socks5systemz | dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9

General

Target

dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.exe
Size

6.3MB
MD5

58fb0a8360064b3f103c5df3f8bb7769
SHA1

ef677eb1a910bd750ea3b8fc05067263939ca5d7
SHA256

dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9
SHA512

42a0c89d0a252e3ca86f948afcde14cd3fcd9c60254732c44595f69c01af5086aa28519b9cc383ef93e2c1f8e79ef1d1a23418d12a834343a12b6761c4bb1017
SSDEEP

196608:Sr7GCqsMKcAcUCkH+1E29iuTD5TAy5YXK:SrCCVhcgClE2sQD5TA8X

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3476-88-0x0000000000B80000-0x0000000000C22000-memory.dmp	family_socks5systemz
behavioral2/memory/3476-112-0x0000000000B80000-0x0000000000C22000-memory.dmp	family_socks5systemz
behavioral2/memory/3476-113-0x0000000000B80000-0x0000000000C22000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp
1984	consoledictaphone32.exe
3476	consoledictaphone32.exe

Loads dropped DLL 1 IoCs

pid	Process
2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2668	2108	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.exe	78
PID 2108 wrote to memory of 2668	2108	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.exe	78
PID 2108 wrote to memory of 2668	2108	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.exe	78
PID 2668 wrote to memory of 1984	2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp	79
PID 2668 wrote to memory of 1984	2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp	79
PID 2668 wrote to memory of 1984	2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp	79
PID 2668 wrote to memory of 3476	2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp	80
PID 2668 wrote to memory of 3476	2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp	80
PID 2668 wrote to memory of 3476	2668	dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp	80

C:\Users\Admin\AppData\Local\Temp\dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.exe
"C:\Users\Admin\AppData\Local\Temp\dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\is-G5QGH.tmp\dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-G5QGH.tmp\dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp" /SL5="$8006E,6307168,54272,C:\Users\Admin\AppData\Local\Temp\dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2668
- - C:\Users\Admin\AppData\Local\Console Dictaphone\consoledictaphone32.exe
    "C:\Users\Admin\AppData\Local\Console Dictaphone\consoledictaphone32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:1984
- - C:\Users\Admin\AppData\Local\Console Dictaphone\consoledictaphone32.exe
    "C:\Users\Admin\AppData\Local\Console Dictaphone\consoledictaphone32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Console Dictaphone\consoledictaphone32.exe

Filesize
4.6MB

MD5
bfbdbddf9d2c5f75e53f9182321b56c8

SHA1
075166352d1aa859b1a068a51d138785416ab7fa

SHA256
625d4a0c9824db1c5e7c1bb84fb1a684a3ef590054678f3a771338c4460ac396

SHA512
9ec7d073b5c87b3e79ccbfa66ef1a5d7f8c2952d821d44e2ae056b17a07f48b56309da52d26a5e52d5da0df263eb184c9aaae046cd47677f4b80eaf395fdc45f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9LTMU.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-G5QGH.tmp\dcb7d4a78a30a019fc400f6fd6f47c587da5a4d383ae5c28240ea027b5283fd9.tmp

Filesize
680KB

MD5
4aac57fdd75674c8c798a8812b037086

SHA1
7f6c953d611d6e2ec909e420bf6206dd1cb0c1e3

SHA256
de805ad00d9ec55435280fcc07bf0bd5746836ebf2a519845c6cf303f82395c5

SHA512
7e204e7ddbdfc1d71b42f39b99a680278a978bf3a02c8a46b9273d84a2ca81af1c6d6066022d8bb337a9b62cf2479f8ac3ce844602255d12cce977d15d71a3fc

Download Submit
memory/1984-61-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/1984-65-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/1984-64-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/1984-59-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/2108-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2108-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/2108-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2668-12-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2668-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3476-76-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-91-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-72-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-75-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-68-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-79-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-82-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-85-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-88-0x0000000000B80000-0x0000000000C22000-memory.dmp

Filesize
648KB

Download
memory/3476-69-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-96-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-99-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-102-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-105-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-108-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-111-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-112-0x0000000000B80000-0x0000000000C22000-memory.dmp

Filesize
648KB

Download
memory/3476-113-0x0000000000B80000-0x0000000000C22000-memory.dmp

Filesize
648KB

Download
memory/3476-117-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download
memory/3476-120-0x0000000000400000-0x000000000089C000-memory.dmp

Filesize
4.6MB

Download

Analysis

Sharing