socks5systemz | 02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18

General

Target

02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.exe
Size

5.1MB
MD5

258cb65b2b0594931af16a2e2e4f8df6
SHA1

1693fe87579d44cb180b5b0f6dfaaf6b51488b75
SHA256

02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18
SHA512

ab6cf6385574fb646e27928eef209b9cb4cc432870e7d736dfef2414e0887d3b787c1fc7ce98b98ddf80b2c7686a990eceb18bee522f9e6c79058c053dc55e32
SSDEEP

98304:C3FRIuPPqB12guaOw/+UTBFKD3g4ZnX3HoK74bLa3+EC9iV4orr4dhTsQx2Yy:nu3qBwguaf+iBFLSYh+CG+iQAYy

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2356-85-0x0000000002590000-0x0000000002632000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp
4248	3gpvideoconverter32_64.exe
2356	3gpvideoconverter32_64.exe

Loads dropped DLL 1 IoCs

pid	Process
5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 5072	724	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.exe	85
PID 724 wrote to memory of 5072	724	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.exe	85
PID 724 wrote to memory of 5072	724	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.exe	85
PID 5072 wrote to memory of 4248	5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp	89
PID 5072 wrote to memory of 4248	5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp	89
PID 5072 wrote to memory of 4248	5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp	89
PID 5072 wrote to memory of 2356	5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp	90
PID 5072 wrote to memory of 2356	5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp	90
PID 5072 wrote to memory of 2356	5072	02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp	90

C:\Users\Admin\AppData\Local\Temp\02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.exe
"C:\Users\Admin\AppData\Local\Temp\02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:724
- C:\Users\Admin\AppData\Local\Temp\is-IG1J1.tmp\02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-IG1J1.tmp\02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp" /SL5="$401F4,5121635,54272,C:\Users\Admin\AppData\Local\Temp\02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:5072
- - C:\Users\Admin\AppData\Local\3GP Video Converter\3gpvideoconverter32_64.exe
    "C:\Users\Admin\AppData\Local\3GP Video Converter\3gpvideoconverter32_64.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4248
- - C:\Users\Admin\AppData\Local\3GP Video Converter\3gpvideoconverter32_64.exe
    "C:\Users\Admin\AppData\Local\3GP Video Converter\3gpvideoconverter32_64.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\3GP Video Converter\3gpvideoconverter32_64.exe

Filesize
3.7MB

MD5
8693d031b3b4b48c267220e988bb86f1

SHA1
f937a95ae3bc9238d003c92b346163b9b0800f10

SHA256
32e10386250b42d2d6eae2ce7e2693e32cbe709bbfe698adca444a9da94615d3

SHA512
e5e2b37318b814de1fb496b4ece12298ec9efa923108dd051b18897c0dba95923fa731738141f2155b2f643135d49dd0c10e5431dc5472e82b8d1eb6f87be328

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-IG1J1.tmp\02a6d61c9cebf8c920cc07d34236c7414e495ee2a63702dac6d0f521c4c0af18.tmp

Filesize
680KB

MD5
2a166cf3f79bcdcd09875b6471f465c4

SHA1
cc784af9f1a9ecfd75194c1ed7d6123aecf4d96e

SHA256
ab5cd059d2aea8797684ef8d084e595d990c0940ddf28d7af5d35667fec34961

SHA512
9f3706f79ddd40501b5d63db893ad63086b20be8e5f53ba6a80fad3dc5904eba9711898fd8f7e1b576874a676d4de3a3f257dbe1328f2720fd70aac13a5d46c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-V6TU8.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/724-68-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/724-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/724-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2356-89-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-85-0x0000000002590000-0x0000000002632000-memory.dmp

Filesize
648KB

Download
memory/2356-113-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-67-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-110-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-107-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-70-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-73-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-76-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-79-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-82-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-104-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-101-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-92-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-95-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/2356-98-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/4248-62-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/4248-60-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/4248-64-0x0000000000400000-0x00000000007B3000-memory.dmp

Filesize
3.7MB

Download
memory/5072-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/5072-69-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing