socks5systemz | e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae

General

Target

e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.exe
Size

5.0MB
MD5

eb8b873ff562781236d4b8655495386b
SHA1

f1d1ebe03ce2d8be00626b286f9d377080cf1354
SHA256

e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae
SHA512

2d9b0b1c16a7f122aaed62e873a21f349a81c8b8dc7bb5133ede6f04c8952093daaed5e1f2f10ab55f590b32681d7fa8907247cf94fbdeeae5b373d2629bf12a
SSDEEP

98304:CtBaiYQjSINxSMCTEQVUC0ZUhnrkvtHh1V5pyQHFXAXCNnHsehZaZUKY3gaqU6A9:8gbn1hnrkvL5ph9iCNnMehZae53sPAQc

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 4 IoCs

resource	yara_rule
behavioral1/memory/3936-85-0x00000000029E0000-0x0000000002A82000-memory.dmp	family_socks5systemz
behavioral1/memory/3936-109-0x00000000029E0000-0x0000000002A82000-memory.dmp	family_socks5systemz
behavioral1/memory/3936-108-0x00000000029E0000-0x0000000002A82000-memory.dmp	family_socks5systemz
behavioral1/memory/3936-110-0x00000000029E0000-0x0000000002A82000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp
1064	vpkaudioplayer32_64.exe
3936	vpkaudioplayer32_64.exe

Loads dropped DLL 1 IoCs

pid	Process
2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	91.211.247.248

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 792 wrote to memory of 2008	792	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.exe	83
PID 792 wrote to memory of 2008	792	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.exe	83
PID 792 wrote to memory of 2008	792	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.exe	83
PID 2008 wrote to memory of 1064	2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp	87
PID 2008 wrote to memory of 1064	2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp	87
PID 2008 wrote to memory of 1064	2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp	87
PID 2008 wrote to memory of 3936	2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp	88
PID 2008 wrote to memory of 3936	2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp	88
PID 2008 wrote to memory of 3936	2008	e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp	88

C:\Users\Admin\AppData\Local\Temp\e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.exe
"C:\Users\Admin\AppData\Local\Temp\e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:792
- C:\Users\Admin\AppData\Local\Temp\is-0JQ93.tmp\e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-0JQ93.tmp\e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp" /SL5="$E0068,5028360,54272,C:\Users\Admin\AppData\Local\Temp\e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer32_64.exe
    "C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer32_64.exe" -i
    3⤵
    - Executes dropped EXE
    PID:1064
- - C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer32_64.exe
    "C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer32_64.exe" -s
    3⤵
    - Executes dropped EXE
    PID:3936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\is-0JQ93.tmp\e4f1c4bd22684b0dfc15a1fed6f151edb29a1de6bb121db345fad43cf15fadae.tmp

Filesize
680KB

MD5
f904efc1c282336911efced980685605

SHA1
83e12f03639241a533a85e486bf6fdc6a3151ca0

SHA256
4baa1a18b7cc49231119545024fc8d076e1db42aea16d11b35d2acd85a49a217

SHA512
110ce1352530a9d7c11edb6545bd173d8c23b4547dcb118045cf4c6f8b36ada5c0cef6515935f90747d3792275648c6af920307e76ad82c49d912e6f82ebb1f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-CEQK3.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\VPK Audio Player\vpkaudioplayer32_64.exe

Filesize
4.2MB

MD5
9d95391ab309dd340cadd20d80815417

SHA1
ba44b8727cec52b11bac95c0ad70f01a51bb24c5

SHA256
37b17879279c28b5be09ce392181cb45a292988eb772757a5a24ef79e6698bc9

SHA512
9b3bcf7211424916a2f5af5633912408c00c657f3228a721e470c0260a1a5c4049d41896f9ac80078610318bed580859378448bb253448a31031d53c6ff6cd96

Download Submit
memory/792-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/792-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/792-68-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/1064-60-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/1064-61-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/1064-64-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/2008-69-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/2008-7-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/3936-76-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-95-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-73-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-67-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-79-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-82-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-85-0x00000000029E0000-0x0000000002A82000-memory.dmp

Filesize
648KB

Download
memory/3936-87-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-92-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-70-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-98-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-101-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-104-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-107-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-109-0x00000000029E0000-0x0000000002A82000-memory.dmp

Filesize
648KB

Download
memory/3936-108-0x00000000029E0000-0x0000000002A82000-memory.dmp

Filesize
648KB

Download
memory/3936-110-0x00000000029E0000-0x0000000002A82000-memory.dmp

Filesize
648KB

Download
memory/3936-115-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download
memory/3936-122-0x0000000000400000-0x000000000082C000-memory.dmp

Filesize
4.2MB

Download

Analysis

Sharing