socks5systemz | d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8

General

Target

d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.exe
Size

6.5MB
MD5

723b0c3195ef3279279726062bc06617
SHA1

270aeac63b67265e061216e8db2c692f1049b005
SHA256

d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8
SHA512

ea098d29148233bf1df6b2f7b63f77b891f425b7beab195c8b7bb611b1780de49eaa847fc2df3b3245ad6123a8254ddc6af79fea5d8f7e54bfd80b6b640a67af
SSDEEP

196608:XpzfIQt3GYrr6fWYVTNXe8in0WoRBtvNDY:ZzfIQt6fvPi0WSE

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4580-83-0x0000000000D00000-0x0000000000DA2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp
4560	berryplayer32.exe
4580	berryplayer32.exe

Loads dropped DLL 1 IoCs

pid	Process
3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 3456	4024	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.exe	73
PID 4024 wrote to memory of 3456	4024	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.exe	73
PID 4024 wrote to memory of 3456	4024	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.exe	73
PID 3456 wrote to memory of 4560	3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp	74
PID 3456 wrote to memory of 4560	3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp	74
PID 3456 wrote to memory of 4560	3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp	74
PID 3456 wrote to memory of 4580	3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp	75
PID 3456 wrote to memory of 4580	3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp	75
PID 3456 wrote to memory of 4580	3456	d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp	75

C:\Users\Admin\AppData\Local\Temp\d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.exe
"C:\Users\Admin\AppData\Local\Temp\d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Users\Admin\AppData\Local\Temp\is-NHQIJ.tmp\d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-NHQIJ.tmp\d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp" /SL5="$60226,6587823,54272,C:\Users\Admin\AppData\Local\Temp\d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe
    "C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4560
- - C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe
    "C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:4580

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Berry Player\berryplayer32.exe

Filesize
5.2MB

MD5
780838db55821bae3f3f22e574805a0a

SHA1
e0f6dc7f598df75b59e06a16088584d3a4ea4e0e

SHA256
93847a385b3f323e7d8193d6599f0d3086ae35224871e139e42e80b5f3d62926

SHA512
f10e143a1ec2a8b97e38ec2fc06d0185d393cd866ebf68b4144c49b1047afd2186df6912c59ee73dff124cf8d1153be4f0bd2167b461edf3e83c99944bcd34ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NHQIJ.tmp\d9f3cfaf9fe92e62b6c0c10d414427dd0dd9ff16c43bb2eeb53c3b876d01f5f8.tmp

Filesize
680KB

MD5
311c1ab01728e25cad4124cb6f68a2f1

SHA1
5d01c47cfefe9bf5390684076fc18129111e5138

SHA256
66e0c4091239948306890f2749f8c9af121efe1b8c9ee09b479d2e2e6a489d0b

SHA512
235b4d48aaf7f3cf01a26127f9a161a7395b8d16facd0e1ee5701fddd3ab3bd32fbeff868f0f3776d8bbebea2cfaf369006ff4deae200909c322790b7eec0ed6

Download Submit
\Users\Admin\AppData\Local\Temp\is-60EU8.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/3456-68-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3456-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4024-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4024-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4024-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4560-59-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4560-63-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4560-60-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-81-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-100-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-72-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-75-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-78-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-66-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-83-0x0000000000D00000-0x0000000000DA2000-memory.dmp

Filesize
648KB

Download
memory/4580-86-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-91-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-94-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-97-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-69-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-103-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-107-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-110-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-113-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-116-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-119-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-122-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-125-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download
memory/4580-130-0x0000000000400000-0x0000000000936000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing