socks5systemz | a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f

General

Target

a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.exe
Size

5.4MB
MD5

a41aa021dce703bdd234ebee529d695a
SHA1

1e14f4c94b6836f1337e65cee6201c892a431e6a
SHA256

a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f
SHA512

848d505df945f0efcc26875093f97cbc903dd0bbbdfab250c337117600596ea8a1fa698fa17861b6650088f156efbbb3968445205e3cdef86b9bdeedb67befa3
SSDEEP

98304:CqdsYt3c0/kNPAxFDHaVAJzVfc6oPN1M0/f6xFR/bjqzRMidFmWJM3/Ug8poEZkl:HZ3v/u4HzaVCRkhqvR/bjG1E13cJViQ2

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/1296-89-0x0000000000A10000-0x0000000000AB2000-memory.dmp	family_socks5systemz
behavioral2/memory/1296-111-0x0000000000A10000-0x0000000000AB2000-memory.dmp	family_socks5systemz
behavioral2/memory/1296-112-0x0000000000A10000-0x0000000000AB2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp
3992	wavesurgelite32_64.exe
1296	wavesurgelite32_64.exe

Loads dropped DLL 1 IoCs

pid	Process
336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 336	2768	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.exe	81
PID 2768 wrote to memory of 336	2768	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.exe	81
PID 2768 wrote to memory of 336	2768	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.exe	81
PID 336 wrote to memory of 3992	336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp	82
PID 336 wrote to memory of 3992	336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp	82
PID 336 wrote to memory of 3992	336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp	82
PID 336 wrote to memory of 1296	336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp	84
PID 336 wrote to memory of 1296	336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp	84
PID 336 wrote to memory of 1296	336	a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp	84

C:\Users\Admin\AppData\Local\Temp\a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.exe
"C:\Users\Admin\AppData\Local\Temp\a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Users\Admin\AppData\Local\Temp\is-AD9FM.tmp\a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-AD9FM.tmp\a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp" /SL5="$50272,5394086,54272,C:\Users\Admin\AppData\Local\Temp\a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:336
- - C:\Users\Admin\AppData\Local\Wave Surge Lite\wavesurgelite32_64.exe
    "C:\Users\Admin\AppData\Local\Wave Surge Lite\wavesurgelite32_64.exe" -i
    3⤵
    - Executes dropped EXE
    PID:3992
- - C:\Users\Admin\AppData\Local\Wave Surge Lite\wavesurgelite32_64.exe
    "C:\Users\Admin\AppData\Local\Wave Surge Lite\wavesurgelite32_64.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-AD9FM.tmp\a668c10fcc80d0d00a68e5f1ce29df536b4272111bf8f4a319b3011be748c09f.tmp

Filesize
680KB

MD5
be6fbb30efc852cf33e9049a6c5a6b3e

SHA1
f7117c84be1cbda6ee4aa05f926359a2b7bad3a6

SHA256
8f96c97e7e7b46daba226ab43b3421d290521053b3e7da7e5f2bb3daa640a65d

SHA512
19dbcf6ca2ad5f007045309a28f59f2b02010e5c27ec7c6eab4fca37a4ad96630daaa3a51519d83494a98f052aba29015de0705fc9ea650f7b5767b4b635cef1

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-KGHQ9.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Wave Surge Lite\wavesurgelite32_64.exe

Filesize
4.1MB

MD5
4c4b0684b94d72950e7748edcb69ce0e

SHA1
03f6f5d733fc48332b9fbddac2db198e2cdd4b20

SHA256
8387db11cd2bb47ccdfba8b9936e06a6ba822436de47d0126c14799b280555c5

SHA512
aa49635b6f0ac070465f19b0dce74e6334281922a7f4efa96ec4f80eef82c6c88838d67edae7e77f8fdee1a66ef4a0ea2e698e07d5275f60190c5f3304f8717f

Download Submit
memory/336-71-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/336-16-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/1296-101-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-72-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-119-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-116-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-112-0x0000000000A10000-0x0000000000AB2000-memory.dmp

Filesize
648KB

Download
memory/1296-67-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-69-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-111-0x0000000000A10000-0x0000000000AB2000-memory.dmp

Filesize
648KB

Download
memory/1296-110-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-104-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-75-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-76-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-79-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-82-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-85-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-88-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-89-0x0000000000A10000-0x0000000000AB2000-memory.dmp

Filesize
648KB

Download
memory/1296-95-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-98-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/1296-107-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/2768-70-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2768-1-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2768-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3992-60-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/3992-65-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/3992-61-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download
memory/3992-63-0x0000000000400000-0x0000000000819000-memory.dmp

Filesize
4.1MB

Download

Analysis

Sharing