socks5systemz | de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0

General

Target

de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.exe
Size

4.7MB
MD5

f2329503b1a2561bc0dd9601ec45c373
SHA1

bf581aa890089a7d251bfbc07c7ae3ca7790e0e7
SHA256

de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0
SHA512

145d9c0660a3b674eff3cbed93241709323aa534d8b32ad59200d0b04de676f0d5603ea685908b347b668eaa0564d36a7ac4081d72d6f81079e4457feeb956c7
SSDEEP

98304:miwJLaPdRnr9VD00OR0DbOlhFN4EeZOjzJyib8gH2Agx:4JLaznr9Vw0ODlhF3eCyiIgWAgx

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

buxbxyr.com

http://buxbxyr.com/search/?q=67e28dd8655bf57a4609f84c7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa48e8889b5e4fa9281ae978ff71ea771795af8e05c645db22f31dfe339426fa11a366c350adb719a9577e55b8603e983a608ff718c2e9979d3e

http://buxbxyr.com/search/?q=67e28dd8655bf57a4609f84c7c27d78406abdd88be4b12eab517aa5c96bd86ee948e44845a8bbc896c58e713bc90c91d36b5281fc235a925ed3e5cd6bd974a95129070b616e96cc92be510b866db52bee348ee4c2b14a82966836f23d7f210c7ee9d9339cb6d9113

Signatures

Detect Socks5Systemz Payload 1 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2184-82-0x00000000009D0000-0x0000000000A72000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz
Executes dropped EXE 3 IoCs

Processes:

de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmpmediaplayerrptuning.exemediaplayerrptuning.exe

pid process

3220 de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp
2580 mediaplayerrptuning.exe
2184 mediaplayerrptuning.exe
Loads dropped DLL 1 IoCs

Processes:

de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp

pid process

3220 de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp
Unexpected DNS network traffic destination 1 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.

Processes:

description ioc

Destination IP 141.98.234.31
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp

pid process

3220 de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp

pid	process
3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp
2580	mediaplayerrptuning.exe
2184	mediaplayerrptuning.exe

pid	process
3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp

description	ioc
Destination IP	141.98.234.31

pid	process
3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp

Suspicious use of WriteProcessMemory 9 IoCs

Processes:

de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.exede837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp

description	pid	process	target process
PID 4252 wrote to memory of 3220	4252	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.exe	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp
PID 4252 wrote to memory of 3220	4252	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.exe	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp
PID 4252 wrote to memory of 3220	4252	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.exe	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp
PID 3220 wrote to memory of 2580	3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp	mediaplayerrptuning.exe
PID 3220 wrote to memory of 2580	3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp	mediaplayerrptuning.exe
PID 3220 wrote to memory of 2580	3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp	mediaplayerrptuning.exe
PID 3220 wrote to memory of 2184	3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp	mediaplayerrptuning.exe
PID 3220 wrote to memory of 2184	3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp	mediaplayerrptuning.exe
PID 3220 wrote to memory of 2184	3220	de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp	mediaplayerrptuning.exe

C:\Users\Admin\AppData\Local\Temp\de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.exe
"C:\Users\Admin\AppData\Local\Temp\de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4252

C:\Users\Admin\AppData\Local\Temp\is-NRGP4.tmp\de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp
"C:\Users\Admin\AppData\Local\Temp\is-NRGP4.tmp\de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp" /SL5="$601EA,4709342,54272,C:\Users\Admin\AppData\Local\Temp\de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3220

C:\Users\Admin\AppData\Local\Media Player RPTuning\mediaplayerrptuning.exe
"C:\Users\Admin\AppData\Local\Media Player RPTuning\mediaplayerrptuning.exe" -i
3⤵
- Executes dropped EXE
PID:2580

C:\Users\Admin\AppData\Local\Media Player RPTuning\mediaplayerrptuning.exe
"C:\Users\Admin\AppData\Local\Media Player RPTuning\mediaplayerrptuning.exe" -s
3⤵
- Executes dropped EXE
PID:2184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Media Player RPTuning\mediaplayerrptuning.exe

Filesize
2.7MB

MD5
fd57dc8ba16ebf7014267be8b2827b5b

SHA1
7f36af46a89c4d3a21755213fe2479a32de0de6d

SHA256
8a297a554f3c028d309038af7d3e6fc9cf92d973bad08c2a77d51d4020e2c5dd

SHA512
8a338b226eeca2e817131846ce0bccbeb19a1f6dd2d0741a7c10400404e012d011a10e7b23c6c03b59e0c36a617158efd77a06231c9b11aae867c6e1b66e8d0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-NRGP4.tmp\de837c4609e97b7bcd878843277555afa9ba5128807b43a9634d13e15321cce0.tmp

Filesize
680KB

MD5
2883ddf6925173ecfb8e9a320997b71f

SHA1
5fabceccfcb78c09cd291f7727788b68fe4fd745

SHA256
e331e923521bb37183ec3df450330a19a138ac693fdb00ef7d6a4bfdd42c4f8d

SHA512
e8fb787977a66c5580e7dc85e1711a152bcd66fa05cfc79be4cf85eda097414bcd82945684b5f9c9126a3abcff111bf58f271bf0189ea6bc632d3126528925ba

Download Submit
\Users\Admin\AppData\Local\Temp\is-LC50H.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/2184-100-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-103-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-130-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-125-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-122-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-119-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-116-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-113-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-69-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-72-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-75-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-78-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-81-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-82-0x00000000009D0000-0x0000000000A72000-memory.dmp

Filesize
648KB

Download
memory/2184-86-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-91-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-94-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-97-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-110-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2184-106-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2580-64-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2580-61-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/2580-59-0x0000000000400000-0x00000000006B2000-memory.dmp

Filesize
2.7MB

Download
memory/3220-13-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3220-68-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4252-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4252-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4252-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing