socks5systemz | 7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4

General

Target

7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.exe
Size

5.3MB
MD5

b40fe16074164bd722f57a7b53747339
SHA1

976439ccab616b5256cd0e7695556732c968bded
SHA256

7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4
SHA512

38244330e4de2a158165c14ed59391ef53d357c6130b74a454dad73d652427e22014c0345664ac849588309e1654711d067ce9d6af3420b26f6f3fe1a789c40a
SSDEEP

98304:C+Z10Aah8KhIF2Cplwr/BMAZsi3VtTdQwLkVVlLj/xZwiWrrasIxMsUmfc6XjNq7:P/0AaKlwtMAkwLAlpZwio2jhUmVjNqQS

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/4700-84-0x0000000002690000-0x0000000002732000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp
116	goldenmusicalvariety32_64.exe
4700	goldenmusicalvariety32_64.exe

Loads dropped DLL 1 IoCs

pid	Process
4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 4948	3200	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.exe	84
PID 3200 wrote to memory of 4948	3200	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.exe	84
PID 3200 wrote to memory of 4948	3200	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.exe	84
PID 4948 wrote to memory of 116	4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp	87
PID 4948 wrote to memory of 116	4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp	87
PID 4948 wrote to memory of 116	4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp	87
PID 4948 wrote to memory of 4700	4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp	88
PID 4948 wrote to memory of 4700	4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp	88
PID 4948 wrote to memory of 4700	4948	7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp	88

C:\Users\Admin\AppData\Local\Temp\7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.exe
"C:\Users\Admin\AppData\Local\Temp\7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\is-MCS3B.tmp\7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MCS3B.tmp\7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp" /SL5="$E004A,5265197,54272,C:\Users\Admin\AppData\Local\Temp\7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Users\Admin\AppData\Local\Golden Musical Variety\goldenmusicalvariety32_64.exe
    "C:\Users\Admin\AppData\Local\Golden Musical Variety\goldenmusicalvariety32_64.exe" -i
    3⤵
    - Executes dropped EXE
    PID:116
- - C:\Users\Admin\AppData\Local\Golden Musical Variety\goldenmusicalvariety32_64.exe
    "C:\Users\Admin\AppData\Local\Golden Musical Variety\goldenmusicalvariety32_64.exe" -s
    3⤵
    - Executes dropped EXE
    PID:4700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Golden Musical Variety\goldenmusicalvariety32_64.exe

Filesize
4.0MB

MD5
7020ea79f6a27a7ed64f7d9b2af761de

SHA1
592f91a796a638dc2e7c09475e0cb1872e13fa19

SHA256
4e47724642e3eb58e37bff21bef16f406ce30b45cd1fa91e6dee6ad7bb51a55a

SHA512
025cbd63109bdd1eb703c598cff3c6e38993418ba1a38f9fcd283f1ff303f80b80c6b254de2dc8820b66a62b618eb0ef12ae0256fee22033b8a5ba589738dcc6

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-0KCLU.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MCS3B.tmp\7a694a69d16b2d63b6bb84009be9075eb371932b10c7542467b2b6dcab71fde4.tmp

Filesize
680KB

MD5
d5ec4393caa19bd6d2f1f55888f13eaa

SHA1
84fc0ffa4a35cd11bf0d04d5b64911c7503d7e85

SHA256
61d61b715672c4118de8efb9066f61c28a1eec72ac8790b0d03ffafe0f9d0a00

SHA512
d7d710cde5d4ff969f04a5ec41817ee147680f26f7fae5bd4aa1c3a8eac2f0d0b3d4329e95635c1f213fe0dbdadeb89afd841215c7930403cb7bba55e7782479

Download Submit
memory/116-61-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/116-60-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/116-62-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/116-64-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/3200-67-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/3200-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/3200-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4700-69-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-91-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-113-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-72-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-75-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-78-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-81-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-84-0x0000000002690000-0x0000000002732000-memory.dmp

Filesize
648KB

Download
memory/4700-86-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-110-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-94-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-97-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-100-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-103-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4700-106-0x0000000000400000-0x0000000000800000-memory.dmp

Filesize
4.0MB

Download
memory/4948-68-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4948-12-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing