socks5systemz | 21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d

General

Target

21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.exe
Size

6.2MB
MD5

0048b71e4f1bf4c544777047c127bec6
SHA1

eb7fbaecb132d51b14b2987a21952120998253ec
SHA256

21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d
SHA512

6609aba1588eb50193448944be8006d0b86f3f48e8c59a68a8adc1b2d24683fa5cecc1d8e5fcd416b67805089d79a9d627302825b6e3e28c0c413f7bdc02826f
SSDEEP

196608:6GDmLfHjBAV+Biuw9qRBgv+31X1Lly1Vi/Yty86f2f5GVY:6GsHjB3Biu1BgQ1LM1Viwty86lW

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral1/memory/676-85-0x0000000000BA0000-0x0000000000C42000-memory.dmp	family_socks5systemz
behavioral1/memory/676-108-0x0000000000BA0000-0x0000000000C42000-memory.dmp	family_socks5systemz
behavioral1/memory/676-109-0x0000000000BA0000-0x0000000000C42000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp
4508	galaxymusicstudio32.exe
676	galaxymusicstudio32.exe

Loads dropped DLL 1 IoCs

pid	Process
3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 512 wrote to memory of 3396	512	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.exe	81
PID 512 wrote to memory of 3396	512	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.exe	81
PID 512 wrote to memory of 3396	512	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.exe	81
PID 3396 wrote to memory of 4508	3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp	82
PID 3396 wrote to memory of 4508	3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp	82
PID 3396 wrote to memory of 4508	3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp	82
PID 3396 wrote to memory of 676	3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp	83
PID 3396 wrote to memory of 676	3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp	83
PID 3396 wrote to memory of 676	3396	21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp	83

C:\Users\Admin\AppData\Local\Temp\21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.exe
"C:\Users\Admin\AppData\Local\Temp\21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:512
- C:\Users\Admin\AppData\Local\Temp\is-N3EBC.tmp\21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-N3EBC.tmp\21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp" /SL5="$90060,6254878,54272,C:\Users\Admin\AppData\Local\Temp\21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe
    "C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4508
- - C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe
    "C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Galaxy Music Studio\galaxymusicstudio32.exe

Filesize
4.9MB

MD5
eb14f685c6475c0b222d515e52a9efaa

SHA1
009761e8156c3960bc5019b20d8574d7d5e69198

SHA256
be7e754e6e52555a5733ca6170356531dc97bb54d434983330e8003fdf0f7c35

SHA512
f4d15736ac68fdeed37ac54401c92af1ad34b93b5ea585f0a4387e07944ef9db7c89d815e5eda6816cdcb8a94ddb42068764dc170b72703084f5959df1799e7f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-2UEMC.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-N3EBC.tmp\21db93d30bb9f1d9589a5b0da1b9bf2dd3be9f01ddcf3cc52df27324bb3dd82d.tmp

Filesize
680KB

MD5
78f695ace22daf36e34fa37782f0dd80

SHA1
4098c49735260753da510587fd946153ce2c2001

SHA256
0395db2b5a63eaed214bd1d2831931bfc5621f136567254c82fcc02821e26f30

SHA512
6def356098859e3fb2806126e6515a1e76a9efb8c95edbf53f8b6fef41302a77a9f791a4b3bec08fae82693c7f77192161aacd7a66c22043a520cb8aa14c3861

Download Submit
memory/512-68-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/512-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/512-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/676-95-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-98-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-116-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-113-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-67-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-109-0x0000000000BA0000-0x0000000000C42000-memory.dmp

Filesize
648KB

Download
memory/676-108-0x0000000000BA0000-0x0000000000C42000-memory.dmp

Filesize
648KB

Download
memory/676-70-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-73-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-76-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-79-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-82-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-85-0x0000000000BA0000-0x0000000000C42000-memory.dmp

Filesize
648KB

Download
memory/676-87-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-92-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-107-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-104-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/676-101-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/3396-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3396-69-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4508-60-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/4508-59-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/4508-64-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download
memory/4508-63-0x0000000000400000-0x00000000008E9000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing