socks5systemz | ed0a2b75c68af8b3aac53a23bc8567b60af2618eb31e259884ec7f3dbe979450

General

Target

f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.exe
Size

5.9MB
MD5

92bfec483f66ffb7f39664711b0180a5
SHA1

2df518a3a31c820e5358fc397e25e7cef8fa608c
SHA256

f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16
SHA512

f0d583e3c1abddfd76b4ac2cdea99379f4ebc61942ab51d942aa2fa68feab55233dcade49bbb4a5e6c049414c9ff4507fbf35e9629743fc1d79f7ae72a6c9e71
SSDEEP

98304:CWHIwoMKV8W9pvrIuyyJ9B7zEvE2V7XhYJSzL/XTleTFwpFBLuIuOzRD70QxZ:3otZ8W9dtxzEvZ9hY2L/XTCFw/rbYQb

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/4952-93-0x0000000000980000-0x0000000000A22000-memory.dmp	family_socks5systemz
behavioral2/memory/4952-116-0x0000000000980000-0x0000000000A22000-memory.dmp	family_socks5systemz
behavioral2/memory/4952-115-0x0000000000980000-0x0000000000A22000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp
864	djpromix.exe
4952	djpromix.exe

Loads dropped DLL 3 IoCs

pid	Process
1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp
1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp
1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1836	5052	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.exe	84
PID 5052 wrote to memory of 1836	5052	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.exe	84
PID 5052 wrote to memory of 1836	5052	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.exe	84
PID 1836 wrote to memory of 864	1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp	86
PID 1836 wrote to memory of 864	1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp	86
PID 1836 wrote to memory of 864	1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp	86
PID 1836 wrote to memory of 4952	1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp	87
PID 1836 wrote to memory of 4952	1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp	87
PID 1836 wrote to memory of 4952	1836	f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp	87

C:\Users\Admin\AppData\Local\Temp\f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.exe
"C:\Users\Admin\AppData\Local\Temp\f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\is-6QIDQ.tmp\f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-6QIDQ.tmp\f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp" /SL5="$8004E,5917763,54272,C:\Users\Admin\AppData\Local\Temp\f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1836
- - C:\Users\Admin\AppData\Local\DJ Pro Mix\djpromix.exe
    "C:\Users\Admin\AppData\Local\DJ Pro Mix\djpromix.exe" -i
    3⤵
    - Executes dropped EXE
    PID:864
- - C:\Users\Admin\AppData\Local\DJ Pro Mix\djpromix.exe
    "C:\Users\Admin\AppData\Local\DJ Pro Mix\djpromix.exe" -s
    3⤵
    - Executes dropped EXE
    PID:4952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\DJ Pro Mix\djpromix.exe

Filesize
3.7MB

MD5
4698476f7a19c7734a41c96ed8733ea4

SHA1
73d47a54b0e7589f73433ccd2b6223f5fc57b966

SHA256
16473cd5055f3dd677d294a1689ddaaf8077fc444ae1ebb00c6bbf7515712957

SHA512
08a619a7d04754def2fdd0986eb3daa4ef3a71bf521934939800d63e04110043eb4ba32b969a3747e3208148f77eccaba61408cb939d68f54562837c2f2bff05

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-6QIDQ.tmp\f85cfee6e5aaf84b1e0a5517c4f70dcc70a2fc98e39c5f06b9d33f2d309cfa16.tmp

Filesize
680KB

MD5
97698f52cbbd53f4e7b7a5e20c0b9b3a

SHA1
0dd4310d26abc28192a781fd6b44aeb9aee7e1a1

SHA256
918fbeaefd2641a57735037bdda4a4abe6427ebcf67d8e0a11f254b5306348c9

SHA512
4b067ea8b341a10d33378c2560041aaa9f7e80ae08bfb18260cdcdac17bdd0c2f4c044c8e184651c9b6fe7af8ec50d5521d9470abb9bb9f4788fd5a65799bb5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RSV36.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-RSV36.tmp\_isetup\_isdecmp.dll

Filesize
13KB

MD5
a813d18268affd4763dde940246dc7e5

SHA1
c7366e1fd925c17cc6068001bd38eaef5b42852f

SHA256
e19781aabe466dd8779cb9c8fa41bbb73375447066bb34e876cf388a6ed63c64

SHA512
b310ed4cd2e94381c00a6a370fcb7cc867ebe425d705b69caaaaffdafbab91f72d357966916053e72e68ecf712f2af7585500c58bb53ec3e1d539179fcb45fb4

Download Submit
memory/864-70-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/864-66-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/864-67-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/864-69-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/1836-75-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1836-10-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4952-80-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-111-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-123-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-120-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-76-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-79-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-115-0x0000000000980000-0x0000000000A22000-memory.dmp

Filesize
648KB

Download
memory/4952-83-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-86-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-89-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-92-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-93-0x0000000000980000-0x0000000000A22000-memory.dmp

Filesize
648KB

Download
memory/4952-99-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-102-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-105-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-108-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-73-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-114-0x0000000000400000-0x00000000007BC000-memory.dmp

Filesize
3.7MB

Download
memory/4952-116-0x0000000000980000-0x0000000000A22000-memory.dmp

Filesize
648KB

Download
memory/5052-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/5052-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/5052-74-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download

Analysis

Sharing