socks5systemz | 9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff

General

Target

9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe
Size

5.0MB
MD5

0c82bd2253068701876844e50d7f27b2
SHA1

489b78bf82676ea0881f8303bb21d8be96c7bd9d
SHA256

9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff
SHA512

5f10b33a44f70076555624d660a79ea4816d98cc3ae450bc4bc2574ec2fb14d85ab4506c21864df4ae340bfedb8c83c66a96349ed664d0b671f8ccb9e4ab7ef4
SSDEEP

98304:C1htxAaXjiAs/rP/y3Gh5OOYU3on+uL5ZfRGSrv5cjZSgiEIBKHhQFh1+6Qx0:GxAaXHaMGh5RjnuL5FR/1OSNKChBQW

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2084-92-0x00000000026C0000-0x0000000002762000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp
2528	audioshell32_64.exe
2084	audioshell32_64.exe

Loads dropped DLL 6 IoCs

pid	Process
2852	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe
2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp
2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp
2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp
2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp
2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2852 wrote to memory of 2196	2852	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe	30
PID 2852 wrote to memory of 2196	2852	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe	30
PID 2852 wrote to memory of 2196	2852	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe	30
PID 2852 wrote to memory of 2196	2852	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe	30
PID 2852 wrote to memory of 2196	2852	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe	30
PID 2852 wrote to memory of 2196	2852	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe	30
PID 2852 wrote to memory of 2196	2852	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe	30
PID 2196 wrote to memory of 2528	2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp	31
PID 2196 wrote to memory of 2528	2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp	31
PID 2196 wrote to memory of 2528	2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp	31
PID 2196 wrote to memory of 2528	2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp	31
PID 2196 wrote to memory of 2084	2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp	32
PID 2196 wrote to memory of 2084	2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp	32
PID 2196 wrote to memory of 2084	2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp	32
PID 2196 wrote to memory of 2084	2196	9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp	32

C:\Users\Admin\AppData\Local\Temp\9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe
"C:\Users\Admin\AppData\Local\Temp\9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2852
- C:\Users\Admin\AppData\Local\Temp\is-4SGBS.tmp\9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-4SGBS.tmp\9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp" /SL5="$500E0,4954139,54272,C:\Users\Admin\AppData\Local\Temp\9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2196
- - C:\Users\Admin\AppData\Local\Audio Shell\audioshell32_64.exe
    "C:\Users\Admin\AppData\Local\Audio Shell\audioshell32_64.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2528
- - C:\Users\Admin\AppData\Local\Audio Shell\audioshell32_64.exe
    "C:\Users\Admin\AppData\Local\Audio Shell\audioshell32_64.exe" -s
    3⤵
    - Executes dropped EXE
    PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Audio Shell\audioshell32_64.exe

Filesize
3.6MB

MD5
b8a4a8c995daefe791fba5b6929df4f4

SHA1
2a098ff3e41cfd412ee4eff54e2365723ad591bd

SHA256
bf57dc65c236992a7e31e94716a9fae20c2d8e07cecfd4f581ad20bbc8254691

SHA512
7e82f816e9439614812999ab89376d8ceda372e528d50c70f6b5fd8535c41ef30c59a67629588f4cae1c3d64fda24e034796029819247a56fd39642ac33bd640

Download Submit
\Users\Admin\AppData\Local\Temp\is-4SGBS.tmp\9b6b0bae2adfc1ca0ed9d502b3fc6be8b4fadea5655e2d5568b114907b4888ff.tmp

Filesize
680KB

MD5
0e552ac434d24cbea702d252e19fe018

SHA1
9f3a97d08f4b79f7300b0844434e35529fb6139c

SHA256
4bd4ae40ca2af18fda601d850526445068b1c433da5a339f4b5c409cd7e2bb2c

SHA512
a6df85ae391aa938ccc93fcaccc38f37fb5533d23b600d47a5a7f246f98c28801b51b00e6c3763eb7f74bb5103bda89613ac1e9021a6020efec7d2d47604c9b5

Download Submit
\Users\Admin\AppData\Local\Temp\is-PKEP3.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
\Users\Admin\AppData\Local\Temp\is-PKEP3.tmp\_isetup\_shfoldr.dll

Filesize
22KB

MD5
92dc6ef532fbb4a5c3201469a5b5eb63

SHA1
3e89ff837147c16b4e41c30d6c796374e0b8e62c

SHA256
9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87

SHA512
9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3

Download Submit
memory/2084-107-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-113-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-137-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-132-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-129-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-126-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-123-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-120-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-117-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-75-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-78-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-110-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-82-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-85-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-88-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-91-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-92-0x00000000026C0000-0x0000000002762000-memory.dmp

Filesize
648KB

Download
memory/2084-98-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-101-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2084-104-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2196-79-0x0000000005A80000-0x0000000005E20000-memory.dmp

Filesize
3.6MB

Download
memory/2196-9-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2196-74-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2196-63-0x0000000005A80000-0x0000000005E20000-memory.dmp

Filesize
3.6MB

Download
memory/2528-69-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2528-66-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2528-65-0x0000000000400000-0x00000000007A0000-memory.dmp

Filesize
3.6MB

Download
memory/2852-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2852-73-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2852-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing