1
SHA1 6ab521a3b16994142a080fc0ad5fd277c6f71ca4
SHA512 bbc128e09dee8516dd3e875bae8468f6a81ed164da185c171bbeca836eea01b778d018f54675fc39d497861ef7b3dc54d1d7c34e86982b8cbe952acbbd659e1b
SSDEEP 196608:iuCfe0jumr7wOGwPVxz9N8Rul80ayB87wGhNi:8fTufOGsz9SQ80aC8hvi
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socks5systemz botnet discovery

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1952-90-0x0000000000C20000-0x0000000000CC2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp
4884	voicechangeremerald32.exe
1952	voicechangeremerald32.exe

Loads dropped DLL 3 IoCs

pid	Process
1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp
1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp
1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1000 wrote to memory of 1004	1000	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.exe	77
PID 1000 wrote to memory of 1004	1000	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.exe	77
PID 1000 wrote to memory of 1004	1000	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.exe	77
PID 1004 wrote to memory of 4884	1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp	78
PID 1004 wrote to memory of 4884	1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp	78
PID 1004 wrote to memory of 4884	1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp	78
PID 1004 wrote to memory of 1952	1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp	79
PID 1004 wrote to memory of 1952	1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp	79
PID 1004 wrote to memory of 1952	1004	928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp	79

C:\Users\Admin\AppData\Local\Temp\928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.exe
"C:\Users\Admin\AppData\Local\Temp\928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1000
- C:\Users\Admin\AppData\Local\Temp\is-V6RNP.tmp\928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-V6RNP.tmp\928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp" /SL5="$B020A,6868754,54272,C:\Users\Admin\AppData\Local\Temp\928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe
    "C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4884
- - C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe
    "C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

_iscrypt.dll

Path C:\Users\Admin\AppData\Local\Temp\is-C20B1.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_isdecmp.dll

Path C:\Users\Admin\AppData\Local\Temp\is-C20B1.tmp\_isetup\_isdecmp.dll
Size 13KB
SHA256 e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64
MD5 a813d18268affd4763dde940246dc7e5
SHA1 c7366e1fd925c17cc6068001bd38eaef5b42852f
SHA512 b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4
SSDEEP 384:BXvhMwoSitz/bjx7yxnbdn+EHvbsHoOODCg:BZ7FEAbd+EDsIO
MD5 SHA1 SHA512 SSDEEP

Submit Download

928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-V6RNP.tmp\928c3d92999c4a1181412f0d598c32b8fdaf318c85b8d7e7f7c6f83c3c5296cd.tmp
Size 680KB
SHA256 97a6065b69d768920dcc6242da693217222539669f2ab1c4d06c18f21e155d6d
MD5 fbcb506d09af77715d142e5d621af9e8
SHA1 6f3ca342f27f7cdd377b8347df476343bd56b9d0
SHA512 697cb3118238ca5a38add4304aee42fc2761d531b07d7d68d767409da5536b91b7b156a29fa83e382027cb439d492522edb0405f56946dabe22f24de777bf071
SSDEEP 12288:L0QfKb7nH5lrPo37AzHTA63I0ihE4UEQrrNtIECORGvp5ELAfXExy8:ffKbT5lrPo37AzHTA63/cfU9IEUp53f0
MD5 SHA1 SHA512 SSDEEP

Submit Download

voicechangeremerald32.exe

Path C:\Users\Admin\AppData\Local\Voice Changer Emerald\voicechangeremerald32.exe
Size 4.6MB
SHA256 0ee26194494adb6509aef34a9df20eae13c7395d9f72bd90362292f982a94e75
MD5 6547c275e41a5485b7b6c12c7c98eaf8
SHA1 08a6f33a7553dfe4f47106d92607c69a0c15bed1
SHA512 256916508a5ffe4bb93dac0f1312d871524ffaa2f3ca607b5644cccb9a9d5c5867a3c8f09a76694870f71aec3b5317334029b7067928e35689ca9337ac6a6991
SSDEEP 98304:aUvumItxdjZu1prysFBcZ3T5s0Bg8fpDeyhzEGUi:HuZSs8BO3T5BBZ1vUi
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1000-73-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1000-3-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/1000-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1004-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1004-74-0x0000000000400000-0x00000000004BA000-memory.dmp

Download

memory/1952-75-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-92-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-119-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-116-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-78-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-81-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-84-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-87-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-90-0x0000000000C20000-0x0000000000CC2000-memory.dmp

Download

memory/1952-113-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-97-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-100-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-103-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-106-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/1952-109-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/4884-69-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/4884-65-0x0000000000400000-0x000000000089F000-memory.dmp

Download

memory/4884-68-0x0000000000400000-0x000000000089F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads