socks5systemz | 2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838

General

Target

2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.exe
Size

5.6MB
MD5

756238f87c9970dca1ac53fed3da5a64
SHA1

52e1ad4e9af7a6184ca29114f9c3ae528f8f6262
SHA256

2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838
SHA512

a3955d7d54d6e01bc8d9d2f274b1d93d325aedb73783fbe27530c12d96abafc092cb4872d9c7f3f2a714239640990f957650089a6fb7e3b629af6d7770bf07ec
SSDEEP

98304:mJt00YtpO/HdCm4aqMgnl4IzmMapwEHrksPpoylfcjiAmCPFON+GQ:It00Y0HdCmDqb/yjWOktylfc+JyFU+r

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

bmbiyyu.com

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/4100-92-0x00000000025A0000-0x0000000002642000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp
4052	svomediaplayer32.exe
4100	svomediaplayer32.exe

Loads dropped DLL 3 IoCs

pid	Process
1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp
1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp
1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31
Destination IP	91.211.247.248
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 1004	4420	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.exe	82
PID 4420 wrote to memory of 1004	4420	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.exe	82
PID 4420 wrote to memory of 1004	4420	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.exe	82
PID 1004 wrote to memory of 4052	1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp	85
PID 1004 wrote to memory of 4052	1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp	85
PID 1004 wrote to memory of 4052	1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp	85
PID 1004 wrote to memory of 4100	1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp	87
PID 1004 wrote to memory of 4100	1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp	87
PID 1004 wrote to memory of 4100	1004	2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp	87

C:\Users\Admin\AppData\Local\Temp\2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.exe
"C:\Users\Admin\AppData\Local\Temp\2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\is-4RDAH.tmp\2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4RDAH.tmp\2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp" /SL5="$F006A,5624894,54272,C:\Users\Admin\AppData\Local\Temp\2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe
    "C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4052
- - C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe
    "C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe" -s
    3⤵
    - Executes dropped EXE
    PID:4100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\SVO Media Player\svomediaplayer32.exe

Filesize
3.3MB

MD5
0662834956dcdeb59638f3d41294e8f8

SHA1
30e19e3c568e832176204bb14fbf0a7304bf9507

SHA256
8cde5dfcf28a448b3db98bfdeb45a245a7acc8ddb2121a83c31288b3c7a9b46f

SHA512
025a1564a001120fed557461b39ec198649414aa1eab8bfb1094a75a6721b1de6d7844bd9b84ed975b5fd08847ec0eb5b9f9a006329ecf3e48d7dbef4a3032dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4RDAH.tmp\2ddc31f2c711b81779c9f1628ebd406df391e42877802442947bc6be5d9fe838.tmp

Filesize
680KB

MD5
5f513310dfdd2863a7925cf881b08d83

SHA1
e56ca43de148e9113a0143817d610dbff90984c8

SHA256
a1ea89d5df4a9fb1fb89d9c060df3d5e69a61d8ffde360ebd46128f55e95ff01

SHA512
c5e15e04432663c15d73a7ab2ea21f38907fe7667689702bd7914dc4b086484d985ee9d46fc4f4871b6ae48d17464cc296c18a9ac87ab2fc01dca056f07e44dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VODHA.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VODHA.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
memory/1004-76-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1004-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4052-71-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4052-65-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4052-66-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4052-69-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-77-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-92-0x00000000025A0000-0x0000000002642000-memory.dmp

Filesize
648KB

Download
memory/4100-120-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-117-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-114-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-80-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-83-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-86-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-89-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-74-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-96-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-99-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-102-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-105-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-108-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4100-111-0x0000000000400000-0x0000000000748000-memory.dmp

Filesize
3.3MB

Download
memory/4420-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4420-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4420-75-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing