socks5systemz

General

Target

5a2322d7f478af9aac39e37b68082d6e7bcba23b0a1b67aa0c9ff6e3c00106f6
Size

4.8MB
Sample

240613-nqwecaxalf
MD5

05f9c3fae9b1f08fc1e5822ae61ee2c0
SHA1

87b34df6e2bc8fa45c79158e62f36d7b345fc6eb
SHA256

5a2322d7f478af9aac39e37b68082d6e7bcba23b0a1b67aa0c9ff6e3c00106f6
SHA512

30e696872205c7a588d305a9ed67cfa69aca65b7f9501ec52a0da34621bc20bd11979d3cf55079e8af7fa8052f2817817388410be33f7848e0a4f7fe936259d9
SSDEEP

98304:m55c5gU7QtFIat6Bo1NWTKWerUbbva2CLTWOwUAb+wfGDf+26c:8DU7WIaeEr8ba2CLqforJT

Score

10^/10

Malware Config

Extracted

Family

socks5systemz

C2

bwxsoel.com

http://bwxsoel.com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4ae8889b5e4fa9281ae978f471ea771795af8e05c645db22f31dfe339426fa11af66c152adb719a9577e55b8603e983a608ff713c7e7939c33

http://bwxsoel.com/search/?q=67e28dd83f08f52f150eab187c27d78406abdd88be4b12eab517aa5c96bd86e890834e96148ab2865b77f80ebad9c20f7cb63037ed2ab423a4314383ba915d911ec07bb606a0708727e40ea678c45abbe74ffb0e2807e12571c17f3e83fe16c1e7979d33cb699e

ckwliua.net

Targets

- Target
  
  5a2322d7f478af9aac39e37b68082d6e7bcba23b0a1b67aa0c9ff6e3c00106f6
- Size
  
  4.8MB
- MD5
  
  05f9c3fae9b1f08fc1e5822ae61ee2c0
- SHA1
  
  87b34df6e2bc8fa45c79158e62f36d7b345fc6eb
- SHA256
  
  5a2322d7f478af9aac39e37b68082d6e7bcba23b0a1b67aa0c9ff6e3c00106f6
- SHA512
  
  30e696872205c7a588d305a9ed67cfa69aca65b7f9501ec52a0da34621bc20bd11979d3cf55079e8af7fa8052f2817817388410be33f7848e0a4f7fe936259d9
- SSDEEP
  
  98304:m55c5gU7QtFIat6Bo1NWTKWerUbbva2CLTWOwUAb+wfGDf+26c:8DU7WIaeEr8ba2CLqforJT
Score

10^/10

socks5systemz botnet discovery
- Detect Socks5Systemz Payload
- Socks5Systemz
  Socks5Systemz is a botnet written in C++.
  botnet socks5systemz
- Executes dropped EXE
- Loads dropped DLL
- Unexpected DNS network traffic destination
  Network traffic to other servers than the configured DNS servers was detected on the DNS port.
- Checks installed software on the system
  Looks up Uninstall key entries in the registry to enumerate software on the system.
  discovery
behavioral1 behavioral2

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Tasks

Sharing

General

Malware Config

Extracted

Targets

Detect Socks5Systemz Payload

Executes dropped EXE

Loads dropped DLL

Unexpected DNS network traffic destination

Checks installed software on the system

MITRE ATT&CK Enterprise v15

Tasks

static1

behavioral1

behavioral2