socks5systemz | 42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164

General

Target

42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.exe
Size

5.1MB
MD5

61c7109a0bf03ebb161b4e3eddba5a82
SHA1

c8b5b7871f85a9b79a6d0d5b3787613eaa1baaa7
SHA256

42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164
SHA512

27c4f041359f325a456b48d316a74a51a6f499141e28cff65d8070935c351161414e5ba7d320a6af7d9eb7903ac9079aad86e071b9a71f16429b70f3639d84ea
SSDEEP

98304:Cg0iRwL9Hvp2cNFeRHQ2Ss6jPlnhNqE2t7V6JlS9rTSw/mga5R+6H525akOHQxY4:fZRqxvp1NFSw86jPlnxg6JAUw/mga50L

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

C2

bepipfi.com

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1596-86-0x0000000000A60000-0x0000000000B02000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp
3436	wavmp3splitter.exe
1596	wavmp3splitter.exe

Loads dropped DLL 1 IoCs

pid	Process
2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp

Unexpected DNS network traffic destination 3 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214
Destination IP	141.98.234.31
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2544	2660	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.exe	77
PID 2660 wrote to memory of 2544	2660	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.exe	77
PID 2660 wrote to memory of 2544	2660	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.exe	77
PID 2544 wrote to memory of 3436	2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp	78
PID 2544 wrote to memory of 3436	2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp	78
PID 2544 wrote to memory of 3436	2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp	78
PID 2544 wrote to memory of 1596	2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp	79
PID 2544 wrote to memory of 1596	2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp	79
PID 2544 wrote to memory of 1596	2544	42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp	79

C:\Users\Admin\AppData\Local\Temp\42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.exe
"C:\Users\Admin\AppData\Local\Temp\42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Users\Admin\AppData\Local\Temp\is-TJ74J.tmp\42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-TJ74J.tmp\42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp" /SL5="$60206,5072493,54272,C:\Users\Admin\AppData\Local\Temp\42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2544
- - C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter.exe
    "C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter.exe" -i
    3⤵
    - Executes dropped EXE
    PID:3436
- - C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter.exe
    "C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Direct WAV MP3 Splitter\wavmp3splitter.exe

Filesize
3.3MB

MD5
899fe185b3bd22efa6f0655b8bda57eb

SHA1
e16511d3704bd268211bf40cd68732bd5c3ba662

SHA256
2e87e88efba878bcc1ef9f5eee95cfb8975a523ef957b02efd55d16edf00a9a4

SHA512
f84b41d04bbc7e35f496452d9df26f4e3849a8ca5cab38ccefe4251ff3f2dc1b02e0ab46e9fcd1ee12e0994423770039bbe3c5db965d6c728f19c0d9d32f1b87

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-B5VG1.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-TJ74J.tmp\42d99fbd9cd6141249a718e19374e415b92e900aac020cf9bcc2daae4194d164.tmp

Filesize
680KB

MD5
29507bceeed9430e1545cb4fe0e44e1e

SHA1
bef64c7acada5408513b18b5e5c0aa6b3616b2d3

SHA256
77cf85243df8b3373ac4b3b4d5eeb883e3c9224ceda7bb27197cf134d06a9d9b

SHA512
dc6667817a978989093cc0f409629fe13addccaee6ce7e9a010c595050e79eb2d43aad73c747c87ee93cba523fb0c297ced7824cfccb90e26695a0d17f951863

Download Submit
memory/1596-90-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-76-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-117-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-114-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-111-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-108-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-105-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-69-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-68-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-102-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-99-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-72-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-75-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-96-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-79-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-82-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-85-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/1596-86-0x0000000000A60000-0x0000000000B02000-memory.dmp

Filesize
648KB

Download
memory/2544-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2544-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2660-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2660-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2660-3-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3436-63-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/3436-65-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/3436-60-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download
memory/3436-59-0x0000000000400000-0x0000000000754000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing