socks5systemz | cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e

General

Target

cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e.exe
Size

6.7MB
MD5

39c9e80e32b15c9010648e422e412ea1
SHA1

7053c8f8e505cbb18b4fa4cbc2e732b4f01f5362
SHA256

cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e
SHA512

430fb5def8e95c34f5b2a01ced0d07f9d10c3709795158e670a19b48e18701f8d9a5e5ea5a75d07661670f0ea7ec0ec5401fc0d502c005c5e1f2121b7e200499
SSDEEP

98304:yieZa9eR1unPOAySJBA6UoVcV3O/LBNO10XGFudYb5xAuNTkQa0/d5N20TfMnkj:34uPGAZL2pOTBNqQGNBNXaC5cMfwq

Score

10^/10

Malware Config

Signatures

Detect Socks5Systemz Payload 1 IoCs

resource	yara_rule
behavioral2/memory/2464-83-0x00000000025B0000-0x0000000002652000-memory.dmp	family_socks5systemz

Socks5Systemz
Socks5Systemz is a botnet written in C++.
botnet socks5systemz

Executes dropped EXE 3 IoCs

pid	Process
3220	is-9J90L.tmp
32	mp3cdripperbeta32_64.exe
2464	mp3cdripperbeta32_64.exe

Loads dropped DLL 1 IoCs

pid	Process
3220	is-9J90L.tmp

Unexpected DNS network traffic destination 1 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	ioc
Destination IP	141.98.234.31

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	is-9J90L.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mp3cdripperbeta32_64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	mp3cdripperbeta32_64.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 3220	1036	cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e.exe	81
PID 1036 wrote to memory of 3220	1036	cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e.exe	81
PID 1036 wrote to memory of 3220	1036	cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e.exe	81
PID 3220 wrote to memory of 32	3220	is-9J90L.tmp	83
PID 3220 wrote to memory of 32	3220	is-9J90L.tmp	83
PID 3220 wrote to memory of 32	3220	is-9J90L.tmp	83
PID 3220 wrote to memory of 2464	3220	is-9J90L.tmp	84
PID 3220 wrote to memory of 2464	3220	is-9J90L.tmp	84
PID 3220 wrote to memory of 2464	3220	is-9J90L.tmp	84

C:\Users\Admin\AppData\Local\Temp\cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e.exe
"C:\Users\Admin\AppData\Local\Temp\cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\is-140L3.tmp\is-9J90L.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-140L3.tmp\is-9J90L.tmp" /SL4 $502D6 "C:\Users\Admin\AppData\Local\Temp\cef8b12b6541259d5fc2001e648b8fe33d58a001745a2bbe4cc9068bb961de2e.exe" 6765812 52224
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Users\Admin\AppData\Local\MP3 CD Ripper Beta\mp3cdripperbeta32_64.exe
    "C:\Users\Admin\AppData\Local\MP3 CD Ripper Beta\mp3cdripperbeta32_64.exe" -i
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:32
- - C:\Users\Admin\AppData\Local\MP3 CD Ripper Beta\mp3cdripperbeta32_64.exe
    "C:\Users\Admin\AppData\Local\MP3 CD Ripper Beta\mp3cdripperbeta32_64.exe" -s
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:2464

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\MP3 CD Ripper Beta\mp3cdripperbeta32_64.exe

Filesize
3.1MB

MD5
969b33e0941fcd6a0e503c358f0ba03e

SHA1
28c81cc5df08c18b0f0e469510be8a9c9e3f402f

SHA256
44a960a466af20797daf0c7732a04d0195bea638242430d52cc387deda87b6f3

SHA512
ea007d6fcf7d2dd4b3d566195ba2c6450a623b78587a56c7494f32911ebcdb634d25293dfd47ef8eae698525b67c137392cce41a1d8faaea74c4b65a99009b88

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-140L3.tmp\is-9J90L.tmp

Filesize
642KB

MD5
6580f6f26daf83c5e4d3e3b28e2f70f6

SHA1
5bc35126a341e038b96923db25c3f5424a631c5e

SHA256
e241bd09fc67344895f45de4fb9f147d618a8a5bcec360c83882675e75ebd672

SHA512
8f042bbbaec8f0a7cb31cfa44ed0e3d72100e3f3473f442e06ffc7f90322da4cb54979ba51365033cba927b801225d339e64b3b31c3b57483b76bd006908dd36

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-SSSS2.tmp\_iscrypt.dll

Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
memory/32-57-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/32-58-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/32-60-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/32-62-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/1036-66-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/1036-2-0x0000000000401000-0x000000000040A000-memory.dmp

Filesize
36KB

Download
memory/1036-0-0x0000000000400000-0x0000000000413000-memory.dmp

Filesize
76KB

Download
memory/2464-71-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-84-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-112-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-68-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-109-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-74-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-77-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-80-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-83-0x00000000025B0000-0x0000000002652000-memory.dmp

Filesize
648KB

Download
memory/2464-65-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-90-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-93-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-96-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-99-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-102-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/2464-105-0x0000000000400000-0x000000000071A000-memory.dmp

Filesize
3.1MB

Download
memory/3220-8-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download
memory/3220-67-0x0000000000400000-0x00000000004CF000-memory.dmp

Filesize
828KB

Download

Analysis

Sharing