socks5systemz | f628b63f5984e44746bbfa5cc79d2a8fc61e366178bf7cf7ac9d454714f42886

Analysis

max time kernel
142s
max time network
128s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
24/07/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LisectAVT_2403002A_171.exe
Size 2.2MB
Sample240724-3rr6msvbjl
SHA256 f628b63f5984e44746bbfa5cc79d2a8fc61e366178bf7cf7ac9d454714f42886
MD5 041424055bed4ec879f5c153510b6bac
SHA1 5e990bd3e913c2e5d086e165732de340f53d034b
SHA512 f3dabc06ecdb7ad83c8b7303b840304f0fcc9b3f67fbcb01fe59ba7dd8be953dca1da7b3e50d89bd1510eef8ad04e4ba197ab83786d57faeb2294b2c22e80fb7
SSDEEP 49152:32DbrhTeTjpdvbXKGJ1X2nIIT6yXaHs4NgJ:mDbrMjpdjJTX2n+VM4NgJ
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

socks5systemz botnet discovery

Malware Config

Extracted

Family

socks5systemz

bvoegbe.com
http://bvoegbe.com/search/?q=67e28dd83e5cf17e165cab1e7c27d78406abdd88be4b12ebb517aa5c96bd86ed82df14d714bca5817673aa4de8889b5e4fa9281ae978a771ea771795af8e05c645db22f31df92d8b38e316a667d307eca743ec4c2b07b5296692396686f915c7e89c

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2908-70-0x00000000026B0000-0x0000000002752000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
1028	LisectAVT_2403002A_171.tmp
2824	colorpicker.exe
2908	colorpicker.exe

Loads dropped DLL 5 IoCs

pid	Process
1368	LisectAVT_2403002A_171.exe
1028	LisectAVT_2403002A_171.tmp
1028	LisectAVT_2403002A_171.tmp
1028	LisectAVT_2403002A_171.tmp
1028	LisectAVT_2403002A_171.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	152.89.198.214

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorpicker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	colorpicker.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002A_171.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	LisectAVT_2403002A_171.tmp

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 1028	1368	LisectAVT_2403002A_171.exe	30
PID 1368 wrote to memory of 1028	1368	LisectAVT_2403002A_171.exe	30
PID 1368 wrote to memory of 1028	1368	LisectAVT_2403002A_171.exe	30
PID 1368 wrote to memory of 1028	1368	LisectAVT_2403002A_171.exe	30
PID 1368 wrote to memory of 1028	1368	LisectAVT_2403002A_171.exe	30
PID 1368 wrote to memory of 1028	1368	LisectAVT_2403002A_171.exe	30
PID 1368 wrote to memory of 1028	1368	LisectAVT_2403002A_171.exe	30
PID 1028 wrote to memory of 2824	1028	LisectAVT_2403002A_171.tmp	31
PID 1028 wrote to memory of 2824	1028	LisectAVT_2403002A_171.tmp	31
PID 1028 wrote to memory of 2824	1028	LisectAVT_2403002A_171.tmp	31
PID 1028 wrote to memory of 2824	1028	LisectAVT_2403002A_171.tmp	31
PID 1028 wrote to memory of 2908	1028	LisectAVT_2403002A_171.tmp	32
PID 1028 wrote to memory of 2908	1028	LisectAVT_2403002A_171.tmp	32
PID 1028 wrote to memory of 2908	1028	LisectAVT_2403002A_171.tmp	32
PID 1028 wrote to memory of 2908	1028	LisectAVT_2403002A_171.tmp	32

C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_171.exe
"C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_171.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Users\Admin\AppData\Local\Temp\is-MJ0C8.tmp\LisectAVT_2403002A_171.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-MJ0C8.tmp\LisectAVT_2403002A_171.tmp" /SL5="$4010A,1943765,54272,C:\Users\Admin\AppData\Local\Temp\LisectAVT_2403002A_171.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Users\Admin\AppData\Local\Color Picker\colorpicker.exe
    "C:\Users\Admin\AppData\Local\Color Picker\colorpicker.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2824
- - C:\Users\Admin\AppData\Local\Color Picker\colorpicker.exe
    "C:\Users\Admin\AppData\Local\Color Picker\colorpicker.exe" -s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

