socks5systemz | e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739

General

Target

e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.exe
Size

5.0MB
MD5

93d3f7fab3863e140034776ead4ef7e4
SHA1

e373b677ef7e3322d8c3ff513e1308ec528a6282
SHA256

e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739
SHA512

663bfe84a2c8ff3e20ce8c6640ed0e4058c8f459a741d016257b2d99d9026ce8a3306d9a0979540d1e606ab0014d329dbcbce5be10976c892757c2e78f8c7638
SSDEEP

98304:CFz47URAjBaCHSMwnyJ3EocMLXHf00eQl2ApovjcIduYteQ4nd23Qx+:6y5FaCHInyNEDMLXctQl2JjcQ9s3dyQ8

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral2/memory/3456-87-0x0000000002620000-0x00000000026C2000-memory.dmp	family_socks5systemz
behavioral2/memory/3456-111-0x0000000002620000-0x00000000026C2000-memory.dmp	family_socks5systemz
behavioral2/memory/3456-110-0x0000000002620000-0x00000000026C2000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp
2376	vpkaudioplayer.exe
3456	vpkaudioplayer.exe

Loads dropped DLL 1 IoCs

pid	Process
3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 564 wrote to memory of 3620	564	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.exe	82
PID 564 wrote to memory of 3620	564	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.exe	82
PID 564 wrote to memory of 3620	564	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.exe	82
PID 3620 wrote to memory of 2376	3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp	83
PID 3620 wrote to memory of 2376	3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp	83
PID 3620 wrote to memory of 2376	3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp	83
PID 3620 wrote to memory of 3456	3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp	84
PID 3620 wrote to memory of 3456	3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp	84
PID 3620 wrote to memory of 3456	3620	e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp	84

C:\Users\Admin\AppData\Local\Temp\e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.exe
"C:\Users\Admin\AppData\Local\Temp\e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:564
- C:\Users\Admin\AppData\Local\Temp\is-O5OKI.tmp\e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-O5OKI.tmp\e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp" /SL5="$60168,4986721,54272,C:\Users\Admin\AppData\Local\Temp\e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer.exe
    "C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer.exe" -i
    3⤵
    - Executes dropped EXE
    PID:2376
- - C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer.exe
    "C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-34SVB.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-O5OKI.tmp\e528d79e2e022a617340e8e2b1a88b399b75dd7477bcac6c9cda931e1fd58739.tmp

Filesize
680KB

MD5
0d33bfdd652a7613e11b045250707f60

SHA1
6ceb98f094f315384f7291cfa3cb7178dae97935

SHA256
d1d63bf2c6eb19683e97866004224e5ffa15f196a4de0322b2ed4e1534a99b1a

SHA512
6b34877d8863dcae3c983d8df6c6377f1a1d2bcb9d8a55e828185aade6a101469f435b107fbccc2a98b324381c88315b736bb20a2224031f53949e7675959a63

Download Submit
C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer.exe

Filesize
4.0MB

MD5
c7e23f6fc4389e050f5119030b91a605

SHA1
0db986e1e5b50ec0bb28eed072d3699425cba38a

SHA256
95122cda60c7abda2e7207fa5fedcbb3081b633bbe7be98a312f78a5b2f8e0a7

SHA512
3e30c7bf6837e7ee1d290b014f753de3b6dd5d52f8f8e78b23d0d357f1a0cfcc32bbccb511803606eeef0ccde806ad598d73aa85f041c159d62336858b762dbb

Download Submit
memory/564-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/564-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/564-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/2376-60-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/2376-63-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/2376-62-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-74-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-88-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-68-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-118-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-71-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-115-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-75-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-78-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-81-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-84-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-87-0x0000000002620000-0x00000000026C2000-memory.dmp

Filesize
648KB

Download
memory/3456-67-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-94-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-97-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-100-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-103-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-106-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-109-0x0000000000400000-0x00000000007FA000-memory.dmp

Filesize
4.0MB

Download
memory/3456-111-0x0000000002620000-0x00000000026C2000-memory.dmp

Filesize
648KB

Download
memory/3456-110-0x0000000002620000-0x00000000026C2000-memory.dmp

Filesize
648KB

Download
memory/3620-13-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3620-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download

Analysis

Sharing