socks5systemz | 3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b

General

Target

3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.exe
Size

5.2MB
MD5

9ed525fc8e2e9aa3afff6aea16ea27f5
SHA1

77701603367ae89c98111a5bc50c4d223bf77335
SHA256

3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b
SHA512

3515a42ffcf1a444153f90f9a9f13ea4d1cd615b56666acaf3ff5f30f13f28928a0e52ebdfa1eea198bd837d14e809d2c2451df842e6eb2980fc549a84d60b1b
SSDEEP

98304:CDLpgIJdS0+LbAgpmhkx5oPBOmyysWKMBXyyTpZiLgo6QxQQ:sLbJ0lbAgpmekPIZy7KMpyKiLgBQr

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 3 IoCs

resource	yara_rule
behavioral1/memory/1464-86-0x0000000002760000-0x0000000002802000-memory.dmp	family_socks5systemz
behavioral1/memory/1464-109-0x0000000002760000-0x0000000002802000-memory.dmp	family_socks5systemz
behavioral1/memory/1464-110-0x0000000002760000-0x0000000002802000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp
4888	freevideoplayer.exe
1464	freevideoplayer.exe

Loads dropped DLL 1 IoCs

pid	Process
4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4168	4860	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.exe	85
PID 4860 wrote to memory of 4168	4860	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.exe	85
PID 4860 wrote to memory of 4168	4860	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.exe	85
PID 4168 wrote to memory of 4888	4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp	89
PID 4168 wrote to memory of 4888	4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp	89
PID 4168 wrote to memory of 4888	4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp	89
PID 4168 wrote to memory of 1464	4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp	90
PID 4168 wrote to memory of 1464	4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp	90
PID 4168 wrote to memory of 1464	4168	3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp	90

C:\Users\Admin\AppData\Local\Temp\3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.exe
"C:\Users\Admin\AppData\Local\Temp\3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\is-M3OVH.tmp\3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-M3OVH.tmp\3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp" /SL5="$5021C,5196154,54272,C:\Users\Admin\AppData\Local\Temp\3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Users\Admin\AppData\Local\Free Video Player\freevideoplayer.exe
    "C:\Users\Admin\AppData\Local\Free Video Player\freevideoplayer.exe" -i
    3⤵
    - Executes dropped EXE
    PID:4888
- - C:\Users\Admin\AppData\Local\Free Video Player\freevideoplayer.exe
    "C:\Users\Admin\AppData\Local\Free Video Player\freevideoplayer.exe" -s
    3⤵
    - Executes dropped EXE
    PID:1464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Free Video Player\freevideoplayer.exe

Filesize
4.7MB

MD5
34c823c34a1b20cea996e056ead0d1cc

SHA1
e7afb4490118ab848ca9a381c654e51b8baaec03

SHA256
35e6ffd482d562f7746b347c7cc1c05eb7929953fb41d6e7f1cebcfad3ec4d05

SHA512
70a10adc384c3bc8978906b24e0db79c9c3c2b8677949b64c2c9c3f63646051c85d96b2dc9f97e48ab3b5036216b74314d6a7789659538c9b967c92791d40cae

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-I0TEH.tmp\_isetup\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-M3OVH.tmp\3150a979e720ba9a168ac4d2f2981af1d94cc2a92f128b00b03e82e0646ae32b.tmp

Filesize
680KB

MD5
834337c0b7947083a33ebbd3d51d9df6

SHA1
a0cded29048837eeeb8cbc6ead7f2c446e9284ca

SHA256
8d11bd3d088abe8ca01648da74dcf112a3ed96f00ac8e901c12126277e1be265

SHA512
cf8928a62b5a647059b1737512d9c4d8f01e4f4d27319baf9db5872991cc584564946be6220de19ee1d11ab2bf1ba634b0688a9996285d3c780f5bab3dab6254

Download Submit
memory/1464-96-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-80-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-117-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-114-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-110-0x0000000002760000-0x0000000002802000-memory.dmp

Filesize
648KB

Download
memory/1464-109-0x0000000002760000-0x0000000002802000-memory.dmp

Filesize
648KB

Download
memory/1464-108-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-68-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-105-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-102-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-71-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-74-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-77-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-99-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-83-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-86-0x0000000002760000-0x0000000002802000-memory.dmp

Filesize
648KB

Download
memory/1464-90-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/1464-93-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/4168-13-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4168-70-0x0000000000400000-0x00000000004BA000-memory.dmp

Filesize
744KB

Download
memory/4860-0-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4860-69-0x0000000000400000-0x0000000000414000-memory.dmp

Filesize
80KB

Download
memory/4860-2-0x0000000000401000-0x000000000040B000-memory.dmp

Filesize
40KB

Download
memory/4888-65-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/4888-63-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/4888-61-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download
memory/4888-60-0x0000000000400000-0x00000000008AB000-memory.dmp

Filesize
4.7MB

Download

Analysis

Sharing