colorpicker.exe

Path \Users\Admin\AppData\Local\Color Picker\colorpicker.exe
Size 2.2MB
SHA256 9e88759b12e04e21199bb9c536f5a0f56ca9e291fad87270573e94de1d79eb9d
MD5 4fb7c9f8330a5f6e5c1fd0b95f4bcebe
SHA1 e634bf322484061ef0bc5e32714c3f239b1142d5
SHA512 9eecf2791448a3020292fe7a90fb0966a21433f03ff9b4bf57ff5ed8f71b6cfdae985978a7547e3fd336ae9fa51f788841f9308bb264fcd0256121fb4b9ee46e
SSDEEP 49152:/p5p0n3pFp6p5Sp18pawjpi3tVku0jDqiD/lXeJ+cOMx72mxsJ:/p5p0n3pFp6p5Sp18pdjpQtVklvqiteo
MD5 SHA1 SHA512 SSDEEP

Submit Download

_iscrypt.dll

Path \Users\Admin\AppData\Local\Temp\is-821GL.tmp\_isetup\_iscrypt.dll
Size 2KB
SHA256 2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc
MD5 a69559718ab506675e907fe49deb71e9
SHA1 bc8f404ffdb1960b50c12ff9413c893b56f2e36f
SHA512 e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63
MD5 SHA1 SHA512

Submit Download

_shfoldr.dll

Path \Users\Admin\AppData\Local\Temp\is-821GL.tmp\_isetup\_shfoldr.dll
Size 22KB
SHA256 9884e9d1b4f8a873ccbd81f8ad0ae257776d2348d027d811a56475e028360d87
MD5 92dc6ef532fbb4a5c3201469a5b5eb63
SHA1 3e89ff837147c16b4e41c30d6c796374e0b8e62c
SHA512 9908e573921d5dbc3454a1c0a6c969ab8a81cc2e8b5385391d46b1a738fb06a76aa3282e0e58d0d2ffa6f27c85668cd5178e1500b8a39b1bbae04366ae6a86d3
SSDEEP 384:+Vm08QoKkiWZ76UJuP71W55iWHHoSHigH2euwsHTGHVb+VHHmnH+aHjHqLHxmoq1:2m08QotiCjJuPGw4
MD5 SHA1 SHA512 SSDEEP

Submit Download

LisectAVT_2403002A_171.tmp

Path \Users\Admin\AppData\Local\Temp\is-MJ0C8.tmp\LisectAVT_2403002A_171.tmp
Size 677KB
SHA256 405e474735b776fc09dc71d3a5b44c50b9e2c745cdf7e79eb89dc791866ffe2a
MD5 d394fc26de69f06950dc1c71959b0261
SHA1 7c9448fc3582f19763eaa8e3c5383b7873aee017
SHA512 63ef7265aac27715f5b799b588955dd5df3f49ecd0042fba69d0effe7dfe24d6777079677a809e817e4e8243a2185ca9c3a8022c9247bb2a070c213f06d7bc10
SSDEEP 12288:lhg/qrLc0yVrPg37AzHqA63JJVndjzrN6IRpOz+u1nWXExyd:A/qrQ0yVrPg37AzHqA6Zfn0z3NWXExyd
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1028-12-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/1028-42-0x0000000003B40000-0x0000000003D79000-memory.dmp

Download

memory/1028-56-0x0000000003B40000-0x0000000003D79000-memory.dmp

Download

memory/1028-52-0x0000000000400000-0x00000000004B8000-memory.dmp

Download

memory/1368-51-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/1368-3-0x0000000000401000-0x000000000040B000-memory.dmp

Download

memory/1368-0-0x0000000000400000-0x0000000000414000-memory.dmp

Download

memory/2824-44-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2824-45-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2824-48-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-70-0x00000000026B0000-0x0000000002752000-memory.dmp

Download

memory/2908-76-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-60-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-63-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-66-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-69-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-53-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-57-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-79-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-82-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-85-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-88-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-91-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-95-0x0000000000400000-0x0000000000639000-memory.dmp

Download

memory/2908-98-0x0000000000400000-0x0000000000639000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads