socks5systemz | cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3

General

Target

cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.exe
Size

4.9MB
MD5

81ea90ff56262cc8372cd8917008887f
SHA1

b7c5afa8459587348c5b9bf49220bca47a291788
SHA256

cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3
SHA512

a755c69109fa3ee588bd22bbfcf458e4555b27b7115e9697dbd39e1fe64d23398111b3c5206632d265b2e6dc3f9673d8fcb2ea49065b8a212195c3a84fbc5d1e
SSDEEP

98304:mc6I8idG6BZJ2lTOquzmz/aNn+/hq4c5swpXCsFkhe+0giKHWDbXsk:pAidPlqgzmzyEZq4c5s1su/0giKHW/8k

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

csjugtn.net

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4976-87-0x0000000000960000-0x0000000000A02000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmpaudialstunebite32_64.exeaudialstunebite32_64.exe

pid process

852 cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp
4864 audialstunebite32_64.exe
4976 audialstunebite32_64.exe
Loads dropped DLL 1 IoCs

Processes:

cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp

pid process

852 cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp
Unexpected DNS network traffic destination 3 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 45.155.250.90
Destination IP 152.89.198.214
Destination IP 91.211.247.248
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp

pid process

852 cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp

pid	process
852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp
4864	audialstunebite32_64.exe
4976	audialstunebite32_64.exe

pid	process
852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp

description	ioc
Destination IP	45.155.250.90
Destination IP	152.89.198.214
Destination IP	91.211.247.248

pid	process
852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.execbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp

description	pid	process	target process
PID 1468 wrote to memory of 852	1468	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.exe	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp
PID 1468 wrote to memory of 852	1468	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.exe	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp
PID 1468 wrote to memory of 852	1468	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.exe	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp
PID 852 wrote to memory of 4864	852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp	audialstunebite32_64.exe
PID 852 wrote to memory of 4864	852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp	audialstunebite32_64.exe
PID 852 wrote to memory of 4864	852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp	audialstunebite32_64.exe
PID 852 wrote to memory of 4976	852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp	audialstunebite32_64.exe
PID 852 wrote to memory of 4976	852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp	audialstunebite32_64.exe
PID 852 wrote to memory of 4976	852	cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp	audialstunebite32_64.exe

C:\Users\Admin\AppData\Local\Temp\cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.exe
"C:\Users\Admin\AppData\Local\Temp\cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1468

C:\Users\Admin\AppData\Local\Temp\is-PAI6U.tmp\cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp
"C:\Users\Admin\AppData\Local\Temp\is-PAI6U.tmp\cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp" /SL5="$4021A,4838203,54272,C:\Users\Admin\AppData\Local\Temp\cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Audials Tunebite\audialstunebite32_64.exe
"C:\Users\Admin\AppData\Local\Audials Tunebite\audialstunebite32_64.exe" -i
3⤵
- Executes dropped EXE
PID:4864

C:\Users\Admin\AppData\Local\Audials Tunebite\audialstunebite32_64.exe
"C:\Users\Admin\AppData\Local\Audials Tunebite\audialstunebite32_64.exe" -s
3⤵
- Executes dropped EXE
PID:4976

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Audials Tunebite\audialstunebite32_64.exe
Filesize
2.4MB

MD5
ab523f337c2ddea268aa72091a3225b9

SHA1
caf511ef7375ccd96c2b8aa6efb8fd7d65c5dadc

SHA256
80261ef2dbe4b8fbb27ae0f36aff4b5aee82d7909aa985399a5954d7eb3e542e

SHA512
5426ad3fbe438ef82356674f6ac0b1ce2a960009d9c2a34086874997feadb84473d1ec2b1a625bcb2901b907386c6734483da77618ce548efb6c3ac36f16a150

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4T21R.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-PAI6U.tmp\cbd3b5a0d06e58a8278d96d38d27437e9c982b2d772b415c05ca0ab3de62d0e3.tmp
Filesize
680KB

MD5
9c0c87dbb79871a4914149cd5acefbf8

SHA1
35627d4c709114e03240747deb05d154743ccb59

SHA256
0b29aab1bdbef4c1435541320b77e3a47d063f2cb0657018a918907d8ede18bf

SHA512
6608bfbf67b572584cd068ca60eb71fa972384f7c3cfa87011e82e5c15cb10332d4dcc6db23fc3153104dd635e6b2eb9e27d6eb08a07f4a396b04757a20080bd

Download Submit
memory/852-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/852-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1468-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1468-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/1468-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4864-59-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4864-61-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4864-63-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4864-65-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-72-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-90-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-69-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-74-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-76-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-79-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-82-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-85-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-87-0x0000000000960000-0x0000000000A02000-memory.dmp

Filesize
648KB

Download
memory/4976-68-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-96-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-99-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-102-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-105-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-108-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-111-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-114-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download
memory/4976-117-0x0000000000400000-0x0000000000666000-memory.dmp

Filesize
2.4MB

Download

Analysis

Sharing