socks5systemz

General

Target

815c265c42f5b5739bd5452fc7f510475e2f5c6e4b0a7859729a9148e2e7a73f
Size

4.9MB
Sample

240613-3eh27svfle
MD5

e4f160d5a875eaf0507cf823b7420504
SHA1

1a9dc94c7807d726d8ebee79ec6dd6e255143909
SHA256

815c265c42f5b5739bd5452fc7f510475e2f5c6e4b0a7859729a9148e2e7a73f
SHA512

05c83d7e820e23ec5f3c482393280d6e58830f1a252895615b04f5092b2844141d0fbf144d924193af07fad2c531a4e0a7b1f55f31e90da22d8d5b3322400ba3
SSDEEP

98304:m9EwqN6LJfqQFcNCqaAipTw7ge3ZVb1fePK5TquDNy/HhG2P5Me:9wqN6LrFcCzXKZZ1fekTLD8JGI/

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

bnalyom.com

http://bnalyom.com/search/?q=67e28dd8690cfb204406a51a7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa49e8889b5e4fa9281ae978fe71ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b52966923a6f8dfd10c2ef90

bgbveih.com

http://bgbveih.com/search/?q=67e28dd86809f27b415ba51b7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa1de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff712c2ee979a3a

Targets

- Target
  
  815c265c42f5b5739bd5452fc7f510475e2f5c6e4b0a7859729a9148e2e7a73f
- Size
  
  4.9MB
- MD5
  
  e4f160d5a875eaf0507cf823b7420504
- SHA1
  
  1a9dc94c7807d726d8ebee79ec6dd6e255143909
- SHA256
  
  815c265c42f5b5739bd5452fc7f510475e2f5c6e4b0a7859729a9148e2e7a73f
- SHA512
  
  05c83d7e820e23ec5f3c482393280d6e58830f1a252895615b04f5092b2844141d0fbf144d924193af07fad2c531a4e0a7b1f55f31e90da22d8d5b3322400ba3
- SSDEEP
  
  98304:m9EwqN6LJfqQFcNCqaAipTw7ge3ZVb1fePK5TquDNy/HhG2P5Me:9wqN6LrFcCzXKZZ1fekTLD8JGI/
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